Using bind mounts with Overlayfs

Question

I am attempting to create a virtual mount using bind mounts in combination with OverlayFS. What would be most optimal is as follows:

The root folder is bind-mounted to a new sub-folder, and used as the lower directory. A new upper directory is created to save the differences of the overlay, a work_dir directory for the workdir component and finally a mnt directory to mount the overlay to.

The issue I am having, is that once this is set-up, the contents of the bind mount do not appear in the overlay.

I have researched different properties of the mounts, including the use of recursive mounts and shared/non-shared mounts. Alternatively, I tried bind mounting the individual folders on the root to respective folders under the lowerdir; still no files. Am I missing a setting in either of the mounts, or is this simply not possible?

Answer 1

It is possible to create bind mounts within the mountpoint of an overlayfs. I was only able to accomplish this with C code since the mount(8) command does not provide this option.

<fd> = openat(AT_FDCWD, <merge-dir>, O_RDONLY|O_CLOEXEC|O_PATH)
mount(<source-dir>, "/proc/self/fd/<fd>", "", MS_BIND|MS_REC, NULL)
close(<fd>)

<merge-dir> is the directory to be mounted into relative to the host system, mnt/lower in your case

<source-dir> is the directory to be mounted from, <root directory> in your case. It is also relative to the host system.

<fd> is the file descriptor int returned by openat, it needs to be concated with the /proc/self/fd/ string.

This process can be done immediately after the overlayfs is mounted or anytime after.

I found this by looking at system calls from 'docker run' when executed with the option --mount type=bind when seems to do exactly what you describe in your diagram. Since overlay mounts do not implicitly include child mounts (even with MS_REC), openat(2) can be used to open a file descriptor corresponding to the directory to be mounted into. The file descriptor device file in /proc/self/fd/ can then be used as the target of a bind mount which will stay open after the descriptor is closed.