K8s 1.37 Can Mount /tmp noexec. Docker Images Still Need It The Sept. 16 Kubernetes blog adds Alpha bindMountOptions and emptyDir modes. readOnlyRootFilesystem was never enough if the volume can chmod +x. docker