<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<div class="moz-cite-prefix">On 01/19/2015 12:27 AM, Lars
Kellogg-Stedman wrote:<br>
</div>
<blockquote cite="mid:20150119052709.GA7092@redhat.com" type="cite">
<pre wrap="">On Sun, Jan 18, 2015 at 11:38:12PM -0500, Lars Kellogg-Stedman wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I think we actually want MountFlags=slave, which will permit mounts
from the global namespace to propagate into the service namespace
without permitting propagation in the other direction. It seems like
this would the Least Surprising behavior.
</pre>
</blockquote>
<pre wrap="">
...which would be the default if docker.service were itself using
PrivateTmp=true, because from systemd.exec:
Note that the file system namespace related options (PrivateTmp=,
PrivateDevices=, ProtectSystem=, ProtectHome=, ReadOnlyDirectories=,
InaccessibleDirectories= and ReadWriteDirectories=) require that mount
and unmount propagation from the unit's file system namespace is
disabled, and hence downgrade shared to slave.
So either explicitly setting MountFlags=slave, or setting
PrivateTmp=true if that doesn't cause any issues of which I am not
aware.
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
systemd-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:systemd-devel@lists.freedesktop.org">systemd-devel@lists.freedesktop.org</a>
<a class="moz-txt-link-freetext" href="http://lists.freedesktop.org/mailman/listinfo/systemd-devel">http://lists.freedesktop.org/mailman/listinfo/systemd-devel</a>
</pre>
</blockquote>
Vincent what do you think about MountFlags=slave?<br>
</body>
</html>