Currently, runc maps the acl mount option strings to MS_POSIXACL, but this option doesn't seem used by util-linux: https://github.com/util-linux/util-linux/search?q=MS_POSIXACL

Surprisingly, MS_POSIXACL isn't even referred by the kernel, except in security/apparmor/mount.c:audit_mnt_flags(): https://elixir.bootlin.com/linux/v6.1.11/C/ident/MS_POSIXACL

Probably the acl string should be just passed to mount(2) via void *data.