The iso itself is read-only. When I need to update software I build a whole new iso and replace the existing one. For any folders/files that need persistence across reboots, I store that data separately from the iso, either in a virtual nvme drive or a mounted 9pfs folder from the host. The iso mounts the persistence drive/9pfs via /etc/fstab. So in the end, the software and config files are read-only (until I replace them with a new iso) but my databases and data files are read-write.

Getting into the unnecessary details: in classic live ISO fashion, the root (/) filesystem is tmpfs. Then I have at most 1 persistence drive and/or at most 1 9pfs mount. From there, I use bind mounts to only persist the few folders/files that I want preserved. For example, I'll have my persistence drive mounted at /persist and I'll bind mount "/var/lib/etcd" to "/persist/var/lib/etcd". Then when I reboot, everything outside of "/persist" is wiped out and I'm back to the initial iso + anything in /persist. So it is very similar to running a docker image with a volume mount, or running tails with persistence.

I build it all via NixOS and I use Impermanence to manage the bind mounts to the persist drive: https://wiki.nixos.org/wiki/Impermanence