Best practice for mounting CephFS for both Proxmox storage and LXC bind mount

[nkw]

I'm experimenting with Ceph Reef and Proxmox 8. Proxmox has made creating and configuring the new Ceph cluster really pleasant.

I intend to use CephFS both as a shared Proxmox storage (which was easy to add when creating the fs with the "add as storage" checkbox in the gui), and as a bind mount point for LXC containers (and perhaps someday pass to VMs via virtiofs).

Proxmox already makes available the filesystem by virtue of it being configured as storage at /mnt/pve/cephfs on each node. Is it a poor practice to utilize sub-directories off this mount point for shared storage passed to LXC containers via bind mount points? E.g. passing /mnt/pve/cephfs/shared_data into a LXC container while Proxmox creates and uses say /mnt/pve/cephfs/iso and/or /mtn/pve/cephfs/vztmpl.

Of course I could configure each node's fstab to mount a sub-directory of the already configured CephFS at say /mnt/bindmounts/shared_data and change the Proxmox storage to another sub-directory in the filesystem (rather than the root), but I would have to configure and manage each node individually for that, while the /mnt/pve mount point already "just works".

I do note the documentation states:

"For security reasons, bind mounts should only be established using source directories especially reserved for this purpose, e.g., a directory hierarchy under /mnt/bindmounts. Never bind mount system directories like /, /var or /etc into a container - this poses a great security risk."

However, I would be only using source directories below the /mnt/pve/cephfs mount point.

Even if doing it this way works, are there downsides I should consider here?