It would seem that 1.7.x introduced regression that ro/rw status for --volumes-from is set on first container use (not per running instance). It is now not possible to use the same data container both mounted as ro and rw in different.
This works on 1.6.2 and earlier.
make tests
Creates minimal test case and shows that usage execution order matters for volume binding.
Examples use jq for parsing inspect output; so be warned...