Mount read-only
Mount a host directory read-only into a container with -v "$PWD":/data:ro. A write from inside fails with a read-only file system error, even as root.
A container needs to read your files, such as a config or a source tree, and it should not be able to change them.
mkdir data && echo hello > data/note.txt
docker run --rm -v "$PWD/data":/data:ro alpine:3.20 sh -c 'cat /data/note.txt; touch /data/new.txt'
echo "exit: $?"
ls datahello
touch: /data/new.txt: Read-only file system
exit: 1
note.txtThe :ro suffix makes the bind mount read-only inside the container, so the kernel refuses any write, create or delete on it, including from root. The syntax is documented under bind mounts. The listing at the end shows that no file was created on the host.
Only that one mount is read-only: the rest of the container's file system is still writable unless you add --read-only. A read-only bind mount also does not stop writes through a second, writable mount of the same directory. Use --mount type=bind,src=...,dst=...,readonly when you prefer named keys.