opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-26 11:33:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add containers.conf read-only flag support

Browse Source 
If you are running temporary containers within podman play kube
we should really be running these in read-only mode. For automotive
they plan on running all of their containers in read-only temporal
mode. Adding this option guarantees that the container image is not
being modified during the running of the container.

The containers can only write to tmpfs mounted directories.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2022-12-10 06:35:58 -05:00
parent 2a46b5e117
commit 338b283935
14 changed files with 117 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
pkg/specgenutil/specgen.go
View File

@ -592,10 +592,11 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
s.DependencyContainers = c.Requires
}
// TODO
// outside of specgen and oci though
// defaults to true, check spec/storage
// s.readonly = c.ReadOnlyTmpFS
// Only add ReadWrite tmpfs mounts iff the container is
// being run ReadOnly and ReadWriteTmpFS is not disabled,
// (user specifying --read-only-tmpfs=false.)
s.ReadWriteTmpfs = c.ReadOnly && c.ReadWriteTmpFS
// TODO convert to map?
// check if key=value and convert
sysmap := make(map[string]string)
@ -853,10 +854,6 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
s.PasswdEntry = c.PasswdEntry
}
if c.ReadOnly && c.ReadOnlyTmpFS {
s.Mounts = addReadOnlyMounts(s.Mounts)
}
return nil
}