From 8aee177900da1a2a59f7cc6ca79d688677394008 Mon Sep 17 00:00:00 2001
From: Ayush Ranjan <ayushranjan@google.com>
Date: Wed, 6 Sep 2023 13:59:53 -0700
Subject: [PATCH] Add more justification about why shared mount propagation is
 not allowed.

Updates #9324

PiperOrigin-RevId: 563208592
---
 runsc/specutils/fs.go | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/runsc/specutils/fs.go b/runsc/specutils/fs.go
index 68b7e101c..425e48aa1 100644
--- a/runsc/specutils/fs.go
+++ b/runsc/specutils/fs.go
@@ -79,7 +79,9 @@ var propOptionsMap = map[string]mapping{
 
 // invalidOptions list options not allowed.
 //   - shared: sandbox must be isolated from the host. Propagating mount changes
-//     from the sandbox to the host breaks the isolation.
+//     from the sandbox to the host breaks the isolation. The sandbox's mount
+//     table is maintained in sentry memory. Mount operations from the application
+//     are not propagated to the host.
 var invalidOptions = []string{"shared", "rshared"}
 
 // OptionsToFlags converts mount options to syscall flags.