On: Unveil(2) – Unveil parts of a restricted filesystem view

[TheDong]

Note, this is the same as bindmounts in linux.

    $ mkdir a b
    $ sudo mount --bind a b
    $ rmdir a && mkdir a
    $ touch a/foo
    $ ls b # no foo
    

This can be seen in docker containers if you bindmount things around as well.

The solution for both is the same: simply bindmount a level higher. If you need to mutate "data", instead make the directory "myapp/data" and mutate the sub directory only while mounting/unveiling the parent.