scripts for creating read-only rootfs