[1.2] fix rootfs propagation mode to shared / unbindable

[rata]

(cherry picked from commit 04be81b)
Backport of #4724 to release-1.2 branch. Original description follows.

---

This PR adds support for applying mount propagation settings (MS_SHARED or MS_UNBINDABLE) to the container root based on the value of config.RootPropagation.
We apply mount propagation after executing pivot_root and rootfsParentMountPrivate

Fixes #1755

Related:
#1815
youki-dev/youki#3141

Signed-off-by: Yusuke Sakurai yusuke.sakurai@3-shake.com

[kolyshkin]

Hmm, I was not aware we're going to make another 1.2.x release. If we are, though, it's going to be 1.2.7 which already have some stuff merged.

[rata]

@kolyshkin In the release policy we said we will be quite flexible in what classifies for backport to n-1, I'd like to backport when it's simple or makes sense. Also, 1.2 is widely used in Azure, checking quickly it seems in google Container optimized OS too.

Do you prefer to avoid backports to 1.2 for some reason?

[rata]

@kolyshkin friendly ping?

[kolyshkin]

@kolyshkin In the release policy we said we will be quite flexible in what classifies for backport to n-1, I'd like to backport when it's simple or makes sense. Also, 1.2 is widely used in Azure, checking quickly it seems in google Container optimized OS too.

Do you prefer to avoid backports to 1.2 for some reason?

Not directly, no. What I prefer (being practical and lazy) is maintaining one less branch (meaning I'd love users to switch to v1.3 sooner). If we backport all fixes to v1.2 there's never an incentive to switch to v1.3. Also, making more 1.2 releases may result in thinking that v1.3 is somehow not quite ready, which is not true to my best knowledge.

Our release policy says (note "latest-1" means v1.2.x now):

latest-1 will only receive security fixes and significant bug fixes (what bug fixes are "significant" are down to the maintainer's judgement, but maintainers should err on the side of reducing the number of backports at this stage). At this stage, users of latest-1 are encouraged to start planning the migration to the latest release of runc (as well as reporting any issues they may find).

I guess I'm OK with this PR as it is (as this is indeed a significant bug fix), just don't want too much backports in general, for the reasons outlined above.

[kolyshkin]

Also, we need a backport of #4806 to release-1.2 to fix CI.

[kolyshkin]

LGTM (but please don't merge until CI is fixed).

[rata]

@kolyshkin thanks, rebased! Let's see if CI is green now 🤞