Merge pull request #22069 from rhvgoyal/overlay-private

Make overlay home dir Private mount

daemon/graphdriver/overlay/overlay.go

@@ -19,6 +19,7 @@ import (
 	"github.com/docker/docker/pkg/chrootarchive"
 	"github.com/docker/docker/pkg/idtools"
 
+	"github.com/docker/docker/pkg/mount"
 	"github.com/opencontainers/runc/libcontainer/label"
 )
 
@@ -145,6 +146,10 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		return nil, err
 	}
 
+	if err := mount.MakePrivate(home); err != nil {
+		return nil, err
+	}
+
 	d := &Driver{
 		home:      home,
 		pathCache: make(map[string]string),
@@ -217,10 +222,11 @@ func (d *Driver) GetMetadata(id string) (map[string]string, error) {
 	return metadata, nil
 }
 
-// Cleanup simply returns nil and do not change the existing filesystem.
-// This is required to satisfy the graphdriver.Driver interface.
+// Cleanup any state created by overlay which should be cleaned when daemon
+// is being shutdown. For now, we just have to unmount the bind mounted
+// we had created.
 func (d *Driver) Cleanup() error {
-	return nil
+	return mount.Unmount(d.home)
 }
 
 // CreateReadWrite creates a layer that is writable for use as a container