diff --git a/docker-alfresco/Dockerfile b/docker-alfresco/Dockerfile
index 89c8eea9b..96c3dd451 100644
--- a/docker-alfresco/Dockerfile
+++ b/docker-alfresco/Dockerfile
@@ -96,8 +96,8 @@ RUN java -jar /usr/local/tomcat/alfresco-mmt/alfresco-mmt*.jar install \
 
 # Docker CMD from parent image starts the server
 
-# Unpack ROOT.war
-RUN mkdir /usr/local/tomcat/webapps/ROOT && cd /usr/local/tomcat/webapps/ROOT && jar -xvf /usr/local/tomcat/webapps/ROOT.war && rm -f /usr/local/tomcat/webapps/ROOT.war && \
+# Unpack ROOT.war and make alfresco and ROOT read-only.
+RUN mkdir /usr/local/tomcat/webapps/ROOT && cd /usr/local/tomcat/webapps/ROOT && jar -xvf /usr/local/tomcat/webapps/ROOT.war && rm -f /usr/local/tomcat/webapps/ROOT.war && chmod -R =r /usr/local/tomcat/webapps/ROOT && chmod -R =r /usr/local/tomcat/webapps/alfresco && \
 # Add catalina.policy to ROOT.war and alfresco.war
 # Grant all security permissions to alfresco webapp because of numerous permissions required in order to work properly.
 # Grant only deployXmlPermission to ROOT webapp.