code: func remountReadonly(path string) error {
  	for i := 0; i < 5; i++ {
  		if err := syscall.Mount("", path, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil && !os.IsNotExist(err) {
  			switch err {
  			case syscall.EINVAL:
  				// Probably not a mountpoint, use bind-mount
  				if err := syscall.Mount(path, path, "", syscall.MS_BIND, ""); err != nil {
  					return err
  				}
  				return syscall.Mount(path, path, "", syscall.MS_BIND|syscall.MS_REMOUNT|syscall.MS_RDONLY|syscall.MS_REC|defaultMountFlags, "")
  			case syscall.EBUSY:
  				time.Sleep(100 * time.Millisecond)
  				continue
  			default:
  				return err
  			}
  		}
  		return nil
  	}
  	return fmt.Errorf("unable to mount %s as readonly max retries reached", path)
  }
docs: // remountReadonly will bind over the top of an existing path and ensure that it is read-only.