Since https://github.com/moby/moby/pull/35344 we clarified that this behaviour was a mistake, and the read only flag should just apply to the actual rootfs, so it corresponds to the OCI read-only option. Other mounts may be able to be adjusted by re-specifying them or other means but this is unrelated. Signed-off-by: Justin Cormack <justin.cormack@docker.com>