You have no problem at the first place. An image in Docker is not like a monolithic ISO. It has layers. And layers in Docker, when you run them, are immutable.
- Somebody built Alpine image with hash abc123
- Then somebody build a Python image based on Alpine (FROM alpine:abc123) with hash def456.
- Now you've build your image atop of Python (FROM python:def456) and result in hash ghi789.
Now your customer is pulling the image:
docker pull flask:ghi789
When he runs his container he gets three read-only layers in memory (abc123, def456 and ghi789) and one new read-write layer jkl357 that is initially empty. It will be filled later with some data during app activity, for example - logs, or external connections like "docker exec ...".
Thus, no matter what customer does in his new layers, all precommitted layers are safe.
The layer jkl357 become immutable (readonly) only upon commit. But this is already not your image SHA and not related to you app:
docker commit -t my-altered-flask:tag
All said is relevant unless your goal is to protect from modifying, not from read at all.