This improves security and explicitly fails on startup when a user picks the wrong directory to store its data. - Run in read-only mode - Make /var/run/headscale a read-write tmpfs - Mount the config volume read-only - Use the /health endpoint to check if Headscale is up