code: func cleanupStage1(appName *types.ACName, enterCmd []string) error {
  	// TODO(lucab): re-evaluate once/if we support systemd as non-pid1 (eg. host pid-ns inheriting)
  	mnts, err := mountinfo.ParseMounts(1)
  	if err != nil {
  		return err
  	}
  	appRootFs := filepath.Join("/opt/stage2", appName.String(), "rootfs")
  	mnts = mnts.Filter(mountinfo.HasPrefix(appRootFs))
  
  	// soft-errors here, stage0 may still be able to continue with the removal anyway
  	for _, m := range mnts {
  		// unlink first to avoid back-propagation
  		_ = syscall.Mount("", m.MountPoint, "", syscall.MS_PRIVATE|syscall.MS_REC, "")
  		// simple unmount, it may fail if the target is busy (eg. overlapping children)
  		if e := syscall.Unmount(m.MountPoint, 0); e != nil {
  			// if busy, just detach here and let the kernel clean it once free
  			_ = syscall.Unmount(m.MountPoint, syscall.MNT_DETACH)
  		}
  	}
  
  	return nil
  }
docs: // cleanupStage1 is meant to be executed in stage1 context. It inspects pod systemd-pid1 mountinfo to
  // find all remaining mountpoints for appName and proceed to clean them up.