core: delegate mountns implicitly when any of pidns/cgns/netns is in use

2025-03-30 18:57:18 +02:00
parent 2b4cfbf91f
commit 32b69b190b
3 changed files with 17 additions and 2 deletions
@@ -2411,6 +2411,11 @@ RestrictNamespaces=~cgroup net</programlisting>
        done with the namespace specific unit setting such as <varname>PrivateNetwork=</varname> or
        <varname>PrivateMounts=</varname>.</para>

+        <para>Note that some namespace sandboxing options might entail mount namespace for private API VFS instances,
+        such as <varname>PrivatePIDs=</varname>, <varname>ProtectControlGroups=private/strict</varname>, or
+        <varname>PrivateNetwork=</varname>. If any of the mentioned options are enabled, mount namespace
+        is implicitly delegated.</para>
+
        <xi:include href="version-info.xml" xpointer="v258"/></listitem>
      </varlistentry>