You can specify that a volume should be read-only by appending :ro to the -v switch:
docker run -v volume-name:/path/in/container:ro my/image
or
use –mount switch
$ docker run --mount source=volume-name,destination=/path/in/container,readonly my/image