Description

Docker v25 treats read-only ("ro") mounts as recursive read-only (rro) mounts by default (#45278 (comment)).

This breaking change was intended, but its impact appeared to be larger than we thought, so we should consider disabling upgrading RO mounts to RRO when a client speaks API older than v1.44 (Docker v25).

The current workaround is to use --mount type=bind,src=/mnt,dst=/mnt,readonly,bind-recursive=writable instead of -v /mnt:/mnt:ro.