Description of problem:

For quite some time with docker, the reasonable way to make writable / temporary volumes present in the container based on the container image, without a need for separate docker run options, was to define the mountpoints as VOLUME:

# docker run --rm --read-only registry.access.redhat.com/ubi8 touch /run/a
touch: cannot touch '/run/a': Read-only file system

# cat Dockerfile
FROM registry.access.redhat.com/ubi8
VOLUME [ "/run" ]

# docker build -t test-volume .

# docker run --rm --read-only test-volume touch /run/a

# echo $?
0

Even if the systemd OCI hook got invoked like with Dockerfile like

FROM registry.access.redhat.com/ubi8
RUN ln -s /bin/bash /usr/local/bin/init
ENTRYPOINT [ "/usr/local/bin/init", "-c" ]

which automounted /run and made invocation like

# docker run --rm --read-only test-volume "touch /run/a"

possible without the VOLUME parameter, having the VOLUME parameter was still possible:

FROM registry.access.redhat.com/ubi8
RUN ln -s /bin/bash /usr/local/bin/init
ENTRYPOINT [ "/usr/local/bin/init", "-c" ]
VOLUME [ "/run" ]

# docker build -t test-volume .
# docker run --rm --read-only test-volume "touch /run/a"

That way it was possible to have the temporary volumes defined in the container image and made the use of the image in read-only containers easy.

This got broken with podman.

Version-Release number of selected component (if applicable):

podman-1.4.2-5.module+el8.1.0+4240+893c1ab8.x86_64

How reproducible:

Deterministic.

Steps to Reproduce:
1. Have Dockerfile which defines for example /run as VOLUME:

FROM registry.access.redhat.com/ubi8
VOLUME [ "/run" ]

2. Build image: podman build -t test-volume .
3. Run the container:  podman run --rm --read-only test-volume touch /run/a

Actual results:

Error: conflict at mount destination /run: duplicate mount destination

Expected results:

No error, behaviour similar to docker which did not choke on the extra VOLUME declaration.

Additional info:

The man podman-run(1) says that podman mounts /run (and /tmp and /var/tmp) by default:

       --read-only-tmpfs=true|false

       If container is running in --read-only mode, then mount a read-write
       tmpfs on /run, /tmp, and /var/tmp.  The default is true

But podman should be able to reconcile its idea of automounted tmpfs volumes with the VOLUME declaration in the container image. There is nothing duplicate about those mount destinations, really.

It is possible to avoid the error by explicitly specifying the volume with --tmpfs option:

# podman run --tmpfs /run --rm --read-only test-volume touch /run/a

But that in turn makes the container startup unnecessarily verbose, taking away the benefit of having as much as possible information about the container stored in the container image.