README: update to show that config.{toml,yaml} can be read-only

As suggested by Charlie Drage (thank you!) this commit makes the
mounting of the `config.{toml,yaml}` read-only via the `:ro`
suffix.

The tests are also updated to validate that this works as expected.

Closes: #533

README.md

@@ -51,7 +51,7 @@ sudo podman run \
     --privileged \
     --pull=newer \
     --security-opt label=type:unconfined_t \
-    -v $(pwd)/config.toml:/config.toml \
+    -v $(pwd)/config.toml:/config.toml:ro \
     -v $(pwd)/output:/output \
     -v /var/lib/containers/storage:/var/lib/containers/storage \
     quay.io/centos-bootc/bootc-image-builder:latest \
@@ -288,7 +288,7 @@ sudo podman run \
     --privileged \
     --pull=newer \
     --security-opt label=type:unconfined_t \
-    -v $(pwd)/config.toml:/config.toml \
+    -v $(pwd)/config.toml:/config.toml:ro \
     -v $(pwd)/output:/output \
     quay.io/centos-bootc/bootc-image-builder:latest \
     --type qcow2 \

test/test_manifest.py

@@ -236,7 +236,7 @@ def test_manifest_user_customizations_toml(tmp_path, build_container):
         "podman", "run", "--rm",
         "--privileged",
         "-v", "/var/lib/containers/storage:/var/lib/containers/storage",
-        "-v", f"{config_toml_path}:/config.toml",
+        "-v", f"{config_toml_path}:/config.toml:ro",
         "--security-opt", "label=type:unconfined_t",
         "--entrypoint=/usr/bin/bootc-image-builder",
         build_container,
@@ -266,7 +266,7 @@ def test_manifest_installer_customizations(tmp_path, build_container):
         "podman", "run", "--rm",
         "--privileged",
         "-v", "/var/lib/containers/storage:/var/lib/containers/storage",
-        "-v", f"{config_toml_path}:/config.toml",
+        "-v", f"{config_toml_path}:/config.toml:ro",
         "--security-opt", "label=type:unconfined_t",
         "--entrypoint=/usr/bin/bootc-image-builder",
         build_container,