code: func appAddStage1(appName *types.ACName, uuid *types.UUID, target string) error {
  	mnt := fs.NewLoggingMounter(
  		fs.MounterFunc(syscall.Mount),
  		fs.UnmounterFunc(syscall.Unmount),
  		log.Printf,
  	)
  	appRoot := filepath.Join("/opt/stage2", appName.String(), "rootfs")
  	target = filepath.Join(appRoot, target)
  	incoming := "/run/systemd/nspawn/incoming/rkt.mount"
  
  	if err := stage1init.EnsureTargetExists(incoming, target); err != nil {
  		return errwrap.Wrapf("ensuring "+target+" failed", err)
  	}
  
  	if err := mnt.Mount(incoming, target, "", syscall.MS_MOVE, ""); err != nil {
  		return errwrap.Wrapf("mount move "+incoming+" to "+target+" failed", err)
  	}
  
  	return nil
  }
docs: // appAddStage1 bind mounts the incoming mount /run/systemd/nspawn/incoming/rkt.mount
  // to the final target inside the stage2 rootfs.
  //
  // It is assumed that it is executed in the mount namespace of stage1.
  // We chroot into the stage2 rootfs and the incoming mount is bind mounted to the actual target.