tmpfs permissions confusion

The thought below is spanning across both docker and runc. In case I should be addressing the issue somewhere else, please let me know.

I find a bit confusing how tmpfs mounts are implemented. Simply doing

docker run --mount type=tmpfs,destination=some-path-here,tmpfs-mode=1770 <...>

will produce variable outcome when the mount point already exists and when it doesn't. That is, the tmpfs-mode argument is effectively ignored when the mountpoint exists, since the mode is copied back from the destination directory (libcontainer/rootfs_linux.go:190).

Well, being familiar with this behaviour now, I think this might be useful (still I found nothing about this in docs: https://docs.docker.com/engine/admin/volumes/tmpfs/).

But why then uid/gid are not restored as well? Mounting a tmpfs over the existing directory will preserve mode bits, but replace uid and gid with root. So runc is stopping somewhere in between -- it does neither fully restore permissions from the existing mount point nor rely on tmpfs mount options (uid, gid, mode, etc). Can this be resolved into a fully consistent behaviour?

Start at libcontainer/rootfs_linux.go:190 and compare the tmpfs behavior when the destination directory exists versus when it does not. Read the linked Docker tmpfs documentation and trace how mode, uid, and gid are handled. Done requires an agreed, consistent behavior for these permissions, with the documentation updated if needed.