Skip to content

Commit

Permalink
config: Add readonly_rootfs config option like docker plugin
Browse files Browse the repository at this point in the history
  • Loading branch information
pabloyoyoista committed Nov 10, 2021
1 parent 7e3d018 commit c71e7bb
Show file tree
Hide file tree
Showing 5 changed files with 24 additions and 1 deletion.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ FEATURES:
* config: Map host devices into container. [[GH-41](https://github.com/hashicorp/nomad-driver-podman/pull/41)]
* config: Stream logs via API, support journald log driver. [[GH-99](https://github.com/hashicorp/nomad-driver-podman/pull/99)]
* config: Privileged containers.
* config: Allow mounting rootfs as read-only. [[GH-133](https://github.com/hashicorp/nomad-driver-podman/pull/133)]

BUG FIXES:
* log: Use error key context to log errors rather than Go err style. [[GH-126](https://github.com/hashicorp/nomad-driver-podman/pull/126)]
Expand Down
12 changes: 11 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -243,7 +243,7 @@ config {
}
```

* **devices** - (Optional) A list of `host-device[:container-device][:permissions]` definitions.
* **devices** - (Optional) A list of `host-device[:container-device][:permissions]` definitions.
Each entry adds a host device to the container. Optional permissions can be used to specify device permissions, it is combination of r for read, w for write, and m for mknod(2). See podman documentation for more details.

```
Expand Down Expand Up @@ -417,6 +417,16 @@ config {
}
```

* **readonly_rootfs** - (Optional) true or false (default). Mount the rootfs as read-only.

```
config {
readonly_rootfs = true
}
```



## Network Configuration

[nomad lifecycle hooks](https://www.nomadproject.io/docs/job-specification/lifecycle) combined with the drivers `network_mode` allows very flexible network namespace definitions. This feature does not build upon the native podman pod structure but simply reuses the networking namespace of one container for other tasks in the same group.
Expand Down
2 changes: 2 additions & 0 deletions config.go
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,7 @@ var (
"tty": hclspec.NewAttr("tty", "bool", false),
"volumes": hclspec.NewAttr("volumes", "list(string)", false),
"force_pull": hclspec.NewAttr("force_pull", "bool", false),
"readonly_rootfs": hclspec.NewAttr("readonly_rootfs", "bool", false),
})
)

Expand Down Expand Up @@ -137,4 +138,5 @@ type TaskConfig struct {
Tty bool `codec:"tty"`
ForcePull bool `codec:"force_pull"`
Privileged bool `codec:"privileged"`
ReadOnlyRootfs bool `codec:"readonly_rootfs"`
}
1 change: 1 addition & 0 deletions driver.go
Original file line number Diff line number Diff line change
Expand Up @@ -447,6 +447,7 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive
createOpts.ContainerSecurityConfig.CapDrop = driverConfig.CapDrop
createOpts.ContainerSecurityConfig.User = cfg.User
createOpts.ContainerSecurityConfig.Privileged = driverConfig.Privileged
createOpts.ContainerSecurityConfig.ReadOnlyFilesystem = driverConfig.ReadOnlyRootfs

// Network config options
if cfg.DNS != nil {
Expand Down
9 changes: 9 additions & 0 deletions driver_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -1355,6 +1355,15 @@ func TestPodmanDriver_Privileged(t *testing.T) {
require.True(t, inspectData.HostConfig.Privileged)
}

// check enabled readonly_rootfs option
func TestPodmanDriver_ReadOnlyFilesystem(t *testing.T) {
taskCfg := newTaskConfig("", busyboxLongRunningCmd)
taskCfg.ReadOnlyRootfs = true
inspectData := startDestroyInspect(t, taskCfg, "readonly_rootfs")

require.True(t, inspectData.HostConfig.ReadonlyRootfs)
}

// check dns server configuration
func TestPodmanDriver_Dns(t *testing.T) {
if !tu.IsCI() {
Expand Down

0 comments on commit c71e7bb

Please sign in to comment.