Container Basics On Linux (Namespaces/Cgroups)
Stop your nested containers from tripping over host mount points
🧩 The Challenge
You ever tried to run Docker inside a VM, only to find the container can see every single mount on the parent host? It makes a mess of your filesystem visibility and creates a security nightmare I’ve spent way too many Friday nights cleaning up.
đź’ˇ The Fix
Flip the mount namespace propagation to slave mode so your child processes stop leaking mount events back to the host kernel. It keeps your container isolation actually isolated instead of just a suggestion.
mount --make-rslave /⚙️ Why It Works
Setting the propagation to slave ensures that mount events from the host are received, but any mounts performed inside your container stay local to that namespace. Without this, your container’s /proc/mounts starts looking like a directory dump of the entire physical server.
🚀 Pro-Tip: Check your /proc/self/mountinfo to see the current propagation status before you start nesting things.
Linux Tips & Tricks | © ngelinux.com | 7/30/2026