You keep the user-changeable files on a separate filesystem. Whether that’s just a separate partition, or an external disk. Keep the system itself read only, and write-heavy directories like logs and caches in RAM.