Add bind mounts for running containers

[giuseppe]

Feature request description

Add the ability to create bind mounts for running containers. It can be useful for debugging without having to recreate the container.

Suggest potential solution

I've not really tested whether there is anything blocking it in the kernel, but I guess this can be achieved using the open_tree mount API to create the bind mount, then join the target mount namespace and attach the mount using move_mount.

Have you considered any alternatives?

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[Luap99]

Duplicate of https://github.com/containers/podman/issues/22459?

Overall I still think this should be something that is done by the oci runtime not podman directly. Of course podman then still has to expose this, i.e. podman update --volume or whatever.

[giuseppe]

Overall I still think this should be something that is done by the oci runtime not podman directly. Of course podman then still has to expose this, i.e. podman update --volume or whatever.

I am fine to do it in crun, it is trivial code, but how to expose it so that Podman can use it?

crun add-mount $CTR mount.json?

[Luap99]

Maybe expose this via crun update as new option there and hopefully get runc to support that too.

Though it raises the question if we can add mounts should we be able to remove mounts?

[giuseppe]

$OCI_RUNTIME update deals only with cgroup resources, so a newer command is cleaner in my opinion.

Removing mounts is the equivalent of joining the mount namespace and run umount, but sure we can expose that as well to be uniform.

[baude]

lets keep in mind how this impacts remote clients and the precedents. I am generally in favor of this as well.

[giuseppe]

hacked something for crun, still WIP: https://github.com/containers/crun/pull/1699

[github-actions[bot]]

A friendly reminder that this issue had no activity for 30 days.

[MagicRB]

Bump, would be nice to be able to reload Nix built containers instead of a restart.

[giuseppe]

the feature for cun is merged, you could use it manually