[Followups set to comp.os.linux.misc since I don't read any of the other
groups]

On 1/6/23 21:12, Lew Pitcher wrote:
>
> The reason I get "Operation not permitted" on the
> container /proc mount on my "production" system is that
> I also run an nfs server on my "production" system (and
> do not run one on my development system), and is nfs
> server maintains two mountpoints within the /proc
> filesystem.
>
> Apparently, the attempt to mount /proc within my container
> was blocked by the existance of these two mount points
> (/proc/fs/nfs and /proc/fs/nfsd), as when I shut down my
> rpc and nfs servers, and umounted these two mounts, I could
> successfully run my demo container.
>
> /Now/ the question is: how do I get my container /proc mount
> to ignore or bypass these two nfsd mounts?

In your OP you showed that you've got MS_REC in the mountflags field,
which will cause a recursive mount; i.e., you've explicitly asked for
the inclusion of the NFS-related subtrees. Have you tried without that
flag? MS_BIND would seem a more appropriate choice instead, IMHO, since
it doesn't do the recursion. Then, by default, the subtrees will be
excluded.

See also the section on "Changing the propagation type of an existing
mount" in the mount(2) man page for other ways to prevent the NFS
subtrees from being processed recursively. That might be relevant if
you want to recurse into other parts of the /proc tree, just not the two
directories you've named.