Description

Since Docker 25.0.0, the way recursive bind mounts are handled was changed:

In earlier versions of Docker Engine, recursive mounts (submounts) would always be mounted as writable, even when specifying a read-only mount. This behavior has changed in v25.0.0, for hosts running on kernel version 5.12 or later. Now, read-only bind mounts are recursively read-only by default.
To get the same behavior as earlier releases, you can specify the bind-recursive option for the --mount flag.

docker run --mount type=bind,src=SRC,dst=DST,readonly,bind-recursive=writable IMAGE

More on recursive mounts: https://docs.docker.com/storage/bind-mounts/#recursive-mounts

Seems like this is not supported in Compose yet. Would be nice to have something like:

    volumes:
      - type: bind
        source: /mnt
        target: /mnt
        read_only: true
        bind:
          recursive: writable