probe

internal/provider/pod.go

@@ -224,7 +224,7 @@ func (p *p) CreatePod(ctx context.Context, pod *corev1.Pod) error {
 		}
 		if len(bindmountsro) > 0 {
 			romount := strings.Join(bindmountsro, " ")
-			uf = uf.Insert("Service", "BindReadOnlyPaths", romount)
+			uf = uf.Insert("Service", Option("BindReadOnlyPaths"), romount)
 		}
 
 		for _, del := range deleteOptions {

internal/provider/probe.go

@@ -0,0 +1,39 @@
+package provider
+
+// supportedOptions contains a mappnig for supported systemd options. If an option
+// is supported the key name will be returned. Unsupported either return an
+// empty string (really not supported) or an alternative option that's better
+// than nothing at all.
+var supportedOptions = map[string]string{
+	"BindReadOnlyPaths": "BindReadOnlyPaths",
+}
+
+// ProbeSupportedOptions checks it the options in SupportedOptions are
+// supported by the systemd version running on this system. It will emit Info
+// logs for each unsupported option.
+func ProbeSupportedOptions() {
+	for option := range supportedOptions {
+		ok := probe(option)
+		switch option {
+		case "BindReadOnlyPaths":
+			if !ok {
+				supportedOptions[option] = "BindPaths" // drop the RO bit
+			}
+		}
+	}
+}
+
+// probe probes system to see if option is supported.
+func probe(option string) bool {
+	return true
+}
+
+// Option return the option that is supported by the detected systemd.
+func Option(option string) string {
+	opt, ok := supportedOptions[option]
+	if !ok {
+		// not found in map, return option as-is
+		return option
+	}
+	return opt
+}

internal/unit/file.go

@@ -84,7 +84,11 @@ func (u *File) String() string {
 }
 
 // Insert adds name=value to section and returns a newly parsed pointer to File.
+// If name is the empty string this is a noop.
 func (u *File) Insert(section, name string, value ...string) *File {
+	if name == "" {
+		return u
+	}
 	opts := make([]*unit.UnitOption, len(value))
 	for i := range opts {
 		opts[i] = &unit.UnitOption{
@@ -98,7 +102,11 @@ func (u *File) Insert(section, name string, value ...string) *File {
 }
 
 // Overwrite overwrites name=value in the section and returns a new File.
+// If name is the empty string this is a noop.
 func (u *File) Overwrite(section, name string, value ...string) *File {
+	if name == "" {
+		return u
+	}
 	opts := make([]*unit.UnitOption, len(u.Options))
 	j := 0
 	for _, o := range u.Options {