Quadlet - add support for global arguments

Add support for adding podman level arguments before subcommand Add specific key for Containers Conf Modules Global arguments are added for both start and stop commands Adjust testing environment Add tests Add to man page Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
2025-06-20 00:51:16 +08:00 · 2023-10-04 16:42:54 +03:00
parent c14e8f6cc0
commit d321d427dc
14 changed files with 472 additions and 150 deletions
--- a/docs/source/markdown/podman-systemd.unit.5.md
+++ b/docs/source/markdown/podman-systemd.unit.5.md
@ -122,12 +122,13 @@ There is only one required key, `Image`, which defines the container image the s
 Valid options for `[Container]` are listed below:

 | **[Container] options**              | **podman run equivalent**                            |
-|--------------------------------|------------------------------------------------------|
+|--------------------------------------|------------------------------------------------------|
 | AddCapability=CAP                    | --cap-add CAP                                        |
 | AddDevice=/dev/foo                   | --device /dev/foo                                    |
 | Annotation="XYZ"                     | --annotation "XYZ"                                   |
 | AutoUpdate=registry                  | --label "io.containers.autoupdate=registry"          |
 | ContainerName=name                   | --name name                                          |
+| ContainersConfModule=/etc/nvd\.conf  | --module=/etc/nvd\.conf                              |
 | DNS=192.168.55.1                     | --dns=192.168.55.1                                   |
 | DNSSearch=foo.com                    | --dns-search=foo.com                                 |
 | DNSOption=ndots:1                    | --dns-option=ndots:1                                 |
@ -138,6 +139,7 @@ Valid options for `[Container]` are listed below:
 | Exec=/usr/bin/command                | Command after image specification - /usr/bin/command |
 | ExposeHostPort=50-59                 | --expose 50-59                                       |
 | Group=1234                           | --user UID:1234                                      |
+| GlobalArgs=--log-level=debug         | --log-level=debug                                    |
 | HealthCmd="/usr/bin/command"         | --health-cmd="/usr/bin/command"                      |
 | HealthInterval=2m                    | --health-interval=2m                                 |
 | HealthOnFailure=kill                 | --health-on-failure=kill                             |
@ -228,6 +230,12 @@ The (optional) name of the Podman container. If this is not specified, the defau
 of `systemd-%N` is used, which is the same as the service name but with a `systemd-`
 prefix to avoid conflicts with user-managed containers.

+### `ContainersConfModule=`
+
+Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option.
+
+This key can be listed multiple times.
+
 ### `DNS=`

 Set network-scoped DNS resolver/nameserver for containers in this network.
@ -286,6 +294,19 @@ to the Podman `--expose` option.

 This key can be listed multiple times.

+### `GlobalArgs=`
+
+This key contains a list of arguments passed directly between `podman` and `run`
+in the generated file (right before the image name in the command line). It can be used to
+access Podman features otherwise unsupported by the generator. Since the generator is unaware
+of what unexpected interactions can be caused by these arguments, it is not recommended to use
+this option.
+
+The format of this is a space separated list of arguments, which can optionally be individually
+escaped to allow inclusion of whitespace and other control characters.
+
+This key can be listed multiple times.
+
 ### `Group=`

 The (numeric) GID to run as inside the container. This does not need to match the GID on the host,
@ -598,9 +619,11 @@ There is only one required key, `Yaml`, which defines the path to the Kubernetes
 Valid options for `[Kube]` are listed below:

 | **[Kube] options**                  | **podman kube play equivalent**                                  |
-| ----------------------------------- | -----------------------------------------------------------------|
+| ------------------------------------| -----------------------------------------------------------------|
 | AutoUpdate=registry                 | --annotation "io.containers.autoupdate=registry"                 |
 | ConfigMap=/tmp/config.map           | --config-map /tmp/config.map                                     |
+| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf                                          |
+| GlobalArgs=--log-level=debug        | --log-level=debug                                                |
 | LogDriver=journald                  | --log-driver journald                                            |
 | Network=host                        | --net host                                                       |
 | PodmanArgs=\-\-annotation=key=value | --annotation=key=value                                           |
@ -629,6 +652,12 @@ it may be absolute or relative to the location of the unit file.

 This key may be used multiple times

+### `ContainersConfModule=`
+
+Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option.
+
+This key can be listed multiple times.
+
 ### `ExitCodePropagation=`

 Control how the main PID of the systemd service should exit. The following values are supported:
@ -638,6 +667,20 @@ Control how the main PID of the systemd service should exit. The following value

 The current default value is `none`.

