Rephrased readonlyrootfs docs.

Added ephemeral-storage limits/examples for standalone users.

Author: zlogic

content/en/docs/deployment/private-cloud/private-cloud-cluster/_index.md

@@ -952,10 +952,10 @@ Some container runtimes or network configurations prevent a terminating pod from
 
 ### Read-only RootFS {#readonlyrootfs}
 
-Mendix app container images are locked down quite well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership make all system and non-critical paths read-only.
+Mendix app container images are locked down reasonably well out of the box - they run as a non-root user, cannot request elevated permissions, and file ownership and permissions prevent modification of system and critical paths.
 
 Kubernetes allows to lock down containers even further, by mounting the container filesystem as read-only - if the container's security context specifies [readOnlyRootFilesystem: true](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/).
-With this option enabled, any files and paths from the container image are impossible to modify by any user.
+With this option enabled, any files and paths from the container image cannot be modified by any user.
 
 Starting from Mendix Operator version 2.21.0, all system containers and pods use `readOnlyRootFilesystem` by default, and it's possible to specify if an environment's app container should also have a read-only filesystem.
 
@@ -969,7 +969,7 @@ In addition to internal Mendix Runtime paths, `/tmp` is mounted for any temporar
 
 {{% alert color="info" %}}
 If your app works without issues when read-only root filesystem is enabled, it's best to enable it wherever possible.
-We recommend using a non-production environment to validate that your app keeps working correctly.
+We recommend using a non-production environment to validate that your app keeps working correctly with a read-only RootFS.
 {{% /alert %}}
 
 ### GKE Autopilot Workarounds {#gke-autopilot-workarounds}

content/en/docs/deployment/private-cloud/private-cloud-operator.md

@@ -79,9 +79,11 @@ spec:
     limits: # Upper limit - process will be stopped if it tries to use more
       cpu: 500m # 500 millicores - half of a vCPU
       memory: 512Mi # 512 megabytes - suitable for small-scale non-production apps
+      ephemeral-storage: 256Mi # 256 megabytes - for temporary files such as generated Excel documents
     requests: # Lower limit - needs at least these resources
       cpu: 250m
       memory: 256Mi
+      ephemeral-storage: 256Mi
   runtimeDeploymentPodAnnotations: # Optional, can be omitted : set custom annotations for Mendix Runtime Pods
     # example: inject the Linkerd proxy sidecar
     linkerd.io/inject: enabled