{"record":{"id":"05c38b28b11eb81e","repo":"docker/cli","slug":"option-bind-recursive-readonly-requires-readonl","errorCode":null,"errorMessage":"option 'bind-recursive=readonly' requires 'readonly' to be specified in conjunction","messagePattern":"option 'bind-recursive=readonly' requires 'readonly' to be specified in conjunction","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"opts/mount_utils.go","lineNumber":25,"sourceCode":"\n\t\"github.com/moby/moby/api/types/mount\"\n)\n\n// validateMountOptions performs client-side validation of mount options. Similar\n// validation happens on the daemon side, but this validation allows us to\n// produce user-friendly errors matching command-line options.\nfunc validateMountOptions(m *mount.Mount) error {\n\tif err := validateExclusiveOptions(m); err != nil {\n\t\treturn err\n\t}\n\n\tif m.BindOptions != nil {\n\t\tif m.BindOptions.ReadOnlyNonRecursive && !m.ReadOnly {\n\t\t\treturn errors.New(\"option 'bind-recursive=writable' requires 'readonly' to be specified in conjunction\")\n\t\t}\n\t\tif m.BindOptions.ReadOnlyForceRecursive {\n\t\t\tif !m.ReadOnly {\n\t\t\t\treturn errors.New(\"option 'bind-recursive=readonly' requires 'readonly' to be specified in conjunction\")\n\t\t\t}\n\t\t\tif m.BindOptions.Propagation != mount.PropagationRPrivate {\n\t\t\t\t// FIXME(thaJeztah): this is missing daemon-side validation\n\t\t\t\t//\n\t\t\t\t//\tdocker run --rm --mount type=bind,src=/var/run,target=/foo,bind-recursive=readonly,readonly alpine\n\t\t\t\t//\t# no error\n\t\t\t\treturn errors.New(\"option 'bind-recursive=readonly' requires 'bind-propagation=rprivate' to be specified in conjunction\")\n\t\t\t}\n\t\t}\n\t}\n\n\treturn nil\n}\n\n// validateExclusiveOptions checks if the given mount config only contains\n// options for the given mount-type.\n//\n// This is the client-side equivalent of [mounts.validateExclusiveOptions] in","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/docker/cli/blob/4f84911bfe8811e9b028e4b1fee8e7510be79387/opts/mount_utils.go#L7-L43","documentation":"Returned by validateMountOptions (opts/mount_utils.go:25) when BindOptions.ReadOnlyForceRecursive is true (set by 'bind-recursive=readonly') but the mount is not marked read-only (m.ReadOnly is false). A recursively read-only bind mount requires the mount itself to be read-only, as the kernel feature (since Linux 5.12) makes the entire subtree read-only.","triggerScenarios":"A --mount value includes 'bind-recursive=readonly' without also including 'readonly' or 'ro'. For example: '--mount type=bind,src=/x,dst=/y,bind-recursive=readonly'. validateMountOptions detects ReadOnlyForceRecursive=true with m.ReadOnly=false.","commonSituations":"Forgetting to add 'readonly' when wanting a recursively read-only bind mount, or misunderstanding that 'bind-recursive=readonly' forces the entire subtree read-only and thus requires the mount-level readonly flag.","solutions":["Add 'readonly' (or 'ro') to the --mount spec whenever using 'bind-recursive=readonly'.","Verify the host kernel is >= 5.12 and Docker Engine >= v25 for recursively read-only mount support."],"exampleFix":"// before: missing readonly\n// docker run --mount type=bind,src=/x,dst=/y,bind-recursive=readonly nginx\n\n// after: add readonly\n// docker run --mount type=bind,src=/x,dst=/y,readonly,bind-recursive=readonly nginx","handlingStrategy":"validation","validationCode":"func validateRecursiveReadonly(spec string) error {\n    if strings.Contains(spec, \"bind-recursive=readonly\") &&\n        !strings.Contains(spec, \"readonly\") && !strings.Contains(spec, \",ro\") &&\n        !strings.Contains(spec, \"ro=\") {\n        return fmt.Errorf(\"bind-recursive=readonly requires readonly to also be specified\")\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"if err := mountOpt.Set(value); err != nil {\n    if strings.Contains(err.Error(), \"bind-recursive=readonly' requires 'readonly'\") {\n        return fmt.Errorf(\"add 'readonly' to the mount spec when using bind-recursive=readonly\")\n    }\n    return err\n}","preventionTips":["Always include 'readonly' or 'ro' when using 'bind-recursive=readonly'.","Verify kernel >= 5.12 and Docker Engine >= v25 for recursively read-only mount support.","Review the bind-recursive documentation for required option combinations."],"tags":["mount","bind","validation","readonly"],"backgroundTag":null,"analyzedSha":"4f84911bfe8811e9b028e4b1fee8e7510be79387","analyzedAt":"2026-08-07T12:15:29.814Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}