Comment by manuel_w

There's one (not always but often enough) viable alternative to read-only root filesystems that is often overlooked. It's the possibility to copy the entire rootfs onto a ramdisk when booting. It increases the boot time and obviously disables persisting data (logs etc.), but often these are not needed anyway.

It's just a few lines of code in initramfs!

    --- a/usr/share/initramfs-tools/scripts/local 2021-11-05 12:50:23.541088057 +0100
    +++ b/usr/share/initramfs-tools/scripts/local 2021-11-05 13:02:14.483203576 +0100
    @@ -180,9 +180,20 @@
    
        # Mount root
        # shellcheck disable=SC2086
    - if ! mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
    -  panic "Failed to mount ${ROOT} as root file system."
    - fi
    + #if ! mount ${roflag} ${FSTYPE:+-t "${FSTYPE}"} ${ROOTFLAGS} "${ROOT}" "${rootmnt?}"; then
    + # panic "Failed to mount ${ROOT} as root file system."
    + #fi
    +
    + mkdir --parents /tmp/diskroot
    + mount -t ${FSTYPE} ${roflag} ${ROOTFLAGS} ${ROOT} /tmp/diskroot
    +
    + mount -t tmpfs -o size=6G none ${rootmnt?}
    + chmod 755 ${rootmnt}
    +
    + cp --force --archive --verbose /tmp/diskroot/* ${rootmnt}
    +
    + umount /tmp/diskroot
    + rm -r --force /tmp/diskroot
    }
    
    local_mount_fs()

and `update-initramfs -u`.