alpine linux k3s rootless setup mount issues

[aakash-rajur]

Environmental Info:
K3s Version:

k3s version v1.33.6+k3s1 (b5847677)
go version go1.24.9

Node(s) CPU architecture, OS, and Version:

Linux alpine-mark-2 6.12.63-0-virt #1-Alpine SMP PREEMPT_DYNAMIC 2025-12-24 13:29:43 aarch64 Linux

Cluster Configuration:
trying to setup HA with 3 control and 3 agents

Describe the bug:
I've been tinkering with alpine linux and trying to setup rootless k3s. I've successfully configured cgroup v2 delegation. My next goal is to setup cilium whose init container keeps failing with the following error:

path "/sys/fs/bpf" is mounted on "/sys/fs/bpf" but it is not a shared mount

I can see the mount propagation shared via root and k3s user but not via rootlesskit because we need to pass additional -propagation=rshared option to it. But as you can see k3s rootless source or the docs, there's no option or mention any means to pass the aforementioned flag.

mount config for reference:

alpine-mark-2:~# findmnt -o TARGET,PROPAGATION /sys/fs/bpf;
TARGET      PROPAGATION
/sys/fs/bpf shared
alpine-mark-2:~# cat /etc/fstab | grep bpf
bpffs /sys/fs/bpf  bpf  rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0
alpine-mark-2:~# grep bpf /proc/self/mountinfo
41 24 0:33 / /sys/fs/bpf rw,nosuid,nodev,noexec,relatime shared:17 - bpf bpffs rw,uid=1000,gid=1000
alpine-mark-2:~$ whoami
k3s
alpine-mark-2:~$ rootlesskit -propagation rshared sh -c "findmnt -o TARGET,PROPAGATION /sys/fs/bpf"
TARGET      PROPAGATION
/sys/fs/bpf shared,slave

Steps To Reproduce:
I've an openrc service file that takes care of creating cgroup creation, delegation and cleanup

# configure cgroups
sed -i '/\sswap\s/s/^/#/' /etc/fstab
swapoff -a
echo "cgroup2 /sys/fs/cgroup cgroup2 rw,nosuid,nodev,noexec,relatime,nsdelegate 0 0" >> /etc/fstab
printf '#configure cgroups for k3s\nrc_cgroup_mode="unified"\nrc_cgroup_controllers="cpuset cpu io memory hugetlb pids"\nrc_controller_cgroups="YES"\n' >> /etc/rc.conf
printf 'vm.overcommit_memory=1\nkernel.panic=10\nkernel.panic_on_oops=1\nnet.ipv4.ip_forward=1\n' >> /etc/sysctl.conf
printf 'k3s:10000:65536\n' >> /etc/subuid
printf 'k3s:10000:65536\n' >> /etc/subgid

# upgrade and install dependencies
apk update && apk upgrade
apk add --no-cache \
  git bash curl \
  util-linux iptables ip6tables cni-plugins \
  rootlesskit slirp4netns cgroup-tools \
  iproute2 bridge nftables

chmod o+w /sys/fs/cgroup/cgroup.procs

## install k3s
export INSTALL_K3S_VERSION=v1.33.6+k3s1;
export INSTALL_K3S_SKIP_ENABLE=true;
export INSTALL_K3S_SKIP_START=true;
curl -sfL https://get.k3s.io/ | sh -

# create non-root user k3s
addgroup -g 1000 k3s
adduser -G k3s -h /home/k3s -s /bin/bash -u 1000 --disabled-password k3s

su - k3s -c "mkdir -p ~/.k3s/{data,logs}"
su - k3s -c "openssl rand -base64 24 > ~/.k3s/cluster-token"
su - k3s -c "openssl rand -base64 24 > ~/.k3s/agent-token"

CILIUM_CLI_VERSION=v0.18.9
CLI_ARCH=amd64
if [ "$(uname -m)" = "aarch64" ]; then CLI_ARCH=arm64; fi
curl -L --fail --remote-name-all https://github.com/cilium/cilium-cli/releases/download/${CILIUM_CLI_VERSION}/cilium-linux-${CLI_ARCH}.tar.gz{,.sha256sum}
sha256sum -c cilium-linux-${CLI_ARCH}.tar.gz.sha256sum
tar x -vz -C /usr/local/bin -f cilium-linux-${CLI_ARCH}.tar.gz
rm cilium-linux-${CLI_ARCH}.tar.gz cilium-linux-${CLI_ARCH}.tar.gz.sha256sum

Expected behavior:
Have a mechanism to pass propagation flag from k3s to rootlesskit

Actual behavior:
No mechanism to pass propagation flag from k3s to rootlesskit

Additional context / logs:

failed to generate container "e795089d0cc2bed30cb2eaec720d5827a8f666c4288349d4c78f1b0639f4024c" spec: failed to generate spec: path "/sys/fs/bpf" is mounted on "/sys/fs/bpf" but it is not a shared mount

I believe having a mechanism to pass this forward to rootlesskit should fix this, @AkihiroSuda any insights?
Open to raising a PR to forward all flags from env and cli

Any help is appreciated, Thanks!