Mount a host directory read-only.

Expose existing files without allowing the container to change them.

set -euo pipefail
docker run --rm --mount "type=bind,src=$(pwd)/input,dst=/data,readonly" ubuntu:20.04 cat /data/message.txt

Expected output EXAMPLE

read-only input

Details

Requires Docker Engine and Docker Compose (the docker compose command). Run in a disposable development environment with ubuntu:20.04 available locally. See the input setup for any starting containers or files. Create an input directory with message.txt before running. The source path must exist on the Docker daemon’s host.

✓ Verified

Tested on Alpine Linux v3.24 · 2026-11-02 18:38:10 UTC · Client 29.9.0; Engine 29.9.0 · Compose 5.6.0; ubuntu:20.04

Test inputs, results and environment

The exact published code ran in a dedicated Linux test container with prepared inputs. Dedicated nested Docker daemon in a privileged test helper with no host Docker socket. No application data or host directories are mounted into the example containers. The outer helper has networking disabled; the base image is preloaded. Dockerfile examples are built and run; Compose examples start real containers. Fixtures and output records are isolated from the application database. Testing covers this example and its stated checks, not every input, operating system, or runtime version. The Linux container shares its host's kernel; this is not a native Windows test.

Architecture / host kernel: x86_64 / 6.18.54.1-microsoft-standard-WSL2
Snippet identity / locale: root inside disposable Docker-in-Docker helper / C.UTF-8
Interpreter invocation: bash -euo pipefail -c <published code>
Container image ID: sha256:aa45302a315fcbba307d6749ccbbac83af2e6f9447d6d714fce5b7b1c92b1081
Code SHA-256: 65818b4d860294236587c5648bbe4f4bdb17b616da510aea162c357aae00408d
Dependencies: Compose 5.6.0; ubuntu:20.04

Test input setup

These are the prepared inputs used by the test harness. See Details above for the prerequisites and how to run this example.

mkdir input; printf 'read-only input\n' > input/message.txt

Observed standard output

read-only input

Exit code: 0. Standard error: empty. Validation: Exact stdout comparison. System-dependent values above are one recorded run.

Additional assertions that passed

Checks recorded by the test harness. Where Python assertions are shown, browser cases use Playwright and simulator cases may inspect pin transitions: result.stdout is captured output, work is the temporary directory, and Path is pathlib.Path. The harness also imports json and csv.

All commands returned zero; exact output matched.