Merge pull request #22009 from rhvgoyal/docker-cp-fix

Mount volumes rprivate for archival and other use cases
Upstream-commit: a1968615176001904e58300339df8f6d7b9b7086
Component: engine

components/engine/daemon/container_operations_unix.go

@@ -246,6 +246,19 @@ func (daemon *Daemon) mountVolumes(container *container.Container) error {
 		if err := mount.Mount(m.Source, dest, "bind", opts); err != nil {
 			return err
 		}
+
+		// mountVolumes() seems to be called for temporary mounts
+		// outside the container. Soon these will be unmounted with
+		// lazy unmount option and given we have mounted the rbind,
+		// all the submounts will propagate if these are shared. If
+		// daemon is running in host namespace and has / as shared
+		// then these unmounts will propagate and unmount original
+		// mount as well. So make all these mounts rprivate.
+		// Do not use propagation property of volume as that should
+		// apply only when mounting happen inside the container.
+		if err := mount.MakeRPrivate(dest); err != nil {
+			return err
+		}
 	}
 
 	return nil