Read-only image support

Consider enabling the image to run in 'read-only root' mode (docker --read-only) as this is a common security guideline, and specify the locations in the image with dynamic data with Dockerfile VOLUME directives.

Start by locating the image's Dockerfile and identifying which paths require dynamic data. Run the image with Docker's --read-only option to observe failures, then verify that required writable locations are declared with VOLUME directives and that the image operates successfully in read-only root mode.

Written by the indexing model from the issue text.