fix(devcontainer): preserve readonly compose mounts

pkg/devcontainer/compose.go

@@ -27,6 +27,7 @@ const (
 	ConfigFilesLabel                = "com.docker.compose.project.config_files"
 	FeaturesBuildOverrideFilePrefix = "docker-compose.devcontainer.build"
 	FeaturesStartOverrideFilePrefix = "docker-compose.devcontainer.containerFeatures"
+	readOnlyMountOption             = "readonly"
 )
 
 type composeProjectFiles struct {
@@ -1126,9 +1127,10 @@ exec "$$@"
 
 	for _, mount := range mergedConfig.Mounts {
 		overrideService.Volumes = append(overrideService.Volumes, composetypes.ServiceVolumeConfig{
-			Type:   mount.Type,
-			Source: mount.Source,
-			Target: mount.Target,
+			Type:     mount.Type,
+			Source:   mount.Source,
+			Target:   mount.Target,
+			ReadOnly: isReadOnlyMount(mount),
 		})
 	}
 
@@ -1158,6 +1160,15 @@ exec "$$@"
 	return project
 }
 
+func isReadOnlyMount(mount *config.Mount) bool {
+	for _, option := range mount.Other {
+		if option == readOnlyMountOption || option == "ro" {
+			return true
+		}
+	}
+	return false
+}
+
 func (r *runner) configureGPUResources(
 	parsedConfig *config.SubstitutedConfig,
 	gpuSupportEnabled bool,

pkg/devcontainer/compose_test.go

@@ -9,10 +9,13 @@ import (
 	"github.com/skevetter/devpod/pkg/compose"
 	"github.com/skevetter/devpod/pkg/devcontainer/config"
 	"github.com/skevetter/devpod/pkg/devcontainer/feature"
+	"github.com/skevetter/devpod/pkg/docker"
 	logLib "github.com/skevetter/log"
 	"github.com/stretchr/testify/suite"
 )
 
+const bindMountType = "bind"
+
 type composeBuildImageNameTestCase struct {
 	name          string
 	composeHelper *compose.ComposeHelper
@@ -173,6 +176,50 @@ func (s *ComposeSuite) TestCreateComposeServiceUsesBuildImageName() {
 	s.requireBuildArgValue(service.Build.Args, "BUILDKIT_INLINE_CACHE", "1")
 }
 
+func (s *ComposeSuite) TestGenerateDockerComposeUpProjectPreservesReadOnlyMountOptions() {
+	r := &runner{}
+
+	project := r.generateDockerComposeUpProject(
+		&config.SubstitutedConfig{Config: &config.DevContainerConfig{}},
+		&config.MergedDevContainerConfig{
+			NonComposeBase: config.NonComposeBase{
+				Mounts: []*config.Mount{
+					{
+						Type:   bindMountType,
+						Source: "/tmp/read-only-data",
+						Target: "/workspace/read_only_folder",
+						Other:  []string{readOnlyMountOption},
+					},
+					{
+						Type:   bindMountType,
+						Source: "/tmp/read-only-short-data",
+						Target: "/workspace/read_only_short_folder",
+						Other:  []string{"ro"},
+					},
+					{
+						Type:   bindMountType,
+						Source: "/tmp/valued-read-only-data",
+						Target: "/workspace/valued_read_only_folder",
+						Other:  []string{"readonly=true"},
+					},
+				},
+			},
+		},
+		&compose.ComposeHelper{Docker: &docker.DockerHelper{DockerCommand: "true"}},
+		&composetypes.ServiceConfig{Name: "app"},
+		"mcr.microsoft.com/devcontainers/base:noble",
+		"mcr.microsoft.com/devcontainers/base:noble",
+		&config.ImageDetails{},
+		nil,
+	)
+
+	service := project.Services["app"]
+	s.Require().Len(service.Volumes, 3)
+	s.True(service.Volumes[0].ReadOnly)
+	s.True(service.Volumes[1].ReadOnly)
+	s.False(service.Volumes[2].ReadOnly)
+}
+
 func (s *ComposeSuite) requireBuildArgValue(
 	args composetypes.MappingWithEquals,
 	key, want string,