nerdctl supports Docker v25 recursive read-only bind mounts

Introduced 2026-09-20 · score 0.95

HOW TO USE IT

When a bind mount must make its submounts recursively read-only, use `--mount` with `readonly,bind-recursive=readonly`; this forces recursive read-only and errors if unsupported. For automatic behavior, use `bind-recursive=enabled` (the default), which makes read-only mounts recursive when supported.

WHY THIS HELPS

Configure a bind mount to make its submounts recursively read-only where the kernel and OCI runtime support it.

BEFORE THIS CHANGE

Use the older `rro` option, which is now deprecated in favor of the Docker v25 `bind-recursive` form.

REQUIREMENTS AND LIMITATIONS

• Version: v2.4.0
• --mount (required): Attaches a filesystem mount using comma-separated key-value pairs.
• type=bind (required): Selects a bind mount.
• source / src (required): Host mount source; mandatory for bind mounts.
• target / dst / destination (required): Mount destination in the container.
• readonly / ro: Mounts the filesystem read-only; recursively read-only when kernel and runtime support it.
• bind-recursive: Bind-specific setting: `enabled` (default) recursively binds submounts and makes read-only mounts recursively read-only when supported; `disabled` omits submounts; `writable` keeps submounts writable on a read-only mount; `readonly` forces recursive read-only and errors if unsupported. Values are mutually exclusive; `readonly` requires `bind-propagation=rprivate`.
• bind-propagation: Bind propagation setting; allowed values are `shared`, `slave`, `private`, `rshared`, `rslave`, `rprivate` (default `rprivate`). Specify `rprivate` with `bind-recursive=readonly`.
• Prerequisite: Recursive read-only support requires Linux kernel >= 5.12 and runc >= 1.1 or crun >= 1.8.6. `bind-recursive=readonly` errors when the kernel or runtime lacks support.
• Prerequisite: Runtime support is detected with `$RUNTIME features`; the result is cached in the XDG cache directory.
• Recursive read-only behavior depends on kernel >= 5.12 and runc >= 1.1 or crun >= 1.8.6.
• The `rro` option is deprecated; the source says it raises an error when recursive read-only mounts are unsupported.
• Runtime feature detection uses `$RUNTIME features`, with results cached in the XDG cache directory and invalidated when the runtime binary is modified.

FIRST-PARTY EVIDENCE

• https://github.com/containerd/nerdctl/releases/tag/v2.4.0
• https://github.com/containerd/nerdctl/pull/5043
• https://github.com/containerd/nerdctl/blob/v2.4.0/docs/command-reference.md

Check the installed version and the source before using it. Entry JSON

Report a problem with this card