mountPropagation: None equates to rprivate, not private

[AkihiroSuda]

Evidences:

• kubelet translates core/v1.MountPropagationNone to runtimeapi.MountPropagation_PROPAGATION_PRIVATE:
  • https://github.com/kubernetes/kubernetes/blob/v1.26.1/pkg/kubelet/kubelet_pods.go#L298
• CRI runtimes translate runtimeapi.MountPropagation_PROPAGATION_PRIVATE to OCI mount option "rprivate":
  • https://github.com/containerd/containerd/blob/v1.6.16/pkg/cri/opts/spec_linux.go#L181
  • https://github.com/cri-o/cri-o/blob/v1.26.1/server/container_create_linux.go#L982

---

This commit also replaces the link to https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt with https://man7.org/linux/man-pages/man8/mount.8.html , as the former one does not mention rprivate .

[netlify]

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	8355f38
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/63e78602b17be9000899a26c
😎 Deploy Preview	https://deploy-preview-39385--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[tengqm]

/approve

[sftim]

/sig node

This should have tech review by someone confident to check the evidence.

[sftim]

/approve

FWIW

[reylejano]

@kubernetes/sig-node-pr-reviews , can we have a tech review on this PR?

[endocrimes]

I think we might need to reword this a little more - While cri-o and containerd do use rprivate, Kubernetes implementations that still support dockershim, or use cri-dockerd and forks (or other vendor provided cri's) may still be using private. (https://github.com/Mirantis/cri-dockerd/blob/9a87d6ae274ecf0f23776920964d6484bd679282/libdocker/helpers.go#L236)

This might need to become a "cri-o and containerd use rprivate, other cri's may use private" type change

/hold

[AkihiroSuda]

I think we might need to reword this a little more - While cri-o and containerd do use rprivate, Kubernetes implementations that still support dockershim, or use cri-dockerd and forks (or other vendor provided cri's) may still be using private. (https://github.com/Mirantis/cri-dockerd/blob/9a87d6ae274ecf0f23776920964d6484bd679282/libdocker/helpers.go#L236)

This might need to become a "cri-o and containerd use rprivate, other cri's may use private" type change

/hold

No, cri-dockerd+dockerd never uses the private propagation. The comment line in cri-dockerd is wrong.

But you are right that the propagation isn't always rprivate, as dockerd conditionally changes the default propagation to rslave when the mount source containers the daemon root (/var/lib/docker):

• Fix comment lines about the default mount propagation Mirantis/cri-dockerd#159

---
apiVersion: v1
kind: Pod
metadata:
  name: propagation-test1
spec:
  containers:
    - name: sleep
      image: busybox
      command: ['sleep', 'infinity']
      volumeMounts:
        - mountPath: /mnt
          name: mnt
          mountPropagation: None
          # The mount propagation `None` is translated to:
          # - cri-dockerd v0.3.0, with Docker v20.10.23: rprivate
          # - containerd v1.6.15: rprivate
          # - CRI-O v1.24.1: rprivate
  volumes:
    - name: mnt
      hostPath:
        path: /mnt
---
apiVersion: v1
kind: Pod
metadata:
  name: propagation-test2
spec:
  containers:
    - name: sleep
      image: busybox
      command: ['sleep', 'infinity']
      volumeMounts:
        - mountPath: /mnt
          name: mnt
          mountPropagation: None
          # The mount propagation `None` is translated to:
          # - cri-dockerd v0.3.0, with Docker v20.10.23: rslave
          # - containerd v1.6.15: rprivate
          # - CRI-O v1.24.1: rprivate
          #
          # Docker changes the default propagation to "rslave",
          # because the mount source (`/`) contains `/var/lib/docker`.
          # - https://github.com/moby/moby/blob/v20.10.23/daemon/volumes.go#L137-L143
          # - https://github.com/moby/moby/blob/v20.10.23/daemon/volumes_linux.go#L11-L36
          #
          # This behavior was introduced in Docker 18.03: https://github.com/moby/moby/pull/36055
          #
          # containerd and CRI-O do not automatically change the propagation:
          # - https://github.com/containerd/containerd/blob/v1.6.15/pkg/cri/opts/spec_linux.go#L181
          # - https://github.com/cri-o/cri-o/blob/v1.24.1/server/container_create_linux.go#L967
  volumes:
    - name: mnt
      hostPath:
        path: /

Updated the PR to clarify this limitation.

[endocrimes]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: endocrimes, sftim, tengqm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• content/en/OWNERS [sftim,tengqm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: 083ba25f6fd69dbfed9b566c8e2a7954eeeacd0e

[endocrimes]

(leaving the unhold to someone from sig-docs)

[tengqm]

/hold cancel