Very very important point about mount namespaces is completely missed.
I m not going to give big detailed explanation but will give you some flavour.
When we use two mount namespaces it does NOT mean that we have two independent file systems. it is completely wrong.
we have mount point /01 in mount name space A
next we create mount namespace B from A.
now we have /01 in mount namespace B.
next we make /01 in B as private
(namespace B) # mount --make-private /01
next we create file in A
(namespace A) # touch /01/a.txt
we will see that file in B /01
next we create b.txt in B
(namespace B)# touch /01/b.txt
and we will see b.txt in A /01
So. there is no any independence between mount namespaces.
there is 100% transparancy as for simple files and simple folders between two mount points
when one mount point in one namespace is the source for another mount point for another namespace. It doesnt matter what options you will assign for mountpoints (shared, private, slave). it will not help at all.
So if you think you make new mount namespace assgin private options for all mountpoints in new namespace and get independents filesystem - it is completely wrong.
The real independence is related ONLY for NEW SUB-mountpoints.
Also if you make new sub-mount point in new namespace
in general it does not mean that this submount point is independent
from another mount namespace. the point is that every mount
point has backend ( for instance some real physical disk).
So if you know the backend you can mount it and make changes.
(namespace A) # mount /dev/sdb1 /mnt
(namespace A) # mount --make-private /mnt
(namespace A) # unshare -m bash
(namespace B) #
return to namespace A
(namespace A) # mkdir /mnt/01
(namespace A) # mount /dev/sdc1 /mnt/01
(namespace A) # mount --make-private /mnt/01
(namespace A) # touch /mnt/01/a.txt
we will not see a.txt in namespace B
(namespace B) # ls -1al /mnt/01
it will show nothing.
so all is fine at the moment.
but when we know that for /mnt/01 backend is /dev/sdc1
we can mount this backend in namespace B and at last will see a.txt
(namespace B) # mkdir /mnt/02
(namespace B) # mount /dev/sdc1 /mnt/02
(namespace B) # ls -1al /mnt/02/a.txt
Finally, as a conclusion - mount namespaces are tricky things
and you must understand all the details under the hood
very good to make really
independent file system or get the result you want to get from them.