diff --git a/docs/source/markdown/podman-systemd.unit.5.md b/docs/source/markdown/podman-systemd.unit.5.md
index 483c47a93b..1e7364a023 100644
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@@ -185,6 +185,7 @@ Valid options for `[Container]` are listed below:
| PublishPort=50-59 | --publish 50-59 |
| Pull=never | --pull=never |
| ReadOnly=true | --read-only |
+| ReadOnlyTmpfs=true | --read-only-tmpfs |
| RunInit=true | --init |
| SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json |
| SecurityLabelDisable=true | --security-opt label=disable |
@@ -199,7 +200,6 @@ Valid options for `[Container]` are listed below:
| Ulimit=nofile:1000:10000 | --ulimit nofile:1000:10000 |
| User=bin | --user bin |
| UserNS=keep-id:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 |
-| VolatileTmp=true | --tmpfs /tmp |
| Volume=/source:/dest | --volume /source:/dest |
| WorkingDir=$HOME | --workdir $HOME |
@@ -521,6 +521,10 @@ This is equivalent to the Podman `--pull` option
If enabled, makes the image read-only.
+### `ReadOnlyTmpfs=` (defaults to `yes`)
+
+If ReadOnly is set to `yes`, mount a read-write tmpfs on /dev, /dev/shm, /run, /tmp, and /var/tmp.
+
### `RunInit=` (default to `no`)
If enabled, the container has a minimal init process inside the
@@ -598,12 +602,6 @@ which can be modified with `UserNS`, but if that is not specified, this UID is a
Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and
generally has the form `MODE[:OPTIONS,...]`.
-### `VolatileTmp=` (defaults to `no`)
-
-If enabled, the container has a fresh tmpfs mounted on `/tmp`.
-
-**NOTE:** Podman automatically copies any content from the image onto the tmpfs
-
### `Volume=`
Mount a volume in the container. This is equivalent to the Podman `--volume` option, and
diff --git a/pkg/systemd/quadlet/quadlet.go b/pkg/systemd/quadlet/quadlet.go
index befae8b7a8..c2841abf5c 100644
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@@ -116,6 +116,7 @@ const (
KeyPublishPort = "PublishPort"
KeyPull = "Pull"
KeyReadOnly = "ReadOnly"
+ KeyReadOnlyTmpfs = "ReadOnlyTmpfs"
KeyRemapGID = "RemapGid"
KeyRemapUID = "RemapUid"
KeyRemapUIDSize = "RemapUidSize"
@@ -197,6 +198,7 @@ var (
KeyPublishPort: true,
KeyPull: true,
KeyReadOnly: true,
+ KeyReadOnlyTmpfs: true,
KeyRemapGID: true,
KeyRemapUID: true,
KeyRemapUIDSize: true,
@@ -606,15 +608,13 @@ func ConvertContainer(container *parser.UnitFile, names map[string]string, isUse
podman.addBool("--read-only", readOnly)
}
+ if readOnlyTmpfs, ok := container.LookupBoolean(ContainerGroup, KeyReadOnlyTmpfs); ok {
+ podman.addBool("--read-only-tmpfs", readOnlyTmpfs)
+ }
+
volatileTmp := container.LookupBooleanWithDefault(ContainerGroup, KeyVolatileTmp, false)
- if volatileTmp {
- /* Read only mode already has a tmpfs by default */
- if !readOnly {
- podman.add("--tmpfs", "/tmp:rw,size=512M,mode=1777")
- }
- } else if readOnly {
- /* !volatileTmp, disable the default tmpfs from --read-only */
- podman.add("--read-only-tmpfs=false")
+ if volatileTmp && !readOnly {
+ podman.add("--tmpfs", "/tmp:rw,size=512M,mode=1777")
}
if err := handleUser(container, ContainerGroup, podman); err != nil {
