From 8355f38ae431e3bd04c01ac66a3e0b8f37fc0382 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Fri, 10 Feb 2023 13:33:02 +0900 Subject: [PATCH] `mountPropagation: None` equates to `rprivate`, not `private` Evidences: - https://github.com/containerd/containerd/blob/v1.6.16/pkg/cri/opts/spec_linux.go#L181 - https://github.com/cri-o/cri-o/blob/v1.26.1/server/container_create_linux.go#L982 This commit also replaces the link to https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt with https://man7.org/linux/man-pages/man8/mount.8.html , as the former one does not mention `rprivate` . Signed-off-by: Akihiro Suda --- content/en/docs/concepts/storage/volumes.md | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/content/en/docs/concepts/storage/volumes.md b/content/en/docs/concepts/storage/volumes.md index 9ae9febe3bb..80f259aab31 100644 --- a/content/en/docs/concepts/storage/volumes.md +++ b/content/en/docs/concepts/storage/volumes.md @@ -1282,8 +1282,13 @@ in `Container.volumeMounts`. Its values are: In similar fashion, no mounts created by the container will be visible on the host. This is the default mode. - This mode is equal to `private` mount propagation as described in the - [Linux kernel documentation](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + This mode is equal to `rprivate` mount propagation as described in + [`mount(8)`](https://man7.org/linux/man-pages/man8/mount.8.html) + + However, the CRI runtime may choose `rslave` mount propagation (i.e., + `HostToContainer`) instead, when `rprivate` propagation is not applicable. + cri-dockerd (Docker) is known to choose `rslave` mount propagation when the + mount source contains the Docker daemon's root directory (`/var/lib/docker`). * `HostToContainer` - This volume mount will receive all subsequent mounts that are mounted to this volume or any of its subdirectories. @@ -1296,7 +1301,7 @@ in `Container.volumeMounts`. Its values are: propagation will see it. This mode is equal to `rslave` mount propagation as described in the - [Linux kernel documentation](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + [`mount(8)`](https://man7.org/linux/man-pages/man8/mount.8.html) * `Bidirectional` - This volume mount behaves the same the `HostToContainer` mount. In addition, all volume mounts created by the container will be propagated @@ -1306,7 +1311,7 @@ in `Container.volumeMounts`. Its values are: a Pod that needs to mount something on the host using a `hostPath` volume. This mode is equal to `rshared` mount propagation as described in the - [Linux kernel documentation](https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt) + [`mount(8)`](https://man7.org/linux/man-pages/man8/mount.8.html) {{< warning >}} `Bidirectional` mount propagation can be dangerous. It can damage