Linux nosymfollow mount flag blocks symlink following on one mount, not all path risks

Linux 5.10 introduced the MS_NOSYMFOLLOW mount flag, which stops path resolution from following symbolic links on a specific mounted filesystem. It suits content roots and upload directories where a symlink should never serve as an escape route to other host paths. The protection is limited to that mount, so paths crossing into other mounts or links created before the mount may behave differently than operators expect. Administrators are therefore advised to treat it as one layer alongside application-level path validation, sandboxing, and least-privilege service accounts. Testing on the actual production storage path, along with logging denials and enforcing the option through configuration management, is recommended.