diff --git a/Dockerfile b/Dockerfile
index 4bab71774..f8f101990 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -2,6 +2,7 @@ ARG BUILD_FROM
 FROM ${BUILD_FROM}
 
 ENV \
+    S6_READ_ONLY_ROOT=1 \
     S6_SERVICES_GRACETIME=10000 \
     SUPERVISOR_API=http://localhost \
     CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1 \