The Debian packages bilibop(-*) are what you want. It works with kernels that have either aufs or overlayfs. You must be using initramfs-tools (as opposed to dracut). When your initrd is rebuilt it includes some of its scripts and files that do the magic. Use a normal /etc/fstab. In the bilibop configuration file you can whitelist other partitions that you want mounted normally.
You have to put in a kernel command line argument, I like 'lockfs=soft', but other options are available. With lockfs=soft the real rootfs is mounted read-only at either /overlay/ro or /aufs/ro. You can, as root, do something like below if you need to change something permanently:
root@skylight1:~$ mount -o remount,rw /overlay/ro
root@skylight1:~$ chroot /overlay/ro
root@skylight1:/$ .... do your work here
root@skylight1:/$ exit
root@skylight1:~$ mount -o remount,ro /overlay/ro
For simple file edits that's it. But some operations, say 'apt-get install somepackage', will require more work. You'll need to bind mount /dev, /proc and maybe others to /overlay/ro before entering the chroot (and umounting it all later).
One caution: if you use lockfs=hard (good for kiosk mode) you can paint yourself into a corner where you can't change the system at all. You'd have to mount your rootfs on another system (if you're working off an SD card) or NFS boot if you're working off of MMC.
The included /usr/share/doc/bilibop* files are pretty good at explaining how it works.