Make secret mount rprivate by default

[rhvgoyal]

Specify propagation property of secret mount explicitly. Otherwise it
can become a shared mount (if user passed in another volume with shared
property) and then can start propagation sub mounts to host.

docker run -ti -v /mnt/foo:/var/foo:shared fedora bash

Signed-off-by: Vivek Goyal vgoyal@redhat.com

[rhvgoyal]

cc @rhatdan @runcom

[runcom]

Awesome, LGTM, we need to port this patch to other branches (I'll take care of it)

[rhvgoyal]

Right, we need to port this to docker-1.13.1 branch as well. I just checked that code structure is little different there though.

// SecretMount returns the mount for the secret path
func (container *Container) SecretMount() *Mount {
if len(container.SecretReferences) > 0 {
return &Mount{
Source: container.SecretMountPath(),
Destination: containerSecretMountPath,
Writable: false,
}
}

    return nil

}

[runcom]

@vgoyal merging this

[rhatdan]

Lets get another build of this into RHEL7