diff --git a/libcontainer/nsinit/mount.go b/libcontainer/nsinit/mount.go
index 4b5a42b..3b0cf13 100644
--- a/libcontainer/nsinit/mount.go
+++ b/libcontainer/nsinit/mount.go
@@ -37,14 +37,21 @@ func setupNewMountNamespace(rootfs string, bindMounts []libcontainer.Mount, cons
 	}
 
 	for _, m := range bindMounts {
-		flags := syscall.MS_BIND | syscall.MS_REC
+		var (
+			flags = syscall.MS_BIND | syscall.MS_REC
+			dest  = filepath.Join(rootfs, m.Destination)
+		)
 		if !m.Writable {
 			flags = flags | syscall.MS_RDONLY
 		}
-		dest := filepath.Join(rootfs, m.Destination)
 		if err := system.Mount(m.Source, dest, "bind", uintptr(flags), ""); err != nil {
 			return fmt.Errorf("mounting %s into %s %s", m.Source, dest, err)
 		}
+		if !m.Writable {
+			if err := system.Mount(m.Source, dest, "bind", uintptr(flags|syscall.MS_REMOUNT), ""); err != nil {
+				return fmt.Errorf("remounting %s into %s %s", m.Source, dest, err)
+			}
+		}
 		if m.Private {
 			if err := system.Mount("", dest, "none", uintptr(syscall.MS_PRIVATE), ""); err != nil {
 				return fmt.Errorf("mounting %s private %s", dest, err)