After enabling readOnlyRootFilesystem, a portal Pod CrashLoops because it writes temporary files under /tmp. What is the correct fix?
Select an answer to reveal the explanation.
Short Explanation
Read-only root plus a dedicated emptyDir at /tmp is the classic "lock the house, leave a notepad" fix. Don't dump privileged mode or abandon the hardening flag just because /tmp needs writes.
Full Explanation
Applications that require temporary files must have an explicit writable mount when the root filesystem is read-only. Mounting emptyDir at /tmp (or another scratch path) preserves readOnlyRootFilesystem while restoring needed write access. Privileged mode and world-writable image roots defeat hardening; ConfigMaps are not a temp filesystem.