Set /home/jovyan as read only for jovyan user

This doesn’t follow, unless there’s something I’m missing. Creating files that will not be persisted is only a problem if they were meant to be persisted. So it’s more a matter of expectations than strict requirements, unless you have some audit requirements that all files that are created are always persisted. It is common practice with Jupyterhub, for instance, to not persist $HOME, but persist $HOME/work.