diff --git a/drivers/fsdiff.go b/drivers/fsdiff.go
index <HASH>..<HASH> 100644
--- a/drivers/fsdiff.go
+++ b/drivers/fsdiff.go
@@ -138,6 +138,7 @@ func (gdw *NaiveDiffDriver) Changes(id string, idMappings *idtools.IDMappings, p
 	if parent != "" {
 		options := MountOpts{
 			MountLabel: mountLabel,
+			Options:    []string{"ro"},
 		}
 		parentFs, err = driver.Get(parent, options)
 		if err != nil {
drivers.NaiveDiffDriver.Changes(): mount the parent read-only

The parent layer, by virtue of being a parent layer isn't going to be
modified, so default to mounting it read-only.