feat: support read-only volume annotations

podman/main.go

@@ -11,9 +11,9 @@ import (
 // Creates a Podman volume of name `name` if it does not exist.
 //
 // If the volume exists, then behaviour depends on `existsOk`:
-// - If `existsOk` is truthy, then the already-exists error is ignored and
-//   nothing is done;
-// - Else, an error is returned.
+//   - If `existsOk` is truthy, then the already-exists error is ignored and
+//     nothing is done;
+//   - Else, an error is returned.
 func CreateVolume(name string, existsOk bool) error {
 	args := []string{"volume", "create", name}
 
@@ -93,6 +93,8 @@ func CreateContainer(definition service_definition.ContainerDefinition, knownVol
 
 	for _, volume := range definition.Volumes {
 		var host string
+		var suffix string
+
 		container := volume.Container
 
 		if volume.Name != "" {
@@ -104,7 +106,11 @@ func CreateContainer(definition service_definition.ContainerDefinition, knownVol
 			log.Fatal("Invalid volume source configuration")
 		}
 
-		arg := []string{"-v", host + ":" + container}
+		if volume.ReadOnly == true {
+			suffix = ":ro"
+		}
+
+		arg := []string{"-v", host + ":" + container + suffix}
 
 		args = append(args, arg...)
 	}

service_definition/main.go

@@ -20,6 +20,7 @@ type VolumeConfiguration struct {
 	Name      string `yaml:"name"`
 	Container string `yaml:"container"`
 	Host      string `yaml:"host"`
+	ReadOnly  bool   `yaml:"readonly"`
 }
 
 type ContainerDefinition struct {