On further testing, this does actually work. You may set both read_only: true, and cap_drop: all and it will work as long as you have a named volume. I had it mount a database file from the host system for my test config, which is why I was getting the errors. I don’t know how to make that work though i.e. when the db is bind mounted from the host system. Setting the mount :rw doesn’t seem to fix it.