+### `GlobalArgs=`
+
+This key contains a list of arguments passed directly between `podman` and `kube`
+in the generated file (right before the image name in the command line). It can be used to
+access Podman features otherwise unsupported by the generator. Since the generator is unaware
+of what unexpected interactions can be caused by these arguments, it is not recommended to use
+this option.
+
+The format of this is a space separated list of arguments, which can optionally be individually
+escaped to allow inclusion of whitespace and other control characters.
+
+This key can be listed multiple times.
+
+
 ### `LogDriver=`

 Set the log-driver Podman uses when running the container.
@ -740,11 +783,13 @@ particularly interesting when using special options to control network creation,
 Valid options for `[Network]` are listed below:

 | **[Network] options**               | **podman network create equivalent** |
-|-------------------------------|--------------------------------------|
+|-------------------------------------|--------------------------------------|
+| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf              |
 | DisableDNS=true                     | --disable-dns                        |
 | DNS=192.168.55.1                    | --dns=192.168.55.1                   |
 | Driver=bridge                       | --driver bridge                      |
 | Gateway=192.168.55.3                | --gateway 192.168.55.3               |
+| GlobalArgs=--log-level=debug        | --log-level=debug                    |
 | Internal=true                       | --internal                           |
 | IPAMDriver=dhcp                     | --ipam-driver dhcp                   |
 | IPRange=192.168.55.128/25           | --ip-range 192.168.55.128/25         |
@ -757,6 +802,12 @@ Valid options for `[Network]` are listed below:

 Supported keys in `[Network]` section are:

+### `ContainersConfModule=`
+
+Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option.
+
+This key can be listed multiple times.
+
 ### `DisableDNS=` (defaults to `no`)

 If enabled, disables the DNS plugin for this network.
@ -783,6 +834,19 @@ This is equivalent to the Podman `--gateway` option

 This key can be listed multiple times.

+### `GlobalArgs=`
+
+This key contains a list of arguments passed directly between `podman` and `network`
+in the generated file (right before the image name in the command line). It can be used to
+access Podman features otherwise unsupported by the generator. Since the generator is unaware
+of what unexpected interactions can be caused by these arguments, it is not recommended to use
+this option.
+
+The format of this is a space separated list of arguments, which can optionally be individually
+escaped to allow inclusion of whitespace and other control characters.
+
+This key can be listed multiple times.
+
 ### `Internal=` (defaults to `no`)

 Restrict external access of this network.
@ -870,9 +934,11 @@ Valid options for `[Volume]` are listed below:

 | **[Volume] options**                | **podman volume create equivalent**       |
 |-------------------------------------|-------------------------------------------|
+| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf                   |
+| Copy=true                           | --opt copy                                |
 | Device=tmpfs                        | --opt device=tmpfs                        |
 | Driver=image                        | --driver=image                            |
-| Copy=true                           | --opt copy                                |
+| GlobalArgs=--log-level=debug        | --log-level=debug                         |
 | Group=192                           | --opt group=192                           |
 | Image=quay.io/centos/centos\:latest | --opt image=quay.io/centos/centos\:latest |
 | Label="foo=bar"                     | --label "foo=bar"                         |
@ -882,6 +948,12 @@ Valid options for `[Volume]` are listed below:

 Supported keys in `[Volume]` section are:

+### `ContainersConfModule=`
+
+Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option.
+
+This key can be listed multiple times.
+
 ### `Copy=` (default to `yes`)

 If enabled, the content of the image located at the mountpoint of the volume is copied into the
@ -897,6 +969,19 @@ Specify the volume driver name. When set to `image`, the `Image` key must also b

 This is equivalent to the Podman `--driver` option.

+### `GlobalArgs=`
+
+This key contains a list of arguments passed directly between `podman` and `volume`
+in the generated file (right before the image name in the command line). It can be used to
+access Podman features otherwise unsupported by the generator. Since the generator is unaware
+of what unexpected interactions can be caused by these arguments, it is not recommended to use
+this option.
+
+The format of this is a space separated list of arguments, which can optionally be individually
+escaped to allow inclusion of whitespace and other control characters.
+
+This key can be listed multiple times.
+
 ### `Group=`

 The host (numeric) GID, or group name to use as the group for the volume
@ -970,8 +1055,10 @@ Valid options for `[Image]` are listed below:
 | Arch=aarch64                        | --arch=aarch64                                  |
 | AuthFile=/etc/registry/auth\.json   | --authfile=/etc/registry/auth\.json             |
 | CertDir=/etc/registery/certs        | --cert-dir=/etc/registery/certs                 |
+| ContainersConfModule=/etc/nvd\.conf | --module=/etc/nvd\.conf                         |
 | Creds=myname\:mypassword            | --creds=myname\:mypassword                      |
 | DecryptionKey=/etc/registery\.key   | --decryption-key=/etc/registery\.key            |
+| GlobalArgs=--log-level=debug        | --log-level=debug                               |
 | Image=quay.io/centos/centos\:latest | podman image pull quay.io/centos/centos\:latest |
 | OS=windows                          | --os=windows                                    |
 | PodmanArgs=--os=linux               | --os=linux                                      |
@ -1002,6 +1089,12 @@ Use certificates at path (*.crt, *.cert, *.key) to connect to the registry.

