I’ve been able to make the image run with GID 64604 (puppet) and a read-only root filesystem, but it’s a real faff