Mount propagation different between crun and runc

[sstosh]

Related: containers/crun#1245

When using podman with crun, the mount propagation of the root directory and the directory mounted with tmpfs will be shared.
On the other hand, when using podman with runc, it will be private.

The .linux.rootfsPropagation field in the config.json created by podman is set to shared.
Therefore, it appears that runc forcibly changes the mount propagation from shared to private.

Why force mount propagation to be private?
Should it behave like crun?

Steps to reproduce:

• runc

[root@fedora38 ~]# podman info --format {{.Host.OCIRuntime.Version}}
runc version 1.1.7
spec: 1.0.2-dev
go: go1.20.3
libseccomp: 2.5.3

[root@fedora38 ~]# mkdir ~/hoge && mount -t tmpfs tmpfs ~/hoge
[root@fedora38 ~]# mount | grep "/hoge "
tmpfs on /root/hoge type tmpfs (rw,relatime,seclabel,inode64)

[root@fedora38 ~]# podman run -itd --privileged --name testcon --volume ~/hoge:/hoge:z,shared fedora-minimal:34 /bin/bash
1c8c35b02a07112d9e0fc90c5af8b3604b755d9f2bcbdc02cf373d2721b3f476

[root@fedora38 ~]# cat /var/lib/containers/storage/overlay-containers/1c8c35b02a07112d9e0fc90c5af8b3604b755d9f2bcbdc02cf373d2721b3f476/userdata/config.json | jq .linux.rootfsPropagation
"shared"

[root@fedora38 ~]# podman exec testcon mkdir /test
[root@fedora38 ~]# podman exec testcon mount -t tmpfs tmpfs /test
[root@fedora38 ~]# podman exec testcon findmnt -o "TARGET,PROPAGATION"
TARGET               PROPAGATION
/                    private
|-/test              private
|-/sys               private
| `-/sys/fs/cgroup   private
|-/proc              private
|-/dev               private
| |-/dev/console     private
| |-/dev/shm         private
| |-/dev/mqueue      private
| `-/dev/pts         private
|-/hoge              shared
|-/etc/resolv.conf   private
|-/etc/hosts         private
|-/run/.containerenv private
|-/run/secrets       private
`-/etc/hostname      private

• crun

[root@fedora38 ~]# podman info --format {{.Host.OCIRuntime.Version}}
crun version 1.8.5
commit: b6f80f766c9a89eb7b1440c0a70ab287434b17ed
rundir: /run/user/0/crun
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL

[root@fedora38 ~]# mkdir ~/hoge && mount -t tmpfs tmpfs ~/hoge
[root@fedora38 ~]# mount | grep "/hoge "
tmpfs on /root/hoge type tmpfs (rw,relatime,seclabel,inode64)

[root@fedora38 ~]# podman run -itd --privileged --name testcon --volume ~/hoge:/hoge:z,shared fedora-minimal:34 /bin/bash
2bc36a82b8738123ef0726dd23dcd9139588f9f66b50aaff3b1128dde7024a9f

[root@fedora38 ~]# cat /var/lib/containers/storage/overlay-containers/2bc36a82b8738123ef0726dd23dcd9139588f9f66b50aaff3b1128dde7024a9f/userdata/config.json | jq .linux.rootfsPropagation
"shared"

[root@fedora38 ~]# podman exec testcon mkdir /test
[root@fedora38 ~]# podman exec testcon mount -t tmpfs tmpfs /test
[root@fedora38 ~]# podman exec testcon findmnt -o "TARGET,PROPAGATION"
TARGET               PROPAGATION
/                    shared
|-/test              shared
|-/sys               private
| `-/sys/fs/cgroup   private
|-/proc              private
|-/dev               private
| |-/dev/console     private
| |-/dev/mqueue      private
| |-/dev/shm         private
| `-/dev/pts         private
|-/hoge              shared
|-/run/secrets       private
|-/run/.containerenv private
|-/etc/hostname      private
|-/etc/resolv.conf   private
`-/etc/hosts         private

[lifubang]

I think it relates to #1815 .