{
  "slug": "nerdctl-supports-docker-v25-recursive-read-only-bind-mounts-44b30cb5659a",
  "title": "nerdctl supports Docker v25 recursive read-only bind mounts",
  "tools": [
    "nerdctl"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-09-20T05:01:55.000Z",
  "announced_at": "2026-09-20T05:01:55.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When a bind mount must make its submounts recursively read-only, use `--mount` with `readonly,bind-recursive=readonly`; this forces recursive read-only and errors if unsupported. For automatic behavior, use `bind-recursive=enabled` (the default), which makes read-only mounts recursive when supported.",
    "examples": [
      "nerdctl run --mount type=bind,source=<host-path>,target=<container-path>,readonly,bind-recursive=readonly <image>",
      "nerdctl run --mount type=bind,source=<host-path>,target=<container-path>,readonly,bind-propagation=rprivate,bind-recursive=readonly <image>"
    ],
    "gotchas": [
      "Version: v2.4.0",
      "--mount (required): Attaches a filesystem mount using comma-separated key-value pairs.",
      "type=bind (required): Selects a bind mount.",
      "source / src (required): Host mount source; mandatory for bind mounts.",
      "target / dst / destination (required): Mount destination in the container.",
      "readonly / ro: Mounts the filesystem read-only; recursively read-only when kernel and runtime support it.",
      "bind-recursive: Bind-specific setting: `enabled` (default) recursively binds submounts and makes read-only mounts recursively read-only when supported; `disabled` omits submounts; `writable` keeps submounts writable on a read-only mount; `readonly` forces recursive read-only and errors if unsupported. Values are mutually exclusive; `readonly` requires `bind-propagation=rprivate`.",
      "bind-propagation: Bind propagation setting; allowed values are `shared`, `slave`, `private`, `rshared`, `rslave`, `rprivate` (default `rprivate`). Specify `rprivate` with `bind-recursive=readonly`.",
      "Prerequisite: Recursive read-only support requires Linux kernel >= 5.12 and runc >= 1.1 or crun >= 1.8.6. `bind-recursive=readonly` errors when the kernel or runtime lacks support.",
      "Prerequisite: Runtime support is detected with `$RUNTIME features`; the result is cached in the XDG cache directory.",
      "Recursive read-only behavior depends on kernel >= 5.12 and runc >= 1.1 or crun >= 1.8.6.",
      "The `rro` option is deprecated; the source says it raises an error when recursive read-only mounts are unsupported.",
      "Runtime feature detection uses `$RUNTIME features`, with results cached in the XDG cache directory and invalidated when the runtime binary is modified."
    ]
  },
  "why_it_matters": "Configure a bind mount to make its submounts recursively read-only where the kernel and OCI runtime support it.",
  "before": "Use the older `rro` option, which is now deprecated in favor of the Docker v25 `bind-recursive` form.",
  "sources": [
    "https://github.com/containerd/nerdctl/releases/tag/v2.4.0",
    "https://github.com/containerd/nerdctl/pull/5043",
    "https://github.com/containerd/nerdctl/blob/v2.4.0/docs/command-reference.md"
  ],
  "rank": 0.95032,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-20261016",
    "verdict_id": "wave1b-20261016:wave1b-20261016-bb062a607fac224b-11:gate",
    "evidence_hash": "89fbd919679ed2949ec61c8062382515fb319dd4be9fdb247a315c9ae6e83512"
  },
  "review": {
    "draft_hash": "8afcb0702384aff785141b65dc693680262b84e614fb87fda224c4b563686e1d",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-20261016:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.95 >= 0.9; 2 needed) and Jev gave 0.71 (>= 0.6 needed)."
  }
}