@@ -80,6 +80,12 @@ func New() *configs.Config {

 				Device:      "sysfs",

 				Flags:       defaultMountFlags | syscall.MS_RDONLY,

 			},

+			{

+				Source:      "cgroup",

+				Destination: "/sys/fs/cgroup",

+				Device:      "cgroup",

+				Flags:       defaultMountFlags | syscall.MS_RDONLY,

+			},

 		},

 		MaskPaths: []string{

 			"/proc/kcore",

@@ -159,6 +159,21 @@ func (s *DockerSuite) TestRunContainerWithCgroupParentAbsPath(c *check.C) {

 	}

 }

+func (s *DockerSuite) TestRunContainerWithCgroupMountRO(c *check.C) {

+	testRequires(c, NativeExecDriver)

+

+	filename := "/sys/fs/cgroup/devices/test123"

+	cmd := exec.Command(dockerBinary, "run", "busybox", "touch", filename)

+	out, _, err := runCommandWithOutput(cmd)

+	if err == nil {

+		c.Fatal("expected cgroup mount point to be read-only, touch file should fail")

+	}

+	expected := "Read-only file system"

+	if !strings.Contains(out, expected) {

+		c.Fatalf("expected output from failure to contain %s but contains %s", expected, out)

+	}

+}

+

 func (s *DockerSuite) TestRunDeviceDirectory(c *check.C) {

 	testRequires(c, NativeExecDriver)

 	cmd := exec.Command(dockerBinary, "run", "--device", "/dev/snd:/dev/snd", "busybox", "sh", "-c", "ls /dev/snd/")