SetupIntermediateMountNamespace creates a new mount namespace and bind mounts all bind-mount sources into a subdirectory of bundlePath that can only be reached by the root user of the container's user namespace, except for Mounts which include the NoBindOption option in their options list.

UnmountMountpoints unmounts the given mountpoints and anything that's hanging off of them, rather aggressively.

NoBindOption is an option which, if present in a Mount structure's options list, will cause SetupIntermediateMountNamespace to not redirect it through a bind mount.