summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cmd/podman/common.go4
-rw-r--r--cmd/podman/shared/container.go3
-rw-r--r--cmd/podman/shared/create.go1
-rw-r--r--cmd/podman/shared/intermediate.go1
-rw-r--r--cmd/podman/shared/intermediate_varlink.go2
-rw-r--r--cmd/podman/varlink/io.podman.varlink1
-rw-r--r--completions/bash/podman1
-rw-r--r--docs/podman-create.1.md3
-rw-r--r--docs/podman-run.1.md9
-rw-r--r--libpod/container_internal_linux.go2
-rw-r--r--pkg/inspect/inspect.go3
-rw-r--r--pkg/spec/createconfig.go1
-rw-r--r--pkg/spec/spec.go25
13 files changed, 52 insertions, 4 deletions
diff --git a/cmd/podman/common.go b/cmd/podman/common.go
index ba4a3f519..eac96d3ba 100644
--- a/cmd/podman/common.go
+++ b/cmd/podman/common.go
@@ -434,6 +434,10 @@ func getCreateFlags(c *cliconfig.PodmanCommand) {
"read-only", false,
"Make containers root filesystem read-only",
)
+ createFlags.Bool(
+ "read-only-tmpfs", true,
+ "When running containers in read-only mode mount a read-write tmpfs on /run, /tmp and /var/tmp",
+ )
createFlags.String(
"restart", "",
"Restart is not supported. Please use a systemd unit file for restart",
diff --git a/cmd/podman/shared/container.go b/cmd/podman/shared/container.go
index e14276bdf..9050fd2b9 100644
--- a/cmd/podman/shared/container.go
+++ b/cmd/podman/shared/container.go
@@ -658,7 +658,8 @@ func GetCtrInspectInfo(config *libpod.ContainerConfig, ctrInspectData *inspect.C
OomKillDisable: memDisableOOMKiller,
PidsLimit: pidsLimit,
Privileged: config.Privileged,
- ReadonlyRootfs: spec.Root.Readonly,
+ ReadOnlyRootfs: spec.Root.Readonly,
+ ReadOnlyTmpfs: createArtifact.ReadOnlyTmpfs,
Runtime: config.OCIRuntime,
NetworkMode: string(createArtifact.NetMode),
IpcMode: string(createArtifact.IpcMode),
diff --git a/cmd/podman/shared/create.go b/cmd/podman/shared/create.go
index 3f54e193f..c521f9cb6 100644
--- a/cmd/podman/shared/create.go
+++ b/cmd/podman/shared/create.go
@@ -650,6 +650,7 @@ func ParseCreateOpts(ctx context.Context, c *GenericCLIResults, runtime *libpod.
PortBindings: portBindings,
Quiet: c.Bool("quiet"),
ReadOnlyRootfs: c.Bool("read-only"),
+ ReadOnlyTmpfs: c.Bool("read-only-tmpfs"),
Resources: cc.CreateResourceConfig{
BlkioWeight: blkioWeight,
BlkioWeightDevice: c.StringSlice("blkio-weight-device"),
diff --git a/cmd/podman/shared/intermediate.go b/cmd/podman/shared/intermediate.go
index 2e1827561..9c494dec5 100644
--- a/cmd/podman/shared/intermediate.go
+++ b/cmd/podman/shared/intermediate.go
@@ -434,6 +434,7 @@ func NewIntermediateLayer(c *cliconfig.PodmanCommand, remote bool) GenericCLIRes
m["publish-all"] = newCRBool(c, "publish-all")
m["quiet"] = newCRBool(c, "quiet")
m["read-only"] = newCRBool(c, "read-only")
+ m["read-only-tmpfs"] = newCRBool(c, "read-only-tmpfs")
m["restart"] = newCRString(c, "restart")
m["rm"] = newCRBool(c, "rm")
m["rootfs"] = newCRBool(c, "rootfs")
diff --git a/cmd/podman/shared/intermediate_varlink.go b/cmd/podman/shared/intermediate_varlink.go
index d62a65955..5e21245e3 100644
--- a/cmd/podman/shared/intermediate_varlink.go
+++ b/cmd/podman/shared/intermediate_varlink.go
@@ -141,6 +141,7 @@ func (g GenericCLIResults) MakeVarlink() iopodman.Create {
PublishAll: BoolToPtr(g.Find("publish-all")),
Quiet: BoolToPtr(g.Find("quiet")),
Readonly: BoolToPtr(g.Find("read-only")),
+ Readonlytmpfs: BoolToPtr(g.Find("read-only-tmpfs")),
Restart: StringToPtr(g.Find("restart")),
Rm: BoolToPtr(g.Find("rm")),
Rootfs: BoolToPtr(g.Find("rootfs")),
@@ -397,6 +398,7 @@ func VarlinkCreateToGeneric(opts iopodman.Create) GenericCLIResults {
m["publish-all"] = boolFromVarlink(opts.PublishAll, "publish-all", false)
m["quiet"] = boolFromVarlink(opts.Quiet, "quiet", false)
m["read-only"] = boolFromVarlink(opts.Readonly, "read-only", false)
+ m["read-only-tmpfs"] = boolFromVarlink(opts.Readonlytmpfs, "read-only-tmpfs", true)
m["restart"] = stringFromVarlink(opts.Restart, "restart", nil)
m["rm"] = boolFromVarlink(opts.Rm, "rm", false)
m["rootfs"] = boolFromVarlink(opts.Rootfs, "rootfs", false)
diff --git a/cmd/podman/varlink/io.podman.varlink b/cmd/podman/varlink/io.podman.varlink
index 17179d665..309f9765a 100644
--- a/cmd/podman/varlink/io.podman.varlink
+++ b/cmd/podman/varlink/io.podman.varlink
@@ -346,6 +346,7 @@ type Create (
publishAll: ?bool,
quiet: ?bool,
readonly: ?bool,
+ readonlytmpfs: ?bool,
restart: ?string,
rm: ?bool,
rootfs: ?bool,
diff --git a/completions/bash/podman b/completions/bash/podman
index dce23df2b..6acdcc05a 100644
--- a/completions/bash/podman
+++ b/completions/bash/podman
@@ -1765,6 +1765,7 @@ _podman_container_run() {
--publish-all -P
--quiet
--read-only
+ --read-only-tmpfs
--tty -t
"
diff --git a/docs/podman-create.1.md b/docs/podman-create.1.md
index f61deebd2..52c965293 100644
--- a/docs/podman-create.1.md
+++ b/docs/podman-create.1.md
@@ -542,6 +542,9 @@ By default a container will have its root filesystem writable allowing processes
to write files anywhere. By specifying the `--read-only` flag the container will have
its root filesystem mounted as read only prohibiting any writes.
