readOnlyRootFilesystem is one setting that controls whether a container is able to write into its filesystem. It's a feature most want enabled in the event of a hack - if an attacker gets in, they won't be able to tamper with the application or write foreign executables to disk.