nerdctl container mounts images and image subpaths read-only

Introduced 2026-09-20 · score 0.91

HOW TO USE IT

When running a container with read-only access to an image, use `nerdctl run` with `--mount type=image,src=<image>,target=<container-path>`. To mount a relative path within the image rootfs, add `image-subpath=<relative-path>`; the image filesystem is read-only.

WHY THIS HELPS

Run a container with read-only access to an image or a path inside its root filesystem.

REQUIREMENTS AND LIMITATIONS

• Version: v2.4.0
• --mount (required): Attach a filesystem mount; provide comma-separated key=value pairs.
• type=image (required): Selects an image filesystem mount.
• src (or source) (required): Image reference to mount.
• target (or dst, destination) (required): Destination path in the container for the mount.
• image-subpath: Relative path inside the image rootfs to mount instead of the whole rootfs. Must resolve inside rootfs; empty, absolute, escaping, and paths through absolute symlinks are rejected. `.` mounts the whole rootfs.
• <container-image> (required): Image argument for the container to run.
• Prerequisite: This nerdctl release is expected to be used with containerd v1.7 or later; some features may not work with other containerd releases.
• The image mount is read-only.

FIRST-PARTY EVIDENCE

• https://github.com/containerd/nerdctl/releases/tag/v2.4.0
• https://github.com/containerd/nerdctl/blob/v2.4.0/docs/command-reference.md

Check the installed version and the source before using it. Entry JSON

Report a problem with this card