Best Practice: Read Only Mounts in Swarm

Current Setup

Right now, my current setup looks something like this,

driver = DriverConfig(
    name=None,
    options={
        "o": "nfsvers=4.0,noatime,nodiratime,soft,addr=x.x.x.x,ro", #read-only
        "device": ":/path/to/data",
        "type": "nfs",
       },
)

mount = Mount(
    type="volume",
    source=None,
    target="/data",
    driver_config=driver,
)

container = ContainerSpec(
    image=image_name,
    command=command,
    args=arguments,
    env=environment,
    mounts=[mount]
    ...
)
task = TaskTemplate(
    container_spec=container,
    restart_policy=RestartPolicy("none"),
    placement=placement,
    resources=resources,
    ...
)
service = client.create_service(
    task,
    name=name,
    networks=["swarm-attachable-network"] ,
    endpoint_spec=EndpointSpec(mode="vip"),
)

Question

Alternatively, there is also an option to specify a mount to be read-only via,

mount = Mount(
    type="volume",
    source=None,
    target="/data",
    driver_config=driver,
    read_only=True, # read-only
    ...
)

This fails however with the following error,

"invalid mount config for type "volume": must not set readonly mode when using anonymous volumes"

In this scenario what is the best practice to deploy NFS mounts?

• Can source be any uuid identifier?
• Does source have to be a pre-defined volume?
• Do you have to make host specific volume on each swarm node?
• Can you centrally manage volumes?

No repository files or tests are named. Start by reviewing the Mount, DriverConfig, ContainerSpec, and Docker Swarm volume behavior involved in the example, then verify the supported NFS deployment patterns. Done means documenting whether source identifiers, predefined volumes, host-specific volumes, and centralized volume management are supported, including the read-only limitation.