First, let’s create a new mount namespace and enter it with a new shell:

sudo unshare -m

Behind its scenes, unshare(1) automatically remounts “/” with MS_REC|MS_PRIVATE, thus ensuring that the mount points copied over from the host mount namespace are set to private, so we won’t do bad things to the host’s mounts.

Now, in the shell attached to the new mount namespace:

mount -t sysfs none /sys

…but this fails with:

mount: /sys: none already mounted or mount point busy.

When I do the following instead, this will succeed:

sudo unshare -mn
mount -t sysfs none /sys

sudo unshare -n
unshare -m
mount -t sysfs none /sys

Why is the first form failing, while the second and third form succeed?