Setting MountFlags=private in docker.service means that any storage mounted on the host after starting Docker will be unavailable for docker containers.  For example, I wanted to expose a directory from a remote server to a Docker container:

  mkdir /data/content
  mount remote-server:/vol/content /data/content
  docker run -v /data/content:/content larsks/thttpd -d /content

This fails because Docker does not see the mount onto /data/content. It only sees the content of the underlying directory, not the mounted filesystem.

I think we want MountFlags=slave instead, which would prevent mounts inside the Docker mount namespace from propagating to the global namespace while still allowing global mounts to be available to docker containers.