[Docker] Can someone explain bind propagation to me, and why my /data mount needs the ":shared" propagation?

You need this for rclone mount in the docker container to be visible on the host.

The rclone mount is a sub mount, because the first mount is mounting /data into the docker container's file system. That is known as a bind mount to glue on a bit of filesystem somewhere else - hence the "bind propagation". The submount is the rclone mount mounting on to /data

Here are the docs which are pretty impenetrable!

shared Sub-mounts of the original mount are exposed to replica mounts, and sub-mounts of replica mounts are also propagated to the original mount.

It would help if they explained what a "replica mount" is (I don't know!).

There is a stack overflow answer here which is quite helpful