Read only root on VMs

Follow the instructions from here: https://help.ubuntu.com/community/aufsRootFileSystemOnUsbFlash

disable app-armor on dhclient (otherwise networking will fail)

sudo aa-complain /etc/apparmor.d/sbin.dhclient

edit /etc/grub.d/00_header to not show menu on unclean close:

# if [ "\${recordfail}" = 1 ]
# then
set timeout=-1
#else
set timeout=${2}
#fi

Optionally, you can choose to not unmount NFS paritions, etc in /etc/rc0.d/S35networking and S40unmountfs