[RFE] Read-only root partition after first boot

[sergey-cheperis]

Current situation

For improved security I was trying to run Flatcar VM in an environment where:

• /var is located on a writable image.
• The Flatcar image which includes the boot partition, ROOT, OEM, USR-* becomes read-only on the second (non-ignition) boot.

This environment does not use auto-updates, instead the whole VM image is rebuilt with up-to-date Flatcar, so making it read only seems reasonable according to the least privilege principle.

I've found out that, even on the second and subsequent boots, the system tries to write something in /etc and thus fails to boot.

Impact

I am not able to run the VM from using a read only root image.

Ideal future situation

I would able to run it in an environment where only /var is writable.

Implementation options

I think that the functionality which depends on writing /etc on second and subsequent boots is minor and might probably have an option to be turned off. I assume this may be even already possible at the moment but not documented.