machine: ensure disk image is writable before resize (fix read-only image init failure)

pkg/machine/e2e/init_test.go

@@ -3,6 +3,7 @@ package e2e_test
 import (
 	"fmt"
 	"os"
+	"os/exec"
 	"path/filepath"
 	"runtime"
 	"strconv"
@@ -733,6 +734,21 @@ var _ = Describe("podman machine init", func() {
 			Expect(p).To(Equal(l.VMType))
 		}
 	})
+
+	It("init with read-only image should succeed", func() {
+		// Step 1: create temp image
+		img := filepath.Join(GinkgoT().TempDir(), "test.qcow2")
+
+		// Step 2: copy existing image as read-only (use install)
+		exec.Command("install", "-m", "444", mb.imagePath, img).Run()
+
+		// Step 3: run podman machine init
+		i := new(initMachine)
+		session, err := mb.setCmd(i.withImage(img)).run()
+
+		Expect(err).To(BeNil())
+		Expect(session).To(Exit(0))
+	})
 })
 
 var p4Config = []byte(`{

pkg/machine/stdpull/local.go

@@ -1,6 +1,9 @@
 package stdpull
 
 import (
+	"fmt"
+	"os"
+
 	"github.com/containers/podman/v6/pkg/machine/compression"
 	"github.com/containers/podman/v6/pkg/machine/define"
 	"github.com/sirupsen/logrus"
@@ -26,5 +29,14 @@ func (s *StdDiskPull) Get() error {
 		return err
 	}
 	logrus.Debugf("decompressing (if needed) %s to %s", s.inputPath.GetPath(), s.finalPath.GetPath())
-	return compression.Decompress(s.inputPath, s.finalPath.GetPath())
+	if err := compression.Decompress(s.inputPath, s.finalPath.GetPath()); err != nil {
+		return err
+	}
+
+	// Ensure image is writable
+	if err := os.Chmod(s.finalPath.GetPath(), 0600); err != nil {
+		return fmt.Errorf("failed to set permissions on machine image: %w", err)
+	}
+	return nil
+
 }

pkg/machine/stdpull/url.go

@@ -76,7 +76,16 @@ func (d *DiskFromURL) Get() error {
 	}