- masked paths - readonly paths - allow attaching to existing namespaces, eg if bind mounted by a system container Signed-off-by: Justin Cormack <justin.cormack@docker.com>