Add an explanation about the readonly mode

command/init.go

@@ -47,7 +47,7 @@ func (c *InitCommand) Run(args []string) int {
 	cmdFlags.BoolVar(&c.reconfigure, "reconfigure", false, "reconfigure")
 	cmdFlags.BoolVar(&flagUpgrade, "upgrade", false, "")
 	cmdFlags.Var(&flagPluginPath, "plugin-dir", "plugin directory")
-	cmdFlags.StringVar(&flagLockfile, "lockfile", "", "Set dependency lockfile mode")
+	cmdFlags.StringVar(&flagLockfile, "lockfile", "", "Set a dependency lockfile mode")
 	cmdFlags.Usage = func() { c.Ui.Error(c.Help()) }
 	if err := cmdFlags.Parse(args); err != nil {
 		return 1
@@ -989,7 +989,7 @@ Options:
                        previously-downloaded objects and install the
                        latest version allowed within configured constraints.
 
-  -lockfile=MODE       Set dependency lockfile mode.
+  -lockfile=MODE       Set a dependency lockfile mode.
                        Currently only "readonly" is valid.
 
 `

website/docs/cli/commands/init.html.md

@@ -157,7 +157,14 @@ You can modify `terraform init`'s plugin behavior with the following options:
   You can use `-plugin-dir` as a one-time override for exceptional situations,
   such as if you are testing a local build of a provider plugin you are
   currently developing.
-- `-lockfile=MODE` Set dependency lockfile mode. Currently only "readonly" is valid.
+- `-lockfile=MODE` Set a dependency lockfile mode.
+
+The valid values for the lockfile mode are as follows:
+
+- readonly: suppress the lockfile changes, but verify checksums against the
+  information already recorded. It conflicts with the `-upgrade` flag. If you
+  update the lockfile with third-party dependency management tools, it would be
+  useful to control when it changes explicitly.
 
 ## Running `terraform init` in automation