 This is equivalent to the Podman `--cert-dir` option.

+### `ContainersConfModule=`
+
+Load the specified containers.conf(5) module. Equivalent to the Podman `--module` option.
+
+This key can be listed multiple times.
+
 ### `Creds=`

 The `[username[:password]]` to use to authenticate with the registry, if required.
@ -1014,6 +1107,19 @@ The `[key[:passphrase]]` to be used for decryption of images.

 This is equivalent to the Podman `--decryption-key` option.

+### `GlobalArgs=`
+
+This key contains a list of arguments passed directly between `podman` and `image`
+in the generated file (right before the image name in the command line). It can be used to
+access Podman features otherwise unsupported by the generator. Since the generator is unaware
+of what unexpected interactions can be caused by these arguments, it is not recommended to use
+this option.
+
+The format of this is a space separated list of arguments, which can optionally be individually
+escaped to allow inclusion of whitespace and other control characters.
+
+This key can be listed multiple times.
+
 ### `Image=`

 The image to pull.
--- a/pkg/systemd/quadlet/quadlet.go
+++ b/pkg/systemd/quadlet/quadlet.go
@ -59,6 +59,7 @@ const (
 	KeyDecryptionKey         = "DecryptionKey"
 	KeyConfigMap             = "ConfigMap"
 	KeyContainerName         = "ContainerName"
+	KeyContainersConfModule  = "ContainersConfModule"
 	KeyCopy                  = "Copy"
 	KeyDevice                = "Device"
 	KeyDNS                   = "DNS"
@ -72,6 +73,7 @@ const (
 	KeyExec                  = "Exec"
 	KeyExitCodePropagation   = "ExitCodePropagation"
 	KeyExposeHostPort        = "ExposeHostPort"
+	KeyGlobalArgs            = "GlobalArgs"
 	KeyGroup                 = "Group"
 	KeyHealthCmd             = "HealthCmd"
 	KeyHealthInterval        = "HealthInterval"
@ -154,6 +156,7 @@ var (
 		KeyAnnotation:            true,
 		KeyAutoUpdate:            true,
 		KeyContainerName:         true,
+		KeyContainersConfModule:  true,
 		KeyDNS:                   true,
 		KeyDNSOption:             true,
 		KeyDNSSearch:             true,
@ -163,6 +166,7 @@ var (
 		KeyEnvironmentHost:       true,
 		KeyExec:                  true,
 		KeyExposeHostPort:        true,
+		KeyGlobalArgs:            true,
 		KeyGroup:                 true,
 		KeyHealthCmd:             true,
 		KeyHealthInterval:        true,
@ -219,9 +223,11 @@ var (

 	// Supported keys in "Volume" group
 	supportedVolumeKeys = map[string]bool{
+		KeyContainersConfModule: true,
 		KeyCopy:                 true,
 		KeyDevice:               true,
 		KeyDriver:               true,
+		KeyGlobalArgs:           true,
 		KeyGroup:                true,
 		KeyImage:                true,
 		KeyLabel:                true,
@ -236,6 +242,8 @@ var (
 	supportedNetworkKeys = map[string]bool{
 		KeyLabel:                true,
 		KeyDNS:                  true,
+		KeyContainersConfModule: true,
+		KeyGlobalArgs:           true,
 		KeyNetworkDisableDNS:    true,
 		KeyNetworkDriver:        true,
 		KeyNetworkGateway:       true,
@ -253,7 +261,9 @@ var (
 	supportedKubeKeys = map[string]bool{
 		KeyAutoUpdate:           true,
 		KeyConfigMap:            true,
+		KeyContainersConfModule: true,
 		KeyExitCodePropagation:  true,
+		KeyGlobalArgs:           true,
 		KeyLogDriver:            true,
 		KeyNetwork:              true,
 		KeyPodmanArgs:           true,
@ -273,8 +283,10 @@ var (
 		KeyArch:                 true,
 		KeyAuthFile:             true,
 		KeyCertDir:              true,
+		KeyContainersConfModule: true,
 		KeyCreds:                true,
 		KeyDecryptionKey:        true,
+		KeyGlobalArgs:           true,
 		KeyImage:                true,
 		KeyOS:                   true,
 		KeyPodmanArgs:           true,
@ -416,14 +428,19 @@ func ConvertContainer(container *parser.UnitFile, names map[string]string, isUse

