@@ -628,12 +628,44 @@ definitions:

           Binds:

             type: "array"

             description: |

-              A list of volume bindings for this container. Each volume binding is a string in one of these forms:

-

-              - `host-src:container-dest` to bind-mount a host path into the container. Both `host-src`, and `container-dest` must be an _absolute_ path.

-              - `host-src:container-dest:ro` to make the bind mount read-only inside the container. Both `host-src`, and `container-dest` must be an _absolute_ path.

-              - `volume-name:container-dest` to bind-mount a volume managed by a volume driver into the container. `container-dest` must be an _absolute_ path.

-              - `volume-name:container-dest:ro` to mount the volume read-only inside the container.  `container-dest` must be an _absolute_ path.

+              A list of volume bindings for this container. Each volume binding

+              is a string in one of these forms:

+

+              - `host-src:container-dest[:options]` to bind-mount a host path

+                into the container. Both `host-src`, and `container-dest` must

+                be an _absolute_ path.

+              - `volume-name:container-dest[:options]` to bind-mount a volume

+                managed by a volume driver into the container. `container-dest`

+                must be an _absolute_ path.

+

+              `options` is an optional, comma-delimited list of:

+

+              - `nocopy` disables automatic copying of data from the container

+                path to the volume. The `nocopy` flag only applies to named volumes.

+              - `[ro|rw]` mounts a volume read-only or read-write, respectively.

+                If omitted or set to `rw`, volumes are mounted read-write.

+              - `[z|Z]` applies SELinux labels to allow or deny multiple containers

+                to read and write to the same volume.

+                  - `z`: a _shared_ content label is applied to the content. This

+                    label indicates that multiple containers can share the volume

+                    content, for both reading and writing.

+                  - `Z`: a _private unshared_ label is applied to the content.

+                    This label indicates that only the current container can use

+                    a private volume. Labeling systems such as SELinux require

+                    proper labels to be placed on volume content that is mounted

+                    into a container. Without a label, the security system can

+                    prevent a container's processes from using the content. By

+                    default, the labels set by the host operating system are not

+                    modified.

+              - `[[r]shared|[r]slave|[r]private]` specifies mount

+                [propagation behavior](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt).

+                This only applies to bind-mounted volumes, not internal volumes

+                or named volumes. Mount propagation requires the source mount

+                point (the location where the source directory is mounted in the

+                host operating system) to have the correct propagation properties.

+                For shared volumes, the source mount point must be set to `shared`.

+                For slave volumes, the mount must be set to either `shared` or

+                `slave`.

             items:

               type: "string"

           ContainerIDFile: