diff --git a/core/start-service.sh b/core/start-service.sh
index b033bcc..5fae58e 100755
--- a/core/start-service.sh
+++ b/core/start-service.sh
@@ -27,15 +27,22 @@ fi
 # Hint: this is not compatible with a read-only container.
 # The general recommendation is to already build a container that has all required packages installed.
 ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
-	# shellcheck disable=SC2016 disable=SC2086
-	if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
-		DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
-	else
-		echo "INFO: $installpkg is already installed"
-	fi
-done
+if [ -n "$(mkdir -p "/var/lib/apt/lists/" 2&> /dev/null)" ]; then
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
+		# shellcheck disable=SC2016 disable=SC2086
+		if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
+			DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
+		else
+			echo "INFO: $installpkg is already installed"
+		fi
+	done
+else
+	echo "Notice: Container is run read-only, skipping package installation."
+	echo "If you want to have additional packages installed in the container either:"
+	echo "- build your own image with the packages already included"
+	echo "- switch the container to 'read_only: false'"
+fi
 
 mkdir -p /tmp/"$SERVICE_TO_START" /var/run/kopano
 
diff --git a/examples/meet/setup.sh b/examples/meet/setup.sh
index 9e56bec..0d4d253 100755
--- a/examples/meet/setup.sh
+++ b/examples/meet/setup.sh
@@ -133,9 +133,6 @@ INSECURE=$INSECURE
 docker_repo=kopano
 COMPOSE_PROJECT_NAME=kopano
 
-# Additional packages to install
-ADDITIONAL_KOPANO_PACKAGES=python3-grapi.backend.ldap
-
 EOF
 else
 	echo ".env already exists with initial configuration"
diff --git a/kdav/start.sh b/kdav/start.sh
index 4eb3817..c667155 100755
--- a/kdav/start.sh
+++ b/kdav/start.sh
@@ -8,15 +8,23 @@ ADDITIONAL_KOPANO_PACKAGES=${ADDITIONAL_KOPANO_PACKAGES:-""}
 set -eu # unset variables are errors & non-zero return values exit the whole script
 [ "$DEBUG" ] && set -x
 
-# TODO this is not compatible with a read-only container
+# Hint: this is not compatible with a read-only container.
+# The general recommendation is to already build a container that has all required packages installed.
 ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
-	# shellcheck disable=SC2016 disable=SC2086
-	if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
-		apt --assume-yes --no-upgrade install "$installpkg"
-	fi
-done
+if [ -n "$(mkdir -p "/var/lib/apt/lists/" 2&> /dev/null)" ]; then
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
+		# shellcheck disable=SC2016 disable=SC2086
+		if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
+			apt --assume-yes --no-upgrade install "$installpkg"
+		fi
+	done
+else
+	echo "Notice: Container is run read-only, skipping package installation."
+	echo "If you want to have additional packages installed in the container either:"
+	echo "- build your own image with the packages already included"
+	echo "- switch the container to 'read_only: false'"
+fi
 
 echo "Ensure directories"
 mkdir -p /run/sessions
diff --git a/meet/start-service.sh b/meet/start-service.sh
index ba23cae..83d2d45 100755
--- a/meet/start-service.sh
+++ b/meet/start-service.sh
@@ -14,7 +14,6 @@ if [ ! -e /kopano/"$SERVICE_TO_START".py ]; then
 	exit 1
 fi
 
-# TODO how to best move this to /tmp? 
 echo "Configure service '$SERVICE_TO_START'" | ts
 /usr/bin/python3 /kopano/"$SERVICE_TO_START".py
 
@@ -60,7 +59,6 @@ if [ "${GRID_WEBAPP:-yes}" = "yes" ]; then
 	jq '.apps.enabled += ["kopano-webapp"]' $CONFIG_JSON | sponge $CONFIG_JSON
 fi
 
-# todo do not replace here, but in a temp location
 sed s/\ *=\ */=/g /tmp/kopano/kwebd.cfg > /tmp/kweb-env
 # always disable tls
 export tls=no
diff --git a/webapp/start.sh b/webapp/start.sh
index fc56388..2303327 100755
--- a/webapp/start.sh
+++ b/webapp/start.sh
@@ -16,15 +16,22 @@ source /kopano/start-helper.sh
 # The general recommendation is to already build a container that has all required packages installed.
 ADDITIONAL_KOPANO_PACKAGES="$ADDITIONAL_KOPANO_PACKAGES $ADDITIONAL_KOPANO_WEBAPP_PLUGINS"
 ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
-	# shellcheck disable=SC2016 disable=SC2086
-	if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
-		DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
-	else
-		echo "INFO: $installpkg is already installed"
-	fi
-done
+if [ -n "$(mkdir -p "/var/lib/apt/lists/" 2&> /dev/null)" ]; then
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
+		# shellcheck disable=SC2016 disable=SC2086
+		if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
+			DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
+		else
+			echo "INFO: $installpkg is already installed"
+		fi
+	done
+else
+	echo "Notice: Container is run read-only, skipping package installation."
+	echo "If you want to have additional packages installed in the container either:"
+	echo "- build your own image with the packages already included"
+	echo "- switch the container to 'read_only: false'"
+fi
 
 # copy latest config template
 mkdir -p /tmp/webapp/
diff --git a/zpush/start.sh b/zpush/start.sh
index 9e2bd17..7c6e04f 100755
--- a/zpush/start.sh
+++ b/zpush/start.sh
@@ -42,15 +42,22 @@ php_cfg_gen() {
 # Hint: this is not compatible with a read-only container.
 # The general recommendation is to already build a container that has all required packages installed.
 ADDITIONAL_KOPANO_PACKAGES=$(echo "$ADDITIONAL_KOPANO_PACKAGES" | tr -d '"')
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
-[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
-	# shellcheck disable=SC2016 disable=SC2086
-	if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
-		DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
-	else
-		echo "INFO: $installpkg is already installed"
-	fi
-done
+if [ -n "$(mkdir -p "/var/lib/apt/lists/" 2&> /dev/null)" ]; then
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && apt update
+	[ -n "${ADDITIONAL_KOPANO_PACKAGES// }" ] && for installpkg in $ADDITIONAL_KOPANO_PACKAGES; do
+		# shellcheck disable=SC2016 disable=SC2086
+		if [ "$(dpkg-query -W -f='${Status}' $installpkg 2>/dev/null | grep -c 'ok installed')" -eq 0 ]; then
+			DEBIAN_FRONTEND=noninteractive apt --assume-yes --no-upgrade install "$installpkg"
+		else
+			echo "INFO: $installpkg is already installed"
+		fi
+	done
+else
+	echo "Notice: Container is run read-only, skipping package installation."
+	echo "If you want to have additional packages installed in the container either:"
+	echo "- build your own image with the packages already included"
+	echo "- switch the container to 'read_only: false'"
+fi
 
 # copy latest config template
 mkdir -p /tmp/z-push/