 	// If conmon exited uncleanly it may not have removed the container, so
 	// force it, -i makes it ignore non-existing files.
-	service.Add(ServiceGroup, "ExecStop", podmanBinary()+" rm -v -f -i --cidfile=%t/%N.cid")
+	serviceStopCmd := createBasePodmanCommand(container, ContainerGroup)
+	serviceStopCmd.add("rm", "-v", "-f", "-i", "--cidfile=%t/%N.cid")
+	service.AddCmdline(ServiceGroup, "ExecStop", serviceStopCmd.Args)
 	// The ExecStopPost is needed when the main PID (i.e., conmon) gets killed.
 	// In that case, ExecStop is not executed but *Post only.  If both are
 	// fired in sequence, *Post will exit when detecting that the --cidfile
 	// has already been removed by the previous `rm`..
-	service.Add(ServiceGroup, "ExecStopPost", "-"+podmanBinary()+" rm -v -f -i --cidfile=%t/%N.cid")
+	serviceStopCmd.Args[0] = fmt.Sprintf("-%s", serviceStopCmd.Args[0])
+	service.AddCmdline(ServiceGroup, "ExecStopPost", serviceStopCmd.Args)

-	podman := NewPodmanCmdline("run")
+	podman := createBasePodmanCommand(container, ContainerGroup)
+
+	podman.add("run")

 	podman.addf("--name=%s", containerName)

@ -794,7 +811,9 @@ func ConvertNetwork(network *parser.UnitFile, name string) (*parser.UnitFile, st
 	// Need the containers filesystem mounted to start podman
 	service.Add(UnitGroup, "RequiresMountsFor", "%t/containers")

-	podman := NewPodmanCmdline("network", "create", "--ignore")
+	podman := createBasePodmanCommand(network, NetworkGroup)
+
+	podman.add("network", "create", "--ignore")

 	if disableDNS := network.LookupBooleanWithDefault(NetworkGroup, KeyNetworkDisableDNS, false); disableDNS {
 		podman.add("--disable-dns")
@ -898,7 +917,9 @@ func ConvertVolume(volume *parser.UnitFile, name string, names map[string]string

 	labels := volume.LookupAllKeyVal(VolumeGroup, "Label")

-	podman := NewPodmanCmdline("volume", "create", "--ignore")
+	podman := createBasePodmanCommand(volume, VolumeGroup)
+
+	podman.add("volume", "create", "--ignore")

 	driver, ok := volume.Lookup(VolumeGroup, KeyDriver)
 	if ok {
@ -1050,7 +1071,9 @@ func ConvertKube(kube *parser.UnitFile, names map[string]string, isUser bool) (*
 		service.Set(ServiceGroup, "SyslogIdentifier", "%N")
 	}

-	execStart := NewPodmanCmdline("kube", "play")
+	execStart := createBasePodmanCommand(kube, KubeGroup)
+
+	execStart.add("kube", "play")

 	execStart.add(
 		// Replace any previous container with the same name, not fail
@ -1107,8 +1130,8 @@ func ConvertKube(kube *parser.UnitFile, names map[string]string, isUser bool) (*

 	// Use `ExecStopPost` to make sure cleanup happens even in case of
 	// errors; otherwise containers, pods, etc. would be left behind.
-	execStop := NewPodmanCmdline("kube", "down")
-	execStop.add(yamlPath)
+	execStop := createBasePodmanCommand(kube, KubeGroup)
+	execStop.add("kube", "down", yamlPath)
 	service.AddCmdline(ServiceGroup, "ExecStopPost", execStop.Args)

 	err = handleSetWorkingDirectory(kube, service)
@ -1142,7 +1165,9 @@ func ConvertImage(image *parser.UnitFile) (*parser.UnitFile, string, error) {
 	// Need the containers filesystem mounted to start podman
 	service.Add(UnitGroup, "RequiresMountsFor", "%t/containers")

-	podman := NewPodmanCmdline("image", "pull")
+	podman := createBasePodmanCommand(image, ImageGroup)
+
+	podman.add("image", "pull")

 	stringKeys := map[string]string{
 		KeyArch:          "--arch",
@ -1571,3 +1596,19 @@ func convertToCSV(s []string) (string, error) {

