Comment by demomode

Also: consider using overlayfs to make root fs read-only