It's failing because passwd manipulates a temporary file,
and then attempts to rename it to /etc/shadow.
This fails because /etc/shadow is a mountpoint
-- which cannot be replaced
-- which results in this error (captured using strace)
rename("/etc/nshadow", "/etc/shadow") = -1
EBUSY (Device or resource busy)
You can reproduce this trivially from the command line:
# cd /etc
# touch foo
# mv foo shadow
mv: cannot move 'foo' to 'shadow': Device or resource busy
You could work around this by mounting a directory
containing my_shadow and my_passwd somewhere else,
and then symlinking /etc/passwd and /etc/shadow in the container appropriately:
$ docker run -it --rm -v $PWD/my_etc:/my_etc centos
[root@kutayzorlu.com /]# ln -sf /my_etc/my_passwd /etc/passwd
[root@kutayzorlu.com /]# ln -sf /my_etc/my_shadow /etc/shadow
[root@kutayzorlu.com /]# ls -l /etc/{shadow,passwd}
lrwxrwxrwx. 1 root root 17 Oct 8 17:48 /etc/passwd -> /my_etc/my_passwd
lrwxrwxrwx. 1 root root 17 Oct 8 17:48 /etc/shadow -> /my_etc/my_shadow
[root@kutayzorlu.com /]# passwd root
Changing password for user root.
New password:
Retype new password:
passwd: all authentication tokens updated successfully.
[root@kutayzorlu.com /]#