Flag for read-only mount, set hostPath mount to readOnly is considered best-practice.