Revert "Revert "Make overlay home dir Private mount""

daemon/graphdriver/overlay/overlay.go

@@ -19,6 +19,7 @@ import (
 	"github.com/docker/docker/pkg/archive"
 	"github.com/docker/docker/pkg/fsutils"
 	"github.com/docker/docker/pkg/idtools"
+	"github.com/docker/docker/pkg/mount"
 	"github.com/opencontainers/runc/libcontainer/label"
 )
 
@@ -134,6 +135,10 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		return nil, err
 	}
 
+	if err := mount.MakePrivate(home); err != nil {
+		return nil, err
+	}
+
 	supportsDType, err := fsutils.SupportsDType(home)
 	if err != nil {
 		return nil, err
@@ -217,10 +222,11 @@ func (d *Driver) GetMetadata(id string) (map[string]string, error) {
 	return metadata, nil
 }
 
-// Cleanup simply returns nil and do not change the existing filesystem.
-// This is required to satisfy the graphdriver.Driver interface.
+// Cleanup any state created by overlay which should be cleaned when daemon
+// is being shutdown. For now, we just have to unmount the bind mounted
+// we had created.
 func (d *Driver) Cleanup() error {
-	return nil
+	return mount.Unmount(d.home)
 }
 
 // CreateReadWrite creates a layer that is writable for use as a container

daemon/graphdriver/overlay2/overlay.go

@@ -27,6 +27,7 @@ import (
 	"github.com/docker/docker/pkg/directory"
 	"github.com/docker/docker/pkg/fsutils"
 	"github.com/docker/docker/pkg/idtools"
+	"github.com/docker/docker/pkg/mount"
 	"github.com/docker/docker/pkg/parsers"
 	"github.com/docker/docker/pkg/parsers/kernel"
 	units "github.com/docker/go-units"
@@ -160,6 +161,10 @@ func Init(home string, options []string, uidMaps, gidMaps []idtools.IDMap) (grap
 		return nil, err
 	}
 
+	if err := mount.MakePrivate(home); err != nil {
+		return nil, err
+	}
+
 	supportsDType, err := fsutils.SupportsDType(home)
 	if err != nil {
 		return nil, err
@@ -283,10 +288,11 @@ func (d *Driver) GetMetadata(id string) (map[string]string, error) {
 	return metadata, nil
 }
 
-// Cleanup simply returns nil and do not change the existing filesystem.
-// This is required to satisfy the graphdriver.Driver interface.
+// Cleanup any state created by overlay which should be cleaned when daemon
+// is being shutdown. For now, we just have to unmount the bind mounted
+// we had created.
 func (d *Driver) Cleanup() error {
-	return nil
+	return mount.Unmount(d.home)
 }
 
 // CreateReadWrite creates a layer that is writable for use as a container