When we create the outer mount namespace, we still want to receive any
mounts from the host system which is why we set it to slave.
The second mount namespace should be a copy of the outer one but should not
propagate anything back to the outer mount namespace.
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
# Create a new mount namespace
"--mount"
- "--propagation=slave"
+ "--propagation=private"
# Create a new PID namespace and fork
"--pid"
IN_NAMESPACE=1 \
exec unshare \
--mount \
- --propagation=private \
+ --propagation=slave \
"${0}" "${args[@]}" "$@"
}