linux: move pivot_root before container mounts

Use the new mount API (fsopen/fsconfig/fsmount) to create detached
mounts for each non-bind filesystem type before pivot_root.  After
the pivot, place them via move_mount so the kernel mnt_already_visible
check is satisfied.  set_mounts then mounts fresh instances on top
with the correct OCI flags.

This fixes mounting proc/sysfs/cgroup in containers that use a user
namespace, where the kernel denies these mounts unless a mount of
the same type is already visible.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>

Author: giuseppe

src/libcrun/container.c

@@ -1339,11 +1339,6 @@ container_init_setup (void *args, pid_t own_pid, char *notify_socket,
   if (UNLIKELY (ret < 0))
     return ret;
 
-  /* sync 2 and 3 are sent as part of libcrun_set_mounts.  */
-  ret = libcrun_set_mounts (entrypoint_args, container, rootfs, send_sync_cb, &sync_socket, err);
-  if (UNLIKELY (ret < 0))
-    return ret;
-
   if (def->hooks && def->hooks->create_container_len)
     {
       libcrun_error_t tmp_err = NULL;
@@ -1357,6 +1352,15 @@ container_init_setup (void *args, pid_t own_pid, char *notify_socket,
         return ret;
     }
 
+  ret = libcrun_do_pivot_root (container, entrypoint_args->context->no_pivot, &rootfs, err);
+  if (UNLIKELY (ret < 0))
+    return ret;
+
+  /* sync 2 and 3 are sent as part of libcrun_set_mounts.  */
+  ret = libcrun_set_mounts (entrypoint_args, container, rootfs, send_sync_cb, &sync_socket, err);
+  if (UNLIKELY (ret < 0))
+    return ret;
+
   ret = libcrun_finalize_mounts (entrypoint_args, container, rootfs, err);
   if (UNLIKELY (ret < 0))
     return ret;
@@ -1376,13 +1380,6 @@ container_init_setup (void *args, pid_t own_pid, char *notify_socket,
   if (UNLIKELY (ret < 0))
     crun_error_write_warning_and_release (entrypoint_args->context->output_handler_arg, &err);
 
-  if (rootfs)
-    {
-      ret = libcrun_do_pivot_root (container, entrypoint_args->context->no_pivot, rootfs, err);
-      if (UNLIKELY (ret < 0))
-        return ret;
-    }
-
   ret = libcrun_reopen_dev_null (err);
   if (UNLIKELY (ret < 0))
     return ret;