Function docker_bind_mount_readonly 

pub fn docker_bind_mount_readonly(source: &str, target: &str) -> [String; 2]

The --mount argv pair for a read-only host bind. The explicit long form, not the -v shorthand: at least one site docker proxy mis-parses the shorthand’s :ro suffix on same-path binds and silently drops the mount (verified on real hardware), while the long form passes through.