AppArmor denying a mount operation
As per: http://lwn.net/Articles/281157/
Bind's have the same options as the original, so you can only bind mount a rw copy of /.. unless you remount your entire / to ro.. which I'm guessing you don't want to do.
Needs to be in two steps.
mount --bind /vital_data /untrusted_container/vital_data
mount -o remount,ro /untrusted_container/vital_data