- add /etc/localtime volume mount for time synchronization - set volume as read-only to maintain security