Container security hardening (phase 4) (#24140)

* Support read-only rootfs with self-signed certs in /config/tls

* Support read-only rootfs in s6 and pre-compile bytecode

* Assert read-only rootfs support in CI

* Document hardened read-only deployment

* keep certsync's cert selection identical to nginx's

* note the uid trade-off in user: mode

* fail fast when EXTRA_GROUPS or a missing media volume meets read_only

* keep nosuid and nodev on the /run tmpfs

* support read_only in the default mode

* don't take go2rtc down when the homekit file isn't writable

* lead with the hardware consequence of switching to user:

* refuse to write TLS material through a symlink as root

* note that memryx writes models to the root filesystem

* certsync watches whichever cert path nginx loaded

docker/main/Dockerfile

@@ -316,6 +316,9 @@ EXPOSE 8555/tcp 8555/udp
 ENV S6_LOGGING_SCRIPT="T 1 n0 s10000000 T"
 # Do not fail on long-running download scripts
 ENV S6_CMD_WAIT_FOR_SERVICES_MAXTIME=0
+# Allow running with a read-only root filesystem: s6 copies its scan dir into
+# /run and executes service scripts from there, so /run must allow exec
+ENV S6_READ_ONLY_ROOT=1
 
 ENTRYPOINT ["/init"]
 CMD []
@@ -387,3 +390,7 @@ FROM deps AS frigate
 
 WORKDIR /opt/frigate/
 COPY --from=rootfs / /
+
+# Pre-compile bytecode so a read-only rootfs doesn't force re-parsing the
+# source tree on every boot (pip-installed packages are already compiled)
+RUN python3 -m compileall -q -j0 /opt/frigate/frigate