It is possible in Kubernetes to run container images in read-only mode as explained in https://cloud.redhat.com/blog/add-a-layer-of-security-to-openshift-kubernetes-with-cri-o-in-read-only-mode.

We should make it possible to run WildFly in such a read-only mode.
Most of WildFly I/O activity is inside $JBOSS_HOME but we need to write in /tmp for some bootstrap scripts iirc.