Upstream removal of MountFlags from systemd unit causes aufs problems

In xenial-updates, docker.io 1.12.6-0ubuntu1~16.04.1 seems to have problems with removing containers sometimes, in particular if we've left nfs mounts inside the container (which was running with --privileged ) I'm still working on a simple test case isolated from the complexities of our infrastructure.

See the attached log excerpt.

It appears that this may be due to the upstream change:
https://github.com/moby/moby/pull/22806

There are other reports of it causing trouble with aufs (which I suspect gets little attention from the docker project as it's mostly unavailable in other distribtuions):
https://github.com/moby/moby/issues/22260

As a workaround, setting MountFlags=private seems to be working for me, but it has caused a definite regression. Hosts we have running earlier xenial with 1.10.3-0ubuntu6 do not seem to exhibit this issue.