It probably depends on what software you're running and what it does. I don't 100% know how to do this, but this is what I'd aim for:

Everything on the physical drive is read-only. On startup, it creates a RAMFS and copies any files that change as part of the software you're running there and points to that for all temporary files, etc.

That way the whole physical device is read only and anything that needs to change does so in memory only.