A production container should resist an attack that installs tools into its root filesystem. Which controls directly support a less mutable runtime? Select 2.

1. Deliver changes by rebuilding and redeploying reviewed images
2. Use a read-only root filesystem where the application supports it
3. Give every workload privileged mode
4. Mount the host's root directory read-write in every container