After reading the USB and remastering howtos I'm considering modifying Debian or Knoppix to boot from a compact flash card (using a CF->IDE adapter). However I don't want to mount / RW as that would mean enabling RW access to the CF card, which has a limited number of write/erase cycles before it starts to become useless. Although the number of writes per sector is 300,000 this number could quickly become exhausted under heavy load. Imagine 4000 writes per day, not at all unrealistic given /var/log/messages, utmp, iptables logs etc and you've got an expensive CF card with sectors that will only last 3 months.

Obviously /tmp is needed and could be mounted as tmpfs which will put it in RAM, /var probably could be too. Unfortunately if /var was mounted in tmpfs in RAM any logs would be lost at reboot, so a possible option would be to mount it over NFS or on a partition on the CF disk with noatime as an option when mounting (to reduce the number of sector writes).

What other directories in the filesystem need to be read/write in order to boot and run simple services (DHCP, DNS cache, iptables) properly?

Any other ideas for what to do with /var/log and similar if I don't wish to write to the CF disk?

Thanks.