systemd tmpfiles interferes with DirectoryMode in drop-in

[nalcabio-tom]

Feature request description

This:

D! /run/podman 0700 root root

prevents having a different set of permissions and ownership in a DirectoryMode= directive in a drop-in.

Suggest potential solution

Move this to podman.socket?

https://www.freedesktop.org/software/systemd/man/latest/systemd.socket.html#DirectoryMode=

Have you considered any alternatives?

A clear and concise description of any alternative solutions or features you've considered.

Additional context

Add any other context or screenshots about the feature request here.

[lsm5]

@nalcabio-tom thanks for the report, would you like to open a PR for this?

@containers/podman-maintainers wdyt?

[ygalblum]

@lsm5 not sure if you tagged me on purpose. I really don't know the issue here

[lsm5]

@lsm5 not sure if you tagged me on purpose. I really don't know the issue here

my bad. I had quadlet going in my head too.

[mheon]

My main question would be whether we use /run/podman for anything besides the socket. If not, I think this is a good (and easy) change.

[nalcabio-tom]

My main question would be whether we use /run/podman for anything besides the socket.

No clue where these come from, but nv-proxy.socket and nv-proxy.lease are also in there (Debian Trixie).

If not, I think this is a good (and easy) change.

Thanks everyone for taking the time to respond to this. I'd be happy to submit a pull-request if there's consensus on making this change.

[Luap99]

No clue where these come from, but nv-proxy.socket and nv-proxy.lease are also in there (Debian Trixie).

This is the netavark dhcp proxy:
https://github.com/containers/netavark/blob/main/contrib/systemd/system/netavark-dhcp-proxy.socket

So it should get the same change then.

I'd be happy to submit a pull-request if there's consensus on making this change.

Please do, I cannot think of a reason why this would not work.

[mtrmac]

On the principle of the thing — who “owns” that directory? I would think that’s Podman, and that it exists for Podman’s purposes.

Why is it reasonable and long-term supportable for users to override directory permissions of that directory to arbitrary values?

@nalcabio-tom what are you ultimately trying to do?

[nalcabio-tom]

@nalcabio-tom what are you ultimately trying to do?

# /etc/systemd/system/podman.socket.d/99nalcabio.conf
[Socket]
DirectoryMode=
DirectoryMode=0755
SocketGroup=
SocketGroup=runner

# /etc/systemd/system/runner@.service
[Unit]
Description=Runner %i

[Service]
ExecStart=/usr/local/bin/runner-run %i
Type=exec
Restart=always

User=runner
Group=runner
WorkingDirectory=/home/runner
TimeoutSec=0
RestartSec=10

[Install]
WantedBy=runners.target

For reasons, this works (minus the socket permissions) as a system-wide service but does not work as a user service.