Read-only by default
2026-11-02
Most services need to write to two or three places at most. Everything else on the filesystem can be read-only from their point of view, and modern init systems make that a single line of configuration.
The benefit is not only security. A service that can only write where you expect it to will never fill up the root partition with a forgotten debug file.