{
  "slug": "nerdctl-container-mounts-images-and-image-subpaths-read-only-2777ff956b70",
  "title": "nerdctl container mounts images and image subpaths read-only",
  "tools": [
    "nerdctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-20T05:01:55.000Z",
  "announced_at": "2026-09-20T05:01:55.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When running a container with read-only access to an image, use `nerdctl run` with `--mount type=image,src=<image>,target=<container-path>`. To mount a relative path within the image rootfs, add `image-subpath=<relative-path>`; the image filesystem is read-only.",
    "examples": [
      "nerdctl run --rm --mount type=image,src=<image>,target=<container-path> <container-image>",
      "nerdctl run --rm --mount type=image,src=<image>,target=<container-path>,image-subpath=<relative-path> <container-image>"
    ],
    "gotchas": [
      "Version: v2.4.0",
      "--mount (required): Attach a filesystem mount; provide comma-separated key=value pairs.",
      "type=image (required): Selects an image filesystem mount.",
      "src (or source) (required): Image reference to mount.",
      "target (or dst, destination) (required): Destination path in the container for the mount.",
      "image-subpath: Relative path inside the image rootfs to mount instead of the whole rootfs. Must resolve inside rootfs; empty, absolute, escaping, and paths through absolute symlinks are rejected. `.` mounts the whole rootfs.",
      "<container-image> (required): Image argument for the container to run.",
      "Prerequisite: This nerdctl release is expected to be used with containerd v1.7 or later; some features may not work with other containerd releases.",
      "The image mount is read-only."
    ]
  },
  "why_it_matters": "Run a container with read-only access to an image or a path inside its root filesystem.",
  "sources": [
    "https://github.com/containerd/nerdctl/releases/tag/v2.4.0",
    "https://github.com/containerd/nerdctl/blob/v2.4.0/docs/command-reference.md"
  ],
  "rank": 0.91028,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-bb062a607fac224b-9:gate",
    "evidence_hash": "89fbd919679ed2949ec61c8062382515fb319dd4be9fdb247a315c9ae6e83512"
  },
  "review": {
    "draft_hash": "49fffabddfec1b679da8d5640b912908cd58e761e04092b7ee60d4ab21948004",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.78 (>= 0.6 needed)."
  }
}