By default, Docker hides several files and directories of the container's /proc by mounting something over it:

$ docker run ubuntu:bionic findmnt -R /proc
TARGET                SOURCE              FSTYPE OPTIONS
/proc                 proc                proc   rw,nosuid,nodev,noexec,relatime
|-/proc/bus           proc[/bus]          proc   ro,relatime
|-/proc/fs            proc[/fs]           proc   ro,relatime
|-/proc/irq           proc[/irq]          proc   ro,relatime
|-/proc/sys           proc[/sys]          proc   ro,relatime
|-/proc/sysrq-trigger proc[/sysrq-trigger]
|                                         proc   ro,relatime
|-/proc/asound        tmpfs               tmpfs  ro,relatime
|-/proc/acpi          tmpfs               tmpfs  ro,relatime
|-/proc/kcore         tmpfs[/null]        tmpfs  rw,nosuid,size=65536k,mode=755
|-/proc/keys          tmpfs[/null]        tmpfs  rw,nosuid,size=65536k,mode=755
|-/proc/timer_list    tmpfs[/null]        tmpfs  rw,nosuid,size=65536k,mode=755
|-/proc/sched_debug   tmpfs[/null]        tmpfs  rw,nosuid,size=65536k,mode=755
`-/proc/scsi          tmpfs               tmpfs  ro,relatime

How can I disable this behavior in Docker (currently using version 18.09)? I need access to a proc instance without any mounts over it, otherwise nested containers (e.g., with unshare) fail because a kernel protection kicks in. One can see this with the following command:

docker run -it --security-opt="seccomp=unconfined" --cap-drop=all ubuntu:bionic unshare --fork --user --pid --mount --mount-proc --setgroups deny --map-root-user --propagation unchanged /bin/bash

This fails with unshare: mount /proc failed: Permission denied because of the mounts that are on top of /proc, and would work if Docker would not create these mounts.

I know that --privileged provides full access to /proc:

$ docker run --privileged ubuntu:bionic findmnt -R /proc
TARGET SOURCE FSTYPE OPTIONS
/proc  proc   proc   rw,nosuid,nodev,noexec,relatime

However, --privileged gives the container much more permissions (capabilities, device access, etc.) and I do not want this. I only need full access to /proc.

It would also be ok for me to have the proc file system mounted twice in the container, if one of the mounts does not have the overlapping mounts. Unfortunately, using --volume /proc:/proc2 mounts the host's /proc in the container, and I need the container's /proc. (Because of this, this questions is not a duplicate of Docker - Access host /proc).

Summary: How to get a fully visible /proc instance of the container's proc file system in a Docker container without using --privileged?