opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-10-19 20:23:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

quadlet: Change default of ReadOnly to no

Browse Source 
This matches the default podman run behaviour.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
This commit is contained in:
Alexander Larsson
2022-12-02 16:30:15 +01:00
parent 1c3fddfaf7
commit 098ad52ecb
4 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/source/markdown/podman-systemd.unit.5.md
View File

@ -138,7 +138,7 @@ For example:
AddCapability=CAP_DAC_OVERRIDE CAP_IPC_OWNER
```
#### `ReadOnly=` (defaults to `yes`)
#### `ReadOnly=` (defaults to `no`)
If enabled, makes image read-only, with /var/tmp, /tmp and /run a tmpfs (unless disabled by `VolatileTmp=no`).

2
pkg/systemd/quadlet/quadlet.go
View File

@ -329,7 +329,7 @@ func ConvertContainer(container *parser.UnitFile, isUser bool) (*parser.UnitFile
podman.addf("--cap-add=%s", strings.ToLower(caps))
}
readOnly := container.LookupBoolean(ContainerGroup, KeyReadOnly, true)
readOnly := container.LookupBoolean(ContainerGroup, KeyReadOnly, false)
if readOnly {
podman.add("--read-only")
}

2
test/e2e/quadlet/basic.container
View File

@ -10,8 +10,6 @@
## assert-podman-args "--cgroups=split"
## assert-podman-args "--sdnotify=conmon"
## assert-podman-args "--cap-drop=all"
## assert-podman-args "--read-only"
## !assert-podman-args "--read-only-tmpfs=false"
## assert-key-is "Unit" "RequiresMountsFor" "%t/containers"
## assert-key-is "Service" "KillMode" "mixed"
## assert-key-is "Service" "Delegate" "yes"

1
test/e2e/quadlet/readonly-notmpfs.container
View File

@ -3,4 +3,5 @@
[Container]
Image=localhost/imagename
ReadOnly=yes
VolatileTmp=no