Repository: kubernetes
Issue: Unable to mount configMap below readOnly emptyDir
Labels: kind/bug,sig/storage,lifecycle/stale,triage/needs-information,needs-triage

### What happened?

ConfigMap, DownwardAPI, and Secret volumes can be mounted within each other since #60342. However, when I try to do the same with a read-only emptyDir, the container fails to start, and `runc` returns an error: `read-only file system: unknown`.

For example, this pod creates, but the container fails to start:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: mount-subdirectory-issue
spec:
  containers:
    - name: main
      image: busybox
      command: [sleep, 5m]
      volumeMounts:
        - mountPath: /var/my-settings
          name: one
          readOnly: true
        - mountPath: /var/my-settings/conf.d
          name: two
          readOnly: true
  volumes:
    - name: one
      emptyDir: {}
    - name: two
      configMap:
        name: two
        optional: true
```

```console
$ kubectl describe -f pod.yaml
…
    Mounts:
      /var/my-settings from one (ro)
      /var/my-settings/conf.d from two (ro)
      /var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-fvv44 (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  one:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  <unset>
  two:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      two
    Optional:  true
…
Events:
  Type     Reason     Age              From               Message
  ----     ------     ----             ----               -------
…
  Normal   Created    0s (x2 over 2s)  kubelet            Created container main
  Warning  Failed     0s (x2 over 1s)  kubelet            Error: failed to create containerd task: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error mounting "/var/lib/kubelet/pods/44d290fb-2697-4ef1-b45a-1ebb176aa70f/volumes/kubernetes.io~configmap/two" to rootfs at "/var/my-settings/conf.d": mkdir /run/k3s/containerd/io.containerd.runtime.v2.task/k8s.io/main/rootfs/var/my-settings/conf.d: read-only file system: unknown
```

### What did you expect to happen?

I'm so used to arranging ConfigMap and Secret mounts in this way, I expected all ephemeral volume mounts to behave the same.

When volume `one` above is a Secret or ConfigMap, volume `two` mounts just fine.

```yaml
  volumes:
    - name: one
      configMap:
        name: one
        optional: true
```

### How can we reproduce it (as minimally and precisely as possible)?

Create a pod with one container and two `emptyDir` volume mounts such that one is mounted as a subdirectory of the other.

See the example YAML above.

### Anything else we need to know?

I suspect a call to `volumeutil.MakeNestedMountpoints` around here might resolve it: https://github.com/kubernetes/kubernetes/blob/c46d737ce5ad0bb3e658736476feee41773d531d/pkg/volume/emptydir/empty_dir.go#L282-L284

The runc project has an open issue to change this particular error message:
- https://github.com/opencontainers/runc/issues/2084

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.1+k3s1", GitCommit:"f10af367c3c96863c081ada4018e94e085c9404d", GitTreeState:"clean", BuildDate:"2023-01-26T00:59:34Z", GoVersion:"go1.19.5", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"26", GitVersion:"v1.26.1+k3s1", GitCommit:"f10af367c3c96863c081ada4018e94e085c9404d", GitTreeState:"clean", BuildDate:"2023-01-26T00:59:34Z", GoVersion:"go1.19.5", Compiler:"gc", Platform:"linux/amd64"}
```

</details>


### Cloud provider

n/a

### OS version

<details>

```console
$ cat /etc/os-release
NAME="AlmaLinux"
VERSION="8.7 (Stone Smilodon)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="8.7"
PLATFORM_ID="platform:el8"
PRETTY_NAME="AlmaLinux 8.7 (Stone Smilodon)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:8::baseos"
HOME_URL="https://almalinux.org/"
DOCUMENTATION_URL="https://wiki.almalinux.org/"
BUG_REPORT_URL="https://bugs.almalinux.org/"

ALMALINUX_MANTISBT_PROJECT="AlmaLinux-8"
ALMALINUX_MANTISBT_PROJECT_VERSION="8.7"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.7"

$ uname -a
Linux alma.local 4.18.0-425.10.1.el8_7.x86_64 #1 SMP Thu Jan 12 10:05:00 EST 2023 x86_64 x86_64 x86_64 GNU/Linux
```

</details>


### Install tools

<details>

```
k3s version v1.26.1+k3s1 (f10af367)
```

</details>


### Container runtime (CRI) and version (if applicable)

<details>

```
containerd github.com/k3s-io/containerd v1.6.15-k3s1
```

```
runc version 1.1.4
commit: v1.1.4-0-g5fd4c4d
spec: 1.0.2-dev
go: go1.19.5
libseccomp: 2.5.4
```

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>