17.06.2026 14:13, Mantas Mikulėnas wrote:
I keep getting those even with Bind= in .nspawn files, for containers
started on boot. I tried looking in the kernel sources and I still have no
idea what the message actually means or what combination of things could
cause it.
My understanding is that mount is "too revealing" if
- it is in a non-default namespace and
- it does not have "noexec,nodev" options or it allows wider access to
the already mounted filesystem
To illustrate the latter - if you mount btrfs subvolume, then mounting
btrfs root/sibling subvolume would give you wider access. I presume it
can also be achieved with bind mounts.
On Wed, Jun 17, 2026 at 12:13 PM Sietse van Zanen <[email protected]> wrote:
Whenever I start an nspawn container with –bind in the command line it
leads to the kernel being spammed with the following message:
VFS: Mount too revealing
This does not happen when the exact same bind is configured in
/etc/systemd/nspawn/container.nspawn Bind=.
What is the explanation for this, the documentation states they are
equivalent?
-Sietse
