dotcloud/docker — pull request #4448 by alexlarsson (2014-03-04 11:51:10+00:00)
Title: libcontainer: Use pivot_root instead of chroot

Instead of keeping all the old mounts in the container namespace and
just using subtree as root we pivot_root so that the actual root in
the namespace is the root we want, and then we unmount the previous
mounts.

This has multiple advantages:

* The namespace mount tree is smaller (in the kernel)
* If you break out of the chroot you could previously access the host
filesystem. Now the host filesystem is fully invisible to the namespace.
* We get rid of all unrelated mounts from the parent namespace, which means
we don't hog these. This is important if we later switch to MS_PRIVATE instead
of MS_SLAVE as otherwise these mounts would be impossible to unmount from the
parent namespace.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson (github: alexlarsson)