A container should prevent writes to its root filesystem but still needs a writable /tmp directory. Which arrangement meets both requirements?

1. Set readOnlyRootFilesystem: true and mount a suitable writable volume at /tmp
2. Grant privileged: true so /tmp is automatically protected
3. Mount every node's root filesystem read-write at /tmp
4. Set readOnlyRootFilesystem: false and trust a readonly=true label