In this lesson, you will learn how to control the flow of mount events between your host system and containerized mount namespaces using propagation flags.
The Problem of Isolation
When you create a new mount namespace, it is initially isolated. By default, if you mount a new drive or partition on your host, that change is invisible to the processes inside a container namespace. While this isolation is generally desirable for security, it creates a maintenance hurdle: how do we allow specific filesystem changes (like hot-plugging a volume) to "bleed" into the container without breaking the wall of isolation?
Mount Propagation Flags
Linux solves this by attaching a "propagation type" to each mount point. These flags determine whether a mount or unmount event in one namespace should trigger the same action in a peer namespace. There are four primary modes:
MS_PRIVATE: The default. Mount events do not propagate into or out of the mount point. It is completely isolated.MS_SHARED: Mounts are "cloned" across namespaces. If you mount a drive in the host, it automatically appears in the container.MS_SLAVE: A one-way street. The mount receives events from a master (the host), but changes made inside the container do not propagate back to the host. This is the "gold standard" for most container runtimes.MS_UNBINDABLE: The mount cannot be used as the source for a bind mount.
Practical Configuration
You configure these flags using the mount() system call or the mount command. For instance, to ensure a container remains a "slave" to the host's primary mount events, you would typically issue:
# Set a mount point to be a slave
mount --make-slave /var/lib/container/mountpoint
By marking a container's root filesystem or volume mounts as MS_SLAVE, you ensure that the container stays synchronized with the host's storage reality without granting the container the power to accidentally (or maliciously) unmount filesystems on your host machine.
Key Takeaway: Mount propagation flags define the directionality of mount events, with MS_SLAVE providing the ideal balance of host-to-container synchronization while maintaining strict security boundaries.