Hello,
I have a similar problem, but the solution described here doesn't seem to solve it. 
I have installer.cls with manifest in it, where I create namespace and 2 db's (for code - updatable and data - durable). In docker-compose I use ISC_DATA_DIRECTORY to set durable volume. Also I use module.xml to create web application and load code.
I tried to set my code db permissions to read-only in iris.script after I setup new namespace and db's but then I have errors when loading classes to db. 
I'm pretty new to IRIS, so will be grateful for any suggestions. Thank you.
iris.script

ZN"%SYS"Do$system.OBJ.Load("/opt/irisapp/App.Installer.cls","ck")
    Do##class(App.Installer).Setup()

    ZN"STORE"Do$System.OBJ.LoadDir("/opt/irisapp/src", "ck","",1)

    //ZN "%SYS"//Do ##class(App.Installer).SetupDBPermissions("/code/storeCode/", 1)zn"%SYS"do##class(Security.Users).UnExpireUserPasswords("*")
    do##class(Security.Roles).Create("CustomAdmin", "Custom admin role for OGS application")
    do##class(Security.Roles).Create("Purchaser", "Custom purchaser role for OGS application")
    do##class(Security.Users).Create("CustomSuperUser%40admin.com", "%All,customadmin", "password", "Custom SuperUser")
    do##class(Security.Users).AddRoles("SuperUser", "%all,customadmin", 1)

    zn"STORE"do##class(GroceryApp.utils.Seed).SeedRegions()
    do##class(GroceryApp.data.Category).AddMultipleCategories()

    zpm "load /opt/irisapp/ -v":1:1halt

App.Installer.cls

Class App.Installer
{
XData setup
{
    <Manifest>
        <Default Name="Namespace" Value="STORE" />
        <Default Name="app" Value="store" />
        <If Condition='(##class(Config.Namespaces).Exists("${Namespace}")=0)'>
            <Namespace Name="${Namespace}" Create="yes" Code="${Namespace}CODE" Data="${Namespace}DATA" Ensemble="">
                <Configuration>
                    <!-- Durable data database -->
                    <Database Name="${Namespace}DATA"
                            Dir="${app}Data"
                            Create="yes"
                            MountRequired="true"
                            Resource="%DB_${Namespace}DATA"
                            PublicPermissions="RW"
                            MountAtStartup="true" />

                    <!-- Non-durable code database -->
                    <Database Name="${Namespace}CODE"
                            Dir="/code/${app}Code"
                            Create="yes"
                            MountRequired="true"
                            Resource="%DB_${Namespace}CODE"
                            PublicPermissions="RW"
                            MountAtStartup="true" />
                </Configuration>
            </Namespace>
        </If>

        <Namespace Name="USER" Create="no" Code="USER" Data="USER" Ensemble="0">
            <Configuration>
                <ClassMapping From="${Namespace}CODE" Package="GroceryApp" />
                <RoutineMapping From="${Namespace}CODE" Routines="GroceryApp" />
            </Configuration>
        </Namespace>

    </Manifest>
}

ClassMethod Setup(ByRef pVars, pLogLevel As%Integer = 0, pInstaller As%Installer.Installer) As%Status [ CodeMode = objectgenerator, Internal ]
{
    Quit##class(%Installer.Manifest).%Generate(%compiledclass, %code, "setup")
}

/// Change database permissions/// <ul>/// <li><var>dbDir</var> Path to the database.</li>/// <li><var>mode</var> Permission mode. 0 = read/write, 1 = read-only. Optional</li>/// </ul>ClassMethod SetupDBPermissions(dbDir as%String, mode as%Integer = 0) As%Status {
  New$NAMESPACESet$NAMESPACE = "%SYS"Set sc = $$$OKSet db = ##class(SYS.Database).%OpenId(dbDir)
  Write"Setting database permission for " _ db.Directory _ ". Setting ReadOnly from " _ db.ReadOnly _ " to " _ mode, !
  Set db.ReadOnly = mode
  $$$ThrowOnError(db.%Save())

  Return sc
}
}