Merge pull request #19176 from dvdksn/moby-25-rro-changed-default

engine: clarify breaking change for recursive mounts

content/engine/release-notes/25.0.md

@@ -28,6 +28,24 @@ For a full list of pull requests and changes in this release, refer to the relev
 - [docker/cli, 25.0.0 milestone](https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A25.0.0)
 - [moby/moby, 25.0.0 milestone](https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A25.0.0)
 
+> **Note**
+>
+> In earlier versions of Docker Engine, recursive mounts (submounts) would
+> always be mounted as writable, even when specifying a read-only mount. This
+> behavior has changed in v25.0.0, for hosts running on kernel version 5.12 or
+> later. Now, read-only bind mounts are **recursively read-only** by default.
+>
+> To get the same behavior as earlier releases, you can specify the
+> `bind-recursive` option for the `--mount` flag.
+>
+> ```console
+> $ docker run --mount type=bind,src=SRC,dst=DST,readonly,bind-recursive=writable IMAGE
+> ```
+>
+> This option isn't supported with the `-v` or `--volume` flag.
+> For more information, see
+> [Recursive mounts](../../storage/bind-mounts.md#recursive-mounts).
+
 ### New
 
 - Add OpenTelemetry tracing. [moby/moby#45652](https://github.com/moby/moby/pull/45652), [moby/moby#45579](https://github.com/moby/moby/pull/45579)