Storing the shared data on Gluster, it seems impossible to mount the data as read-only to containers.  They all have root permissions in the container, which results in root permissions on the shared FS.

Need to find a better solution.

For terra, read-only data is mounted RO via NFS.  We could do the same via Gluster, but needs to be at the volume level (which means mounting multiple volumes via clients).  There may be something with Docker --userns-remap flag, but it's unclear whether this works with Kubernetes.

http://blog.aquasec.com/docker-1.10-user-namespace

https://github.com/kubernetes/kubernetes/issues/33508