add readonly root filesystem

[jay-whitwell]

Purpose

Briefly describe the purpose of the change, and/or link to the JIRA ticket for context

Fixes UML-####

Approach

Explain how your code addresses the purpose of the change

Learning

Any tips and tricks, blog posts or tools which helped you. Plus anything notable you've discovered about the Use a Lasting Power of Attorney service

Checklist

• I have performed a self-review of my own code
• I have added relevant logging with appropriate levels to my code
• New event_codes have been documented on the wiki page
• I have updated documentation (Confluence/GitHub wiki/tech debt doc) where relevant
• I have added tests to prove my work
• I have added welsh translation tags and updated translation files
• I have run an accessibility tool on any pages I have made changes to and fixed any issues found
• I have notified the Interaction Designer of any content changes so that appropriate screenshots/flow diagram changes can be made
• The product team have tested these changes

[cooperaj]

lgtm.

Think we should wait till the system message fix goes up before merging though.

[cooperaj]

Although it all looks to work something we should be aware of is that the the service-front apps will be writing to the /tmp folders with template caches and the like.

We could look at baking that caching process into the images maybe but it's likely to be easier to allow those images write access to /tmp.