Is it possible to have execute permissions on /tmp for kube play created pods?

[rhatdan]

Discussed in #19859

^{Originally posted by frenetic00 September 5, 2023}
Is it possible to give /tmp execute permissions when running as a pod under systemd?

I've used Kubernetes yaml to build a pod of several containers to run Nextcloud.
One of the Nextcloud apps is failing to run correctly because it relies on having execute permissions in /tmp

My Kubernetes yaml is executed as a non-root user using a systemd service.

ExecStart=/usr/bin/podman kube play --network=ns:/var/run/netns/%U --replace --service-container=true %I

Inside the container, I can see that /tmp has been mounted with noexec

tmpfs /tmp tmpfs rw,nosuid,nodev,noexec,relatime,uid=1003,gid=1003,inode64 0 0

I'm new to go and namespaces, but I'm trying to get an understanding of what's going on while trying to solve my issue.

I can see in the docs that there is a systemd option for other podman commands that will mount several tmpfs file systems when systemd mode is enabled. Does the --service-container option ensure that that the container will be configured with systemd? I've seen some reference to it here.

I can also see that permissions for /tmp are being set here and here but I'm still not sure how /tmp gets configured with the noexec option. Can anyone point me in the right direction? Thanks