This is an Quay specific issue for this directive: https://issues.redhat.com/browse/OCPSTRAT-1699

Summary:

Red Hat Product Security recommends that pods be deployed with readOnlyRootFilesystem set to true in the SecurityContext, but does not require it because a successful attack can only be carried out with a combination of weaknesses and OpenShift runs with a variety of mitigating controls. 

However, customers are increasingly asking questions about why pods from Red Hat, and deployed as part of OpenShift, do not follow common hardening recommendations. 

Note that setting readOnlyRootFilesystem to true ensures that the container's root filesystem is mounted as read-only. This setting has nothing to do with host access. 

We need to:

1. Investigate the impact to Quay, Clair, Postgres & Redis
2. If necessary, make appropriate changes in either Quay 3.15 or 3.16