readonlyroot: make / readonly but permit writes to some paths

readonlyroot

#!/bin/bash -e

if [[ $EUID -ne 0 ]]; then
  echo >&2 "Need to be root."
  exit 1
fi

if ! mountpoint /mnt >/dev/null; then
  exit 2
fi

systemctl start readonlyroot.service
pid=$(systemctl show readonlyroot.service | grep -oP '(?<=pid=)\d+')
nsenter -m -t "$pid" "$@"

readonlyroot.service

[Unit]
Description=make a readonly root

[Service]
Type=simple
ExecStart=/usr/bin/sleep infinity

PrivateTmp=true
ReadOnlyPaths=/
ReadWritePaths=/run
ReadWritePaths=/mnt
ReadWritePaths=/home/lilydjwg/tmpfs/