docker-compose: read-only container root fs

docker-compose.yml

@@ -33,6 +33,9 @@ services:
     volumes:
     - host_keys:/etc/ssh/host_keys:rw
     - authorized_keys:/home/dump/.ssh:ro
+    tmpfs:
+    - /tmp:nosuid,nodev,exec,size=4k # /tmp/mysqldump.sh
+    read_only: true
     ports:
     - 127.0.0.1:2222:2222
     security_opt: ['no-new-privileges']