container: document remaining per-container options and network types (#2244)

* container: document remaining per-container options and network types

The container page covered 44 of the 53 nodes in container.xml.in. Add
the eight that were missing, grouped where they belong on the page:

- allow-host-cgroups, next to allow-host-pid
- network <net> mac, next to the network address option
- volume <vol> propagation, with all six modes
- stop-timeout, next to restart
- shared-memory, next to memory
- network <net> type bridge / type macvlan mode / type macvlan parent

The network type is the notable gap: MACVLAN was entirely undocumented,
although it is the way to put containers directly on a parent network
instead of behind the host bridge and NAT. The page now states that
parent and mode are both required, that the parent must exist, and that
MACVLAN networks cannot be assigned to a VRF - all three are enforced
by verify() in src/conf_mode/container.py.

Defaults and ranges are taken from container.xml.in; the "--cgroupns
host" note matches what the quadlet generator emits.

* container: describe volume propagation in terms of mount events

The six propagation modes were described in terms of sub-mount
visibility, taken from the <description> text in container.xml.in. That
is not what the modes do - mount(2)/umount(2) event propagation is.
Per mount_namespaces(7):

- MS_SHARED propagates events *both ways* between members of the peer
  group, not only from the original mount to the replica
- MS_PRIVATE propagates no events out of or into the mount; it does not
  hide sub-mounts within it

Also note the constraint the host side imposes, which is easy to trip
over: per docker-run(1)/podman, shared propagation requires the source
mount to be shared and slave requires it to be shared or slave, or the
requested mode silently does not take effect. Added the findmnt
invocation to check it.

Raised by CodeRabbit on #2244.

* container: document stop-timeout range and MACVLAN private mode precisely

0 files changed, 0 insertions, 0 deletions