confd: add support for mounting read-only files in containers

In the container configuration context:

    edit file ntp.conf
    set path /etc/ntp.conf
    set content

The last command opens a text editor where you can paste the contents
of the file.  This is stored base64 encoded in the datastore as well
as in JSON/XML.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

board/common/rootfs/usr/sbin/container

@@ -43,10 +43,10 @@ create()
     fi
 
     #  --syslog --log-level info
-    log "Calling \"podman create --name $name --conmon-pidfile=$pidfn $ro $vol $hostname $entrypoint $env $network $port $args $image $*\""
+    log "Calling \"podman create --name $name --conmon-pidfile=$pidfn $ro $vol $mount $hostname $entrypoint $env $network $port $args $image $*\""
     set -x
     # shellcheck disable=SC2048
-    if podman create --name "$name" --conmon-pidfile="$pidfn" $ro $vol $hostname $entrypoint $env $network $port $args "$image" $*; then
+    if podman create --name "$name" --conmon-pidfile="$pidfn" $ro $vol $mount $hostname $entrypoint $env $network $port $args "$image" $*; then
 	log "Successfully created container $name from $image"
 	rm -f "/run/containers/env/${name}.env"
 	initctl show "container:$name" |grep -q manual:yes || initctl -bq start "container:$name"
@@ -89,6 +89,7 @@ options:
   -h, --help              Show this help text
       --hostname NAME     Set hostname when creating container
       --net NETWORK       Set network(s) when creating container
+  -m, --mount HOST:DEST   Bind mount a read-only file inside a container
   -p, --publish PORT      Publish ports when creating container
                           Syntax: [[ip:][hostPort]:]containerPort[/protocol]
       --read-only         Do not create a writable layer
@@ -141,6 +142,10 @@ while [ "$1" != "" ]; do
 	    shift
 	    hostname="--hostname $1"
 	    ;;
+	-m | --mount)
+	    shift
+	    mount="--mount=$1"
+	    ;;
 	--net)
 	    shift
 	    network="$network --net $1"

package/execd/tmpfiles.conf

@@ -1,4 +1,5 @@
 d  /run/containers/args		0700 - -
+d  /run/containers/files	0700 - -
 d  /var/lib/containers/active	0700 - -
 d  /run/containers/inbox	0700 - -
 d  /run/containers/queue	0700 - -

src/confd/src/infix-containers.c

@@ -65,6 +65,27 @@ static int add(const char *name, struct lyd_node *cif)
 	LYX_LIST_FOR_EACH(lyd_child(cif), node, "volume")
 		fprintf(fp, " -v %s-%s:%s", name, lydx_get_cattr(node, "name"), lydx_get_cattr(node, "dir"));
 
+	LYX_LIST_FOR_EACH(lyd_child(cif), node, "file") {
+		const char *filenm = lydx_get_cattr(node, "name");
+		const char *contdir = "/run/containers/files";
+		char nm[strlen(filenm) + strlen(name) + 32];
+		char buf[256];
+		FILE *pp;
+
+		snprintf(nm, sizeof(nm), "%s/%s-%s", contdir, name, filenm);
+		snprintf(buf, sizeof(buf), "base64 -d > %s", nm);
+		pp = popen(buf, "w");
+		if (pp) {
+			const char *data = lydx_get_cattr(node, "content");
+
+			fputs(data, pp);
+			pclose(pp);
+
+			fprintf(fp, " -m type=bind,source=%s,destination=%s,readonly=true",
+				nm, lydx_get_cattr(node, "path"));
+		}
+	}
+
 	ap = NULL;
 	LYX_LIST_FOR_EACH(lyd_child(cif), node, "env") {
 		if (!ap) {

src/confd/yang/infix-containers@2023-12-14.yang

@@ -193,6 +193,30 @@ module infix-containers {
 	}
       }
 
+      list file {
+        description "Files to mount inside container.";
+        key name;
+
+        leaf name {
+          description "File to store in host's startup-config as binary.
+
+                       Note: will be prefixed with container name globally.";
+          type string;
+        }
+
+        leaf path {
+          description "Path to location inside container to mount file on, e.g., /etc/ntpd.conf";
+          type string {
+            pattern '/.*';
+          }
+        }
+
+        leaf content {
+          description "File contents, in base64 native format (XML/JSON).";
+          type binary;
+        }
+      }
+
       container statistics {
 	description "Statistics of the container";
 	config false;