 	return ret, nil
 }
+
+func createBasePodmanCommand(unitFile *parser.UnitFile, groupName string) *PodmanCmdline {
+	podman := NewPodmanCmdline()
+
+	containersConfModules := unitFile.LookupAll(groupName, KeyContainersConfModule)
+	for _, containersConfModule := range containersConfModules {
+		podman.addf("--module=%s", containersConfModule)
+	}
+
+	globalArgs := unitFile.LookupAllArgs(groupName, KeyGlobalArgs)
+	if len(globalArgs) > 0 {
+		podman.add(globalArgs...)
+	}
+
+	return podman
+}
--- a/test/e2e/quadlet/basic.container
+++ b/test/e2e/quadlet/basic.container
@ -12,7 +12,7 @@
 ## assert-key-is "Service" "Type" "notify"
 ## assert-key-is "Service" "NotifyAccess" "all"
 ## assert-key-is "Service" "SyslogIdentifier" "%N"
-## assert-key-is-regex "Service" "ExecStopPost" "-.*/podman rm -v -f -i --cidfile=%t/%N.cid"
+## assert-key-is-regex "Service" "ExecStopPost" "-[/S].*/podman rm -v -f -i --cidfile=%t/%N.cid"
 ## assert-key-is-regex "Service" "ExecStop" ".*/podman rm -v -f -i --cidfile=%t/%N.cid"
 ## assert-key-is "Service" "Environment" "PODMAN_SYSTEMD_UNIT=%n"

--- a/test/e2e/quadlet/containersconfmodule.container
+++ b/test/e2e/quadlet/containersconfmodule.container
@ -0,0 +1,7 @@
+## assert-podman-global-args "run" "--module=/etc/container/1.conf"
+## assert-podman-global-args "run" "--module=/etc/container/2.conf"
+
+[Container]
+Image=image
+ContainersConfModule=/etc/container/1.conf
+ContainersConfModule=/etc/container/2.conf
--- a/test/e2e/quadlet/containersconfmodule.image
+++ b/test/e2e/quadlet/containersconfmodule.image
@ -0,0 +1,7 @@
+## assert-podman-global-args "image" "--module=/etc/container/1.conf"
+## assert-podman-global-args "image" "--module=/etc/container/2.conf"
+
+[Image]
+Image=image:latest
+ContainersConfModule=/etc/container/1.conf
+ContainersConfModule=/etc/container/2.conf
--- a/test/e2e/quadlet/containersconfmodule.kube
+++ b/test/e2e/quadlet/containersconfmodule.kube
@ -0,0 +1,7 @@
+## assert-podman-global-args "kube" "--module=/etc/container/1.conf"
+## assert-podman-global-args "kube" "--module=/etc/container/2.conf"
+
+[Kube]
+Yaml=file.yml
+ContainersConfModule=/etc/container/1.conf
+ContainersConfModule=/etc/container/2.conf
--- a/test/e2e/quadlet/containersconfmodule.network
+++ b/test/e2e/quadlet/containersconfmodule.network
@ -0,0 +1,6 @@
+## assert-podman-global-args "network" "--module=/etc/container/1.conf"
+## assert-podman-global-args "network" "--module=/etc/container/2.conf"
+
+[Network]
+ContainersConfModule=/etc/container/1.conf
+ContainersConfModule=/etc/container/2.conf
--- a/test/e2e/quadlet/containersconfmodule.volume
+++ b/test/e2e/quadlet/containersconfmodule.volume
@ -0,0 +1,6 @@
+## assert-podman-global-args "volume" "--module=/etc/container/1.conf"
+## assert-podman-global-args "volume" "--module=/etc/container/2.conf"
+
+[Volume]
+ContainersConfModule=/etc/container/1.conf
+ContainersConfModule=/etc/container/2.conf
--- a/test/e2e/quadlet/globalargs.container
+++ b/test/e2e/quadlet/globalargs.container
@ -0,0 +1,16 @@
+## assert-podman-global-args "run" "--conmon=/usr/bin/somewhere"
+## assert-podman-global-args "run" "--imagestore=/var/lib/somestore"
+## assert-podman-global-args "run" "--log-level=debug"
+
+## assert-podman-stop-global-args "rm" "--conmon=/usr/bin/somewhere"
+## assert-podman-stop-global-args "rm" "--imagestore=/var/lib/somestore"
+## assert-podman-stop-global-args "rm" "--log-level=debug"
+
+## assert-podman-stop-post-global-args "rm" "--conmon=/usr/bin/somewhere"
+## assert-podman-stop-post-global-args "rm" "--imagestore=/var/lib/somestore"
+## assert-podman-stop-post-global-args "rm" "--log-level=debug"
+
+[Container]
+Image=image
+GlobalArgs=--conmon=/usr/bin/somewhere
+GlobalArgs=--imagestore=/var/lib/somestore --log-level=debug
--- a/test/e2e/quadlet/globalargs.image
+++ b/test/e2e/quadlet/globalargs.image
@ -0,0 +1,8 @@
+## assert-podman-global-args "image" "--identity=path=/etc/identity"
+## assert-podman-global-args "image" "--syslog"
+## assert-podman-global-args "image" "--log-level=debug"
+
+[Image]
+Image=image:latest
+GlobalArgs=--identity=path=/etc/identity
+GlobalArgs=--syslog --log-level=debug
--- a/test/e2e/quadlet/globalargs.kube
+++ b/test/e2e/quadlet/globalargs.kube
@ -0,0 +1,12 @@
+## assert-podman-global-args "kube" "--conmon=/usr/bin/somewhere"
+## assert-podman-global-args "kube" "--imagestore=/var/lib/somestore"
+## assert-podman-global-args "kube" "--log-level=debug"
+
+## assert-podman-stop-post-global-args "kube" "--conmon=/usr/bin/somewhere"
+## assert-podman-stop-post-global-args "kube" "--imagestore=/var/lib/somestore"
+## assert-podman-stop-post-global-args "kube" "--log-level=debug"
+
+[Kube]
+Yaml=file.yml
+GlobalArgs=--conmon=/usr/bin/somewhere
+GlobalArgs=--imagestore=/var/lib/somestore --log-level=debug
--- a/test/e2e/quadlet/globalargs.network
+++ b/test/e2e/quadlet/globalargs.network
@ -0,0 +1,7 @@
+## assert-podman-global-args "network" "--network-cmd-path=/usr/bin/network-cmd"
+## assert-podman-global-args "network" "--network-config-dir=/etc/network-config"
+## assert-podman-global-args "network" "--log-level=debug"
+
+[Network]
+GlobalArgs=--network-cmd-path=/usr/bin/network-cmd
+GlobalArgs=--network-config-dir=/etc/network-config --log-level=debug
--- a/test/e2e/quadlet/globalargs.volume
+++ b/test/e2e/quadlet/globalargs.volume
@ -0,0 +1,7 @@
+## assert-podman-global-args "volume" "--volumepath=/var/lib/somewhere"
+## assert-podman-global-args "volume" "--imagestore=/var/lib/store"
+## assert-podman-global-args "volume" "--log-level=debug"
+
+[Volume]
+GlobalArgs=--volumepath=/var/lib/somewhere
+GlobalArgs=--imagestore=/var/lib/store --log-level=debug
--- a/test/e2e/quadlet_test.go
+++ b/test/e2e/quadlet_test.go
@ -169,14 +169,26 @@ func (t *quadletTestcase) assertKeyContains(args []string, unit *parser.UnitFile
 	return ok && strings.Contains(realValue, value)
 }

