mount: support the Docker v25 form of recursive read-only (RRO) mounts

[AkihiroSuda]

Read-only bind and volume mounts (-v src:dst:ro, --mount ...,readonly) are now made recursively read-only when the kernel (>= 5.12) and the OCI runtime (runc >= 1.1, crun >= 1.8.6) support the "rro" mount option, following Docker v25 (moby/moby#45278).

The behavior is customizable with the bind-recursive option of --mount (docker/cli#4316):

• enabled (default): recursive bind; recursively read-only when supported
• disabled: non-recursive bind
• writable: submounts of a read-only mount are kept writable (Docker v24 behavior)
• readonly: force recursively read-only, or raise an error

The boolean aliases of bind-recursive (unreleased) are removed, following docker/cli#4671.

Whether the OCI runtime supports RRO mounts is detected by running $RUNTIME features, with the result cached in the XDG cache directory (e.g., ~/.cache/nerdctl/oci-runtime-features), invalidated when the runtime binary is modified.

The old rro option of -v and --mount, introduced in nerdctl v0.14 ahead of Docker, is now deprecated in favor of the Docker v25 form: --mount type=bind,src=...,dst=...,readonly,bind-propagation=rprivate,bind-recursive=readonly. It now raises an error (instead of silently degrading to plain "ro") when RRO mounts are not supported.

Fix #2651

Assisted-by: Claude Fable 5 noreply@anthropic.com

[Copilot]

Pull request overview

This PR updates nerdctl’s mount handling to match Docker v25’s recursive read-only (RRO) semantics: read-only bind/volume mounts become recursively read-only when supported (kernel + OCI runtime), with explicit control via --mount ... bind-recursive=.... It also adds OCI runtime feature detection via $RUNTIME features with XDG cache persistence, and deprecates nerdctl’s legacy rro option in favor of the Docker v25 form.

Changes:

• Implement Docker v25-compatible RRO behavior (default “recursive if possible” for ro/readonly) plus bind-recursive={enabled,disabled,writable,readonly} handling.
• Add OCI runtime feature probing (<runtime> features) with on-disk cache invalidation on runtime binary modification.
• Update docs/tests and deprecate legacy rro option behavior (now errors when RRO isn’t supported rather than silently degrading).

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
README.md	Updates feature documentation to reflect Docker v25 syntax support and deprecation of legacy rro.
pkg/ociruntimeutil/rro_linux.go	Adds kernel+runtime capability check for RRO with in-process caching.
pkg/ociruntimeutil/ociruntimeutil.go	Introduces OCI runtime binary resolution and $RUNTIME features probing with XDG cache.
pkg/ociruntimeutil/ociruntimeutil_linux_test.go	Unit tests for runtime feature probing and cache invalidation behavior.
pkg/mountutil/mountutil.go	Threads --runtime through -v parsing so read-only mode can depend on runtime capabilities.
pkg/mountutil/mountutil_linux.go	Implements Docker v25 read-only semantics and bind-recursive modes; deprecates rro option path.
pkg/mountutil/mountutil_linux_test.go	Expands unit test coverage for RRO modes, deprecations, and error cases.
pkg/mountutil/mountutil_windows.go	Updates function signatures to accept ociRuntime (still not implemented on Windows).
pkg/mountutil/mountutil_windows_test.go	Updates tests for the new ProcessFlagV/parseVolumeOptions signatures.
pkg/mountutil/mountutil_darwin.go	Updates function signatures to accept ociRuntime (not implemented).
pkg/mountutil/mountutil_freebsd.go	Updates function signatures to accept ociRuntime (not implemented).
pkg/containerutil/cp_resolve_linux.go	Treats rro as read-only when resolving mounts for cp-related logic.
pkg/cmd/container/run_mount.go	Passes options.Runtime into mount parsing to enable runtime-aware RRO decisions.
docs/command-reference.md	Documents Docker v25 bind-recursive modes, runtime feature detection cache, and rro deprecation.
cmd/nerdctl/container/container_run_mount_linux_test.go	Adds integration tests validating recursive read-only behavior and deprecated rro behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.