rkt: Fix panic in setting ReadOnlyRootFS

pkg/kubelet/rkt/rkt.go

@@ -784,10 +784,9 @@ func (r *Runtime) newAppcRuntimeApp(pod *api.Pod, c api.Container, requiresPrivi
 	}
 
 	ra := appcschema.RuntimeApp{
-		Name:           convertToACName(c.Name),
-		Image:          appcschema.RuntimeImage{ID: *hash},
-		App:            imgManifest.App,
-		ReadOnlyRootFS: *c.SecurityContext.ReadOnlyRootFilesystem,
+		Name:  convertToACName(c.Name),
+		Image: appcschema.RuntimeImage{ID: *hash},
+		App:   imgManifest.App,
 		Annotations: []appctypes.Annotation{
 			{
 				Name:  *appctypes.MustACIdentifier(k8sRktContainerHashAnno),
@@ -796,6 +795,10 @@ func (r *Runtime) newAppcRuntimeApp(pod *api.Pod, c api.Container, requiresPrivi
 		},
 	}
 
+	if c.SecurityContext != nil && c.SecurityContext.ReadOnlyRootFilesystem != nil {
+		ra.ReadOnlyRootFS = *c.SecurityContext.ReadOnlyRootFilesystem
+	}
+
 	if mnt != nil {
 		ra.Annotations = append(ra.Annotations, appctypes.Annotation{
 			Name:  *appctypes.MustACIdentifier(k8sRktTerminationMessagePathAnno),