I’ll maintain a fork until I’ll have a clean series of patches to apply to the new ro filesystem. Should be doable just not miss anything in the VPNs section.
Using docker might be a solution however I won’t bet on it the risk is hitting the same write permissions limits.
The original post about this ro implementation is here.