Hello,
I have a similar problem, but the solution described here doesn't seem to solve it. 
I have installer.cls with manifest in it, where I create namespace and 2 db's (for code - updatable and data - durable). In docker-compose I use ISC_DATA_DIRECTORY to set durable volume. Also I use module.xml to create web application and load code.

I tried to set my code db permissions to read-only in iris.script after I setup new namespace and db's but then I have errors when loading classes to db. 

I'm pretty new to IRIS, so will be grateful for any suggestions. Thank you.

iris.script

    ZN "%SYS"
    Do $system.OBJ.Load("/opt/irisapp/App.Installer.cls","ck")
    Do ##class(App.Installer).Setup()

    ZN "STORE"
    Do $System.OBJ.LoadDir("/opt/irisapp/src", "ck","",1)

    //ZN "%SYS"
    //Do ##class(App.Installer).SetupDBPermissions("/code/storeCode/", 1)

    zn "%SYS"
    do ##class(Security.Users).UnExpireUserPasswords("*")
    do ##class(Security.Roles).Create("CustomAdmin", "Custom admin role for OGS application")
    do ##class(Security.Roles).Create("Purchaser", "Custom purchaser role for OGS application")
    do ##class(Security.Users).Create("CustomSuperUser%40admin.com", "%All,customadmin", "password", "Custom SuperUser")
    do ##class(Security.Users).AddRoles("SuperUser", "%all,customadmin", 1)

    zn "STORE"
    do ##class(GroceryApp.utils.Seed).SeedRegions()
    do ##class(GroceryApp.data.Category).AddMultipleCategories()

    zpm "load /opt/irisapp/ -v":1:1

    halt

App.Installer.cls

Class App.Installer
{
XData setup
{
    <Manifest>
        <Default Name="Namespace" Value="STORE" />
        <Default Name="app" Value="store" />
        <If Condition='(##class(Config.Namespaces).Exists("${Namespace}")=0)'>
            <Namespace Name="${Namespace}" Create="yes" Code="${Namespace}CODE" Data="${Namespace}DATA" Ensemble="">
                <Configuration>
                    <!-- Durable data database -->
                    <Database Name="${Namespace}DATA"
                            Dir="${app}Data"
                            Create="yes"
                            MountRequired="true"
                            Resource="%DB_${Namespace}DATA"
                            PublicPermissions="RW"
                            MountAtStartup="true" />

                    <!-- Non-durable code database -->
                    <Database Name="${Namespace}CODE"
                            Dir="/code/${app}Code"
                            Create="yes"
                            MountRequired="true"
                            Resource="%DB_${Namespace}CODE"
                            PublicPermissions="RW"
                            MountAtStartup="true" />
                </Configuration>
            </Namespace>
        </If>

        <Namespace Name="USER" Create="no" Code="USER" Data="USER" Ensemble="0">
            <Configuration>
                <ClassMapping From="${Namespace}CODE" Package="GroceryApp" />
                <RoutineMapping From="${Namespace}CODE" Routines="GroceryApp" />
            </Configuration>
        </Namespace>

    </Manifest>
}

ClassMethod Setup(ByRef pVars, pLogLevel As %Integer = 0, pInstaller As %Installer.Installer) As %Status [ CodeMode = objectgenerator, Internal ]
{
    Quit ##class(%Installer.Manifest).%Generate(%compiledclass, %code, "setup")
}

/// Change database permissions
/// <ul>
/// <li><var>dbDir</var> Path to the database.</li>
/// <li><var>mode</var> Permission mode. 0 = read/write, 1 = read-only. Optional</li>
/// </ul>
ClassMethod SetupDBPermissions(dbDir as %String, mode as %Integer = 0) As %Status {
  New $NAMESPACE
  Set $NAMESPACE = "%SYS"

  Set sc = $$$OK

  Set db = ##class(SYS.Database).%OpenId(dbDir)
  Write "Setting database permission for " _ db.Directory _ ". Setting ReadOnly from " _ db.ReadOnly _ " to " _ mode, !
  Set db.ReadOnly = mode
  $$$ThrowOnError(db.%Save())

  Return sc
}
}