code: func generateMountBindings(mounts []*runtimeapi.Mount) []string {
  	result := make([]string, 0, len(mounts))
  	for _, m := range mounts {
  		bind := fmt.Sprintf("%s:%s", m.HostPath, m.ContainerPath)
  		var attrs []string
  		if m.Readonly {
  			attrs = append(attrs, "ro")
  		}
  		// Only request relabeling if the pod provides an SELinux context. If the pod
  		// does not provide an SELinux context relabeling will label the volume with
  		// the container's randomly allocated MCS label. This would restrict access
  		// to the volume to the container which mounts it first.
  		if m.SelinuxRelabel {
  			attrs = append(attrs, "Z")
  		}
  		switch m.Propagation {
  		case runtimeapi.MountPropagation_PROPAGATION_PRIVATE:
  			// noop, private is default
  		case runtimeapi.MountPropagation_PROPAGATION_BIDIRECTIONAL:
  			attrs = append(attrs, "rshared")
  		case runtimeapi.MountPropagation_PROPAGATION_HOST_TO_CONTAINER:
  			attrs = append(attrs, "rslave")
  		default:
  			klog.Warningf("unknown propagation mode for hostPath %q", m.HostPath)
  			// Falls back to "private"
  		}
  
  		if len(attrs) > 0 {
  			bind = fmt.Sprintf("%s:%s", bind, strings.Join(attrs, ","))
  		}
  		result = append(result, bind)
  	}
  	return result
  }
docs: // generateMountBindings converts the mount list to a list of strings that
  // can be understood by docker.
  // '<HostPath>:<ContainerPath>[:options]', where 'options'
  // is a comma-separated list of the following strings:
  // 'ro', if the path is read only
  // 'Z', if the volume requires SELinux relabeling
  // propagation mode such as 'rslave'