-func (t *quadletTestcase) assertPodmanArgs(args []string, unit *parser.UnitFile, key string) bool {
+func (t *quadletTestcase) assertPodmanArgs(args []string, unit *parser.UnitFile, key string, allowRegex, globalOnly bool) bool {
 	podmanArgs, _ := unit.LookupLastArgs("Service", key)
-	return findSublist(podmanArgs, args) != -1
-}
+	if globalOnly {
+		podmanCmdLocation := findSublist(podmanArgs, []string{args[0]})
+		if podmanCmdLocation == -1 {
+			return false
+		}

-func (t *quadletTestcase) assertPodmanArgsRegex(args []string, unit *parser.UnitFile, key string) bool {
-	podmanArgs, _ := unit.LookupLastArgs("Service", key)
-	return findSublistRegex(podmanArgs, args) != -1
+		podmanArgs = podmanArgs[:podmanCmdLocation]
+		args = args[1:]
+	}
+
+	var location int
+	if allowRegex {
+		location = findSublistRegex(podmanArgs, args)
+	} else {
+		location = findSublist(podmanArgs, args)
+	}
+
+	return location != -1
 }

 func keyValueStringToMap(keyValueString, separator string) (map[string]string, error) {
@ -216,9 +228,19 @@ func keyValMapEqualRegex(expectedKeyValMap, actualKeyValMap map[string]string) b
 	return true
 }

-func (t *quadletTestcase) assertPodmanArgsKeyVal(args []string, unit *parser.UnitFile, key string, allowRegex bool) bool {
+func (t *quadletTestcase) assertPodmanArgsKeyVal(args []string, unit *parser.UnitFile, key string, allowRegex, globalOnly bool) bool {
 	podmanArgs, _ := unit.LookupLastArgs("Service", key)