diff --git a/test/e2e/quadlet/readonly-notmpfs.container b/test/e2e/quadlet/readonly-notmpfs.container
index 88087cec39..af65950e4f 100644
--- a/test/e2e/quadlet/readonly-notmpfs.container
+++ b/test/e2e/quadlet/readonly-notmpfs.container
@@ -4,4 +4,4 @@
[Container]
Image=localhost/imagename
ReadOnly=yes
-VolatileTmp=no
+ReadOnlyTmpfs=no
diff --git a/test/e2e/quadlet/readonly-tmpfs.container b/test/e2e/quadlet/readonly-tmpfs.container
new file mode 100644
index 0000000000..317b0ff591
--- /dev/null
+++ b/test/e2e/quadlet/readonly-tmpfs.container
@@ -0,0 +1,7 @@
+## assert-podman-args "--read-only-tmpfs"
+## assert-podman-args "--read-only"
+
+[Container]
+Image=localhost/imagename
+ReadOnly=yes
+ReadOnlyTmpfs=yes
diff --git a/test/e2e/quadlet/readonly.container b/test/e2e/quadlet/readonly.container
new file mode 100644
index 0000000000..7eb6fe0516
--- /dev/null
+++ b/test/e2e/quadlet/readonly.container
@@ -0,0 +1,6 @@
+## !assert-podman-args "--read-only-tmpfs"
+## assert-podman-args "--read-only"
+
+[Container]
+Image=localhost/imagename
+ReadOnly=yes
diff --git a/test/e2e/quadlet/volatiletmp-readonly.container b/test/e2e/quadlet/volatiletmp-readonly.container
new file mode 100644
index 0000000000..ef490af598
--- /dev/null
+++ b/test/e2e/quadlet/volatiletmp-readonly.container
@@ -0,0 +1,6 @@
+## !assert-podman-args "--tmpfs" "/tmp:rw,size=512M,mode=1777"
+
+[Container]
+Image=localhost/imagename
+VolatileTmp=yes
+ReadOnly=yes
diff --git a/test/e2e/quadlet/readwrite.container b/test/e2e/quadlet/volatiletmp-readwrite.container
similarity index 56%
rename from test/e2e/quadlet/readwrite.container
rename to test/e2e/quadlet/volatiletmp-readwrite.container
index ef491eec6c..e375d5d050 100644
--- a/test/e2e/quadlet/readwrite.container
+++ b/test/e2e/quadlet/volatiletmp-readwrite.container
@@ -1,8 +1,5 @@
-## !assert-podman-args "--read-only"
-## assert-podman-args "--read-only=false"
## assert-podman-args "--tmpfs" "/tmp:rw,size=512M,mode=1777"
[Container]
Image=localhost/imagename
VolatileTmp=yes
-ReadOnly=no
diff --git a/test/e2e/quadlet_test.go b/test/e2e/quadlet_test.go
index 3279ddd5d6..f2a00b971f 100644
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@@ -709,9 +709,12 @@ BOGUS=foo
Entry("ports.container", "ports.container", 0, ""),
Entry("ports_ipv6.container", "ports_ipv6.container", 0, ""),
Entry("pull.container", "pull.container", 0, ""),
+ Entry("readonly.container", "readonly.container", 0, ""),
+ Entry("readonly-tmpfs.container", "readonly-tmpfs.container", 0, ""),
Entry("readonly-notmpfs.container", "readonly-notmpfs.container", 0, ""),
Entry("readwrite-notmpfs.container", "readwrite-notmpfs.container", 0, ""),
- Entry("readwrite.container", "readwrite.container", 0, ""),
+ Entry("volatiletmp-readwrite.container", "volatiletmp-readwrite.container", 0, ""),
+ Entry("volatiletmp-readonly.container", "volatiletmp-readonly.container", 0, ""),
Entry("remap-auto.container", "remap-auto.container", 0, ""),
Entry("remap-auto2.container", "remap-auto2.container", 0, ""),
Entry("remap-keep-id.container", "remap-keep-id.container", 0, ""),