diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md index 7f62cb67c6..1401c708ff 100644 --- a/docs/source/markdown/podman-systemd.unit.5.md +++ b/docs/source/markdown/podman-systemd.unit.5.md @@ -138,7 +138,7 @@ For example: AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER ``` -#### `ReadOnly=` (defaults to `yes`) +#### `ReadOnly=` (defaults to `no`) If enabled, makes image read-only, with /var/tmp, /tmp and /run a tmpfs (unless disabled by `VolatileTmp=no`). diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go index 45560680ec..8ba00a88dd 100644 --- a/pkg/systemd/quadlet/quadlet.go +++ b/pkg/systemd/quadlet/quadlet.go @@ -329,7 +329,7 @@ func ConvertContainer(container *parser.UnitFile, isUser bool) (*parser.UnitFile podman.addf("--cap-add=%s", strings.ToLower(caps)) } - readOnly := container.LookupBoolean(ContainerGroup, KeyReadOnly, true) + readOnly := container.LookupBoolean(ContainerGroup, KeyReadOnly, false) if readOnly { podman.add("--read-only") } diff --git a/test/e2e/quadlet/basic.container b/test/e2e/quadlet/basic.container index 21e04efdda..78372f27bc 100644 --- a/test/e2e/quadlet/basic.container +++ b/test/e2e/quadlet/basic.container @@ -10,8 +10,6 @@ ## assert-podman-args "--cgroups=split" ## assert-podman-args "--sdnotify=conmon" ## assert-podman-args "--cap-drop=all" -## assert-podman-args "--read-only" -## !assert-podman-args "--read-only-tmpfs=false" ## assert-key-is "Unit" "RequiresMountsFor" "%t/containers" ## assert-key-is "Service" "KillMode" "mixed" ## assert-key-is "Service" "Delegate" "yes" diff --git a/test/e2e/quadlet/readonly-notmpfs.container b/test/e2e/quadlet/readonly-notmpfs.container index cddc7b7142..88087cec39 100644 --- a/test/e2e/quadlet/readonly-notmpfs.container +++ b/test/e2e/quadlet/readonly-notmpfs.container @@ -3,4 +3,5 @@ [Container] Image=localhost/imagename +ReadOnly=yes VolatileTmp=no