+	if globalOnly {
+		podmanCmdLocation := findSublist(podmanArgs, []string{args[0]})
+		if podmanCmdLocation == -1 {
+			return false
+		}
+
+		podmanArgs = podmanArgs[:podmanCmdLocation]
+		args = args[1:]
+	}
+
 	expectedKeyValMap, err := keyValueStringToMap(args[2], args[1])
 	if err != nil {
 		return false
@ -270,19 +292,35 @@ func (t *quadletTestcase) assertPodmanFinalArgsRegex(args []string, unit *parser
 }

 func (t *quadletTestcase) assertStartPodmanArgs(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgs(args, unit, "ExecStart")
+	return t.assertPodmanArgs(args, unit, "ExecStart", false, false)
 }

 func (t *quadletTestcase) assertStartPodmanArgsRegex(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgsRegex(args, unit, "ExecStart")
+	return t.assertPodmanArgs(args, unit, "ExecStart", true, false)
+}
+
+func (t *quadletTestcase) assertStartPodmanGlobalArgs(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgs(args, unit, "ExecStart", false, true)
+}
+
+func (t *quadletTestcase) assertStartPodmanGlobalArgsRegex(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgs(args, unit, "ExecStart", true, true)
 }

 func (t *quadletTestcase) assertStartPodmanArgsKeyVal(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", false)
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", false, false)
 }

 func (t *quadletTestcase) assertStartPodmanArgsKeyValRegex(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", true)
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", true, false)
+}
+
+func (t *quadletTestcase) assertStartPodmanGlobalArgsKeyVal(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", false, true)
+}
+
+func (t *quadletTestcase) assertStartPodmanGlobalArgsKeyValRegex(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStart", true, true)
 }

 func (t *quadletTestcase) assertStartPodmanFinalArgs(args []string, unit *parser.UnitFile) bool {
@ -294,7 +332,11 @@ func (t *quadletTestcase) assertStartPodmanFinalArgsRegex(args []string, unit *p
 }

 func (t *quadletTestcase) assertStopPodmanArgs(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgs(args, unit, "ExecStop")
+	return t.assertPodmanArgs(args, unit, "ExecStop", false, false)
+}
+
+func (t *quadletTestcase) assertStopPodmanGlobalArgs(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgs(args, unit, "ExecStop", false, true)
 }

 func (t *quadletTestcase) assertStopPodmanFinalArgs(args []string, unit *parser.UnitFile) bool {
@ -305,8 +347,20 @@ func (t *quadletTestcase) assertStopPodmanFinalArgsRegex(args []string, unit *pa
 	return t.assertPodmanFinalArgsRegex(args, unit, "ExecStop")
 }

+func (t *quadletTestcase) assertStopPodmanArgsKeyVal(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStop", false, false)
+}
+
+func (t *quadletTestcase) assertStopPodmanArgsKeyValRegex(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStop", true, false)
+}
+
 func (t *quadletTestcase) assertStopPostPodmanArgs(args []string, unit *parser.UnitFile) bool {
-	return t.assertPodmanArgs(args, unit, "ExecStopPost")
+	return t.assertPodmanArgs(args, unit, "ExecStopPost", false, false)
+}
+
+func (t *quadletTestcase) assertStopPostPodmanGlobalArgs(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgs(args, unit, "ExecStopPost", false, true)
 }

 func (t *quadletTestcase) assertStopPostPodmanFinalArgs(args []string, unit *parser.UnitFile) bool {
@ -317,6 +371,14 @@ func (t *quadletTestcase) assertStopPostPodmanFinalArgsRegex(args []string, unit
 	return t.assertPodmanFinalArgsRegex(args, unit, "ExecStopPost")
 }

+func (t *quadletTestcase) assertStopPostPodmanArgsKeyVal(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStopPost", false, false)
+}
+
+func (t *quadletTestcase) assertStopPostPodmanArgsKeyValRegex(args []string, unit *parser.UnitFile) bool {
+	return t.assertPodmanArgsKeyVal(args, unit, "ExecStopPost", true, false)
+}
+
 func (t *quadletTestcase) assertSymlink(args []string, unit *parser.UnitFile) bool {
 	Expect(args).To(HaveLen(2))
 	symlink := args[0]
@ -366,6 +428,14 @@ func (t *quadletTestcase) doAssert(check []string, unit *parser.UnitFile, sessio
 		ok = t.assertStartPodmanArgsKeyVal(args, unit)
 	case "assert-podman-args-key-val-regex":
 		ok = t.assertStartPodmanArgsKeyValRegex(args, unit)
+	case "assert-podman-global-args":
+		ok = t.assertStartPodmanGlobalArgs(args, unit)
+	case "assert-podman-global-args-regex":
+		ok = t.assertStartPodmanGlobalArgsRegex(args, unit)
+	case "assert-podman-global-args-key-val":
+		ok = t.assertStartPodmanGlobalArgsKeyVal(args, unit)
+	case "assert-podman-global-args-key-val-regex":
+		ok = t.assertStartPodmanGlobalArgsKeyValRegex(args, unit)
 	case "assert-podman-final-args":
 		ok = t.assertStartPodmanFinalArgs(args, unit)
 	case "assert-podman-final-args-regex":
@ -374,16 +444,28 @@ func (t *quadletTestcase) doAssert(check []string, unit *parser.UnitFile, sessio
 		ok = t.assertSymlink(args, unit)
 	case "assert-podman-stop-args":
 		ok = t.assertStopPodmanArgs(args, unit)
+	case "assert-podman-stop-global-args":
+		ok = t.assertStopPodmanGlobalArgs(args, unit)
 	case "assert-podman-stop-final-args":
 		ok = t.assertStopPodmanFinalArgs(args, unit)
 	case "assert-podman-stop-final-args-regex":
 		ok = t.assertStopPodmanFinalArgsRegex(args, unit)
+	case "assert-podman-stop-args-key-val":
+		ok = t.assertStopPodmanArgsKeyVal(args, unit)
+	case "assert-podman-stop-args-key-val-regex":
+		ok = t.assertStopPodmanArgsKeyValRegex(args, unit)
 	case "assert-podman-stop-post-args":
 		ok = t.assertStopPostPodmanArgs(args, unit)
+	case "assert-podman-stop-post-global-args":
+		ok = t.assertStopPostPodmanGlobalArgs(args, unit)
 	case "assert-podman-stop-post-final-args":
 		ok = t.assertStopPostPodmanFinalArgs(args, unit)
 	case "assert-podman-stop-post-final-args-regex":
 		ok = t.assertStopPostPodmanFinalArgsRegex(args, unit)
+	case "assert-podman-stop-post-args-key-val":
+		ok = t.assertStopPostPodmanArgsKeyVal(args, unit)
+	case "assert-podman-stop-post-args-key-val-regex":
+		ok = t.assertStopPostPodmanArgsKeyValRegex(args, unit)

