Your comment intrigued me so I read the issue, but I don't follow how his comments re a potential security concern and being able to overmount from inside the container lead to a conclusion of not seeing the point.
As a cybersecurity guy, my interpretation is that the requested change could introduce a vulnerability and that there is another potential path to achieve the same result, which should likely be explored first.
Any change that can compromise security needs significant justification, and should come with guards to allow it to be used in those cases where no other alternatives exist, without impacting other cases.
I've mostly used podman and am far from expert, and have long been intrigued by nspawn, so I really would like to understand the rationale.
Any other examples of nspawn mount limitations impacting operations without "workarounds"? Thanks!
As a cybersecurity guy, my interpretation is that the requested change could introduce a vulnerability and that there is another potential path to achieve the same result, which should likely be explored first.
Any change that can compromise security needs significant justification, and should come with guards to allow it to be used in those cases where no other alternatives exist, without impacting other cases.
I've mostly used podman and am far from expert, and have long been intrigued by nspawn, so I really would like to understand the rationale.
Any other examples of nspawn mount limitations impacting operations without "workarounds"? Thanks!