Ensure bind mounts are read-only