 	default:
 		return fmt.Errorf("Unsupported assertion %s", op)
@ -647,6 +729,8 @@ BOGUS=foo
 		Entry("user.container", "user.container", 0, ""),
 		Entry("volume.container", "volume.container", 0, ""),
 		Entry("workingdir.container", "workingdir.container", 0, ""),
+		Entry("Container - global args", "globalargs.container", 0, ""),
+		Entry("Container - Containers Conf Modules", "containersconfmodule.container", 0, ""),

 		Entry("basic.volume", "basic.volume", 0, ""),
 		Entry("device-copy.volume", "device-copy.volume", 0, ""),
@ -657,6 +741,8 @@ BOGUS=foo
 		Entry("uid.volume", "uid.volume", 0, ""),
 		Entry("image.volume", "image.volume", 0, ""),
 		Entry("image-no-image.volume", "image-no-image.volume", 1, "converting \"image-no-image.volume\": the key Image is mandatory when using the image driver"),
+		Entry("Volume - global args", "globalargs.volume", 0, ""),
+		Entry("Volume - Containers Conf Modules", "containersconfmodule.volume", 0, ""),

 		Entry("Absolute Path", "absolute.path.kube", 0, ""),
 		Entry("Basic kube", "basic.kube", 0, ""),
@ -676,6 +762,8 @@ BOGUS=foo
 		Entry("Kube - Working Directory YAML Relative Path", "workingdir-yaml-rel.kube", 0, ""),
 		Entry("Kube - Working Directory Unit", "workingdir-unit.kube", 0, ""),
 		Entry("Kube - Working Directory already in Service", "workingdir-service.kube", 0, ""),
+		Entry("Kube - global args", "globalargs.kube", 0, ""),
+		Entry("Kube - Containers Conf Modules", "containersconfmodule.kube", 0, ""),

 		Entry("Network - Basic", "basic.network", 0, ""),
 		Entry("Network - Disable DNS", "disable-dns.network", 0, ""),
@ -698,6 +786,8 @@ BOGUS=foo
 		Entry("Network - Subnets", "subnets.network", 0, ""),
 		Entry("Network - multiple subnet, gateway and range", "subnet-trio.multiple.network", 0, ""),
 		Entry("Network - subnet, gateway and range", "subnet-trio.network", 0, ""),
+		Entry("Network - global args", "globalargs.network", 0, ""),
+		Entry("Network - Containers Conf Modules", "containersconfmodule.network", 0, ""),

 		Entry("Image - Basic", "basic.image", 0, ""),
 		Entry("Image - No Image", "no-image.image", 1, "converting \"no-image.image\": no Image key specified"),
@ -711,6 +801,8 @@ BOGUS=foo
 		Entry("Image - All Tags", "all-tags.image", 0, ""),
 		Entry("Image - TLS Verify", "tls-verify.image", 0, ""),
 		Entry("Image - Arch and OS", "arch-os.image", 0, ""),
+		Entry("Image - global args", "globalargs.image", 0, ""),
+		Entry("Image - Containers Conf Modules", "containersconfmodule.image", 0, ""),
 	)

 })