In my case there was no actually mounted points inside docker container. Error raised after some ifup/down game inside privileged ct. The usual way of removing container didn’t work too uprising the similar error:
user@server:~$ docker rm -f tklc.dead
Error response from daemon: containers 896c259600c951323d5db4438d8faaa0de9de4b0cf0b998ab0896e82ec1b3769: driver "overlay2" failed to remove root filesystem: unlinkat /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/urandom: operation not permitted
Nor worked any attempt to unmount any links or mount points inside. Nor to find and stop any processes associated with dead container. Nor worked any attempts to remove files directly.
user@server:~$ sudo rm -rf /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/
rm: cannot remove '/var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/urandom': Operation not permitted
rm: cannot remove '/var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/random': Operation not permitted
And finally I listed the file preventing docker container to be removed.
user@server:~$ sudo ls -l /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev
total 0
---------- 1 root root 0 окт 31 18:17 random
---------- 1 root root 0 окт 31 18:17 urandom
Bingo! No permissions to access to file. Even for superuser! It is definitely extended attributes.
user@server:~$ sudo lsattr /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/urandom
----i----------------- /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/urandom
Here it is. Nice. After changing immutable bits we'll be able to retry removing container itself or any of its files. Finally
user@server:~$ sudo chattr -i /var/lib/docker/overlay2/3670d1e338eaf11b8fc7ada95a91995417fa3bb4ac1c36928c3c4195525988d4/diff/var/spool/postfix/dev/random
user@server:~$ docker ps -a|grep ‘Dead|Removal’|sed -e 's/\s.*$//'|xargs docker rm
896c259600c9
vou a la.