Explanation
This command will mount the host's '/data' directory to the ubuntu container in read-only mode, because it uses the correct syntax and options for mounting a host directory as a data volume and making it read-only.
According to the official documentation, this is an example of using a read-only volume.
References: https://docs.docker.com/engine/reference/commandline/run/#mount-volume-v-read-only
https://docs.docker.com/storage/volumes/#use-a-read-only-volume

Explanation
Using docker container inspect nginx does display a list of volumes for a specific container. The docker container inspect command shows low-level information about one or more containers in JSON format. This information includes various details about the container's configuration, state, network settings, mounts, etc.
To display a list of volumes for a specific container, you can either look at the Mounts section in the JSON output or use --format '{{ .Mounts }}' to filter out only that section. References:
https://docs.docker.com/engine/reference/commandline/container_inspect/,
https://docs.docker.com/engine/reference/commandline/container_inspect/#format-the-output

Explanation
Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints are expressions that match node labels to service labels. Node labels are key-value pairs that can be attached to nodes to identify them by certain characteristics, such as role, environment, region, etc. Service labels are key-value pairs that can be attached to services to specify scheduling preferences or requirements, such as node.role == manager or environment != production. Label constraints can be used with the
--constraint flag when creating or updating a service to ensure that the service's containers are scheduled on nodes that match the specified criteria. References:
https://docs.docker.com/engine/swarm/services/#specify-service-constraints,
https://docs.docker.com/engine/swarm/manage-nodes/#add-or-remove-label-metadata