are we sure this will work with the r/o root fs?

usually, if there's a reason not to have r/o root fs, you'd have to define a separate mount volume to cover the path that still needs to be writable

ie, needs testing before crdb ends up in a weird situation

looks like upstream has some of these set already in statefulset at head (here and here) - we might be a bit behind

but can't find the toolbox deployment (perhaps something we've added)