It's actually fairly easy. I have a system that has hundreds of thousands of JVM's running this way. The way to go about this is to make doing the right thing easier than doing the wrong thing.
The first piece of the puzzle is to present configuration to runtime processes in a read only manner and enforce this rule from the remote side (e.g S3 bucket where the machine only has a R/O key or R/O NFS mount). For added points you can make the OS image read only (but that's another post).
The second piece is to make sure that you have easy build automata that can push into that repository easily and reliably. This is really key - you have to have a programatic way of doing things.
The first piece of the puzzle is to present configuration to runtime processes in a read only manner and enforce this rule from the remote side (e.g S3 bucket where the machine only has a R/O key or R/O NFS mount). For added points you can make the OS image read only (but that's another post).
The second piece is to make sure that you have easy build automata that can push into that repository easily and reliably. This is really key - you have to have a programatic way of doing things.