A user-supplied mount with destination which is a parent of a mount in OCI spec will make the mount from spec invisible. For example, docker run -v /tmp:/sys/fs will result in spec-provided /sys/fs/cgroup mount being invisible from inside the container.

The above is definitely a configuration error, but it is currently ignored (except for /dev, which is handled as a special case, in which all the spec-supplied mounts under /dev are removed).

There are a few ways to handle it (other than to ignore):

1. Provide a warning that user-supplied mount shadows a mount from spec.
2. Upgrade the above warning to the error, i.e. bail out.
3. Sort the mounts so that the order is correct, so there's no problem of overshadowing.

For the reference, here's the (possibly incomplete) list of spec-provided mounts:

/proc
/dev
/dev/pts
/sys
/sys/fs/cgroup
/dev/mqueue		// optional
/dev/shm		// optional
/dev/init		// optional