+**--read-only-tmpfs**=*true*|*false*
+If container is running in --read-only mode, then mount a read-write tmpfs on /run, /tmp, and /var/tmp. The default is *true*
+
**--restart=""**
Not implemented.
diff --git a/docs/podman-run.1.md b/docs/podman-run.1.md
index 5a311980f..e54e5e691 100644
--- a/docs/podman-run.1.md
+++ b/docs/podman-run.1.md
@@ -534,6 +534,9 @@ By default a container will have its root filesystem writable allowing processes
to write files anywhere. By specifying the `--read-only` flag the container will have
its root filesystem mounted as read only prohibiting any writes.
+**--read-only-tmpfs**=*true*|*false*
+If container is running in --read-only mode, then mount a read-write tmpfs on /run, /tmp, and /var/tmp. The default is *true*
+
**--restart=""**
Not implemented.
@@ -905,7 +908,11 @@ still need to write temporary data. The best way to handle this is to mount
tmpfs directories on /run and /tmp.
```
-$ podman run --read-only --tmpfs /run --tmpfs /tmp -i -t fedora /bin/bash
+$ podman run --read-only -i -t fedora /bin/bash
+```
+
+```
+$ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash
```
### Exposing log messages from the container to the host's log
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index f352b188e..c5e404155 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -420,7 +420,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
// It also expects to be able to write to /sys/fs/cgroup/systemd and /var/log/journal
func (c *Container) setupSystemd(mounts []spec.Mount, g generate.Generator) error {
options := []string{"rw", "rprivate", "noexec", "nosuid", "nodev"}
- for _, dest := range []string{"/run", "/run/lock"} {
+ for _, dest := range []string{"/run"} {
if MountExists(mounts, dest) {
continue
}
diff --git a/pkg/inspect/inspect.go b/pkg/inspect/inspect.go
index 270e431ad..6978370ef 100644
--- a/pkg/inspect/inspect.go
+++ b/pkg/inspect/inspect.go
@@ -38,7 +38,8 @@ type HostConfig struct {
PidMode string `json:"PidMode"`
Privileged bool `json:"Privileged"`
PublishAllPorts bool `json:"PublishAllPorts"` //TODO
- ReadonlyRootfs bool `json:"ReadonlyRootfs"`
+ ReadOnlyRootfs bool `json:"ReadonlyRootfs"`
+ ReadOnlyTmpfs bool `json:"ReadonlyTmpfs"`
SecurityOpt []string `json:"SecurityOpt"`
UTSMode string `json:"UTSMode"`
UsernsMode string `json:"UsernsMode"`
diff --git a/pkg/spec/createconfig.go b/pkg/spec/createconfig.go
index e71d9d3db..064dedd45 100644
--- a/pkg/spec/createconfig.go
+++ b/pkg/spec/createconfig.go
@@ -113,6 +113,7 @@ type CreateConfig struct {
PublishAll bool //publish-all
Quiet bool //quiet
ReadOnlyRootfs bool //read-only
+ ReadOnlyTmpfs bool //read-only-tmpfs
Resources CreateResourceConfig
Rm bool //rm
StopSignal syscall.Signal // stop-signal
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go
index 0371b6d4d..4cbed0ea4 100644
--- a/pkg/spec/spec.go
+++ b/pkg/spec/spec.go
@@ -341,6 +341,31 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint
}
}
+ if config.ReadOnlyRootfs && config.ReadOnlyTmpfs {
+ options := []string{"rw", "rprivate", "nosuid", "nodev", "tmpcopyup"}
+ for _, i := range []string{"/tmp", "/var/tmp"} {
+ if libpod.MountExists(g.Config.Mounts, i) {
+ continue
+ }
+ // Default options if nothing passed
+ tmpfsMnt := spec.Mount{
+ Destination: i,
+ Type: "tmpfs",
+ Source: "tmpfs",
+ Options: options,
+ }
+ g.AddMount(tmpfsMnt)
+ }
+ if !libpod.MountExists(g.Config.Mounts, "/run") {
+ tmpfsMnt := spec.Mount{
+ Destination: "/run",
+ Type: "tmpfs",
+ Source: "tmpfs",
+ Options: append(options, "noexec", "size=65536k"),
+ }
+ g.AddMount(tmpfsMnt)
+ }
+ }
for name, val := range config.Env {
g.AddProcessEnv(name, val)
}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-28 07:09:15 +0000