Add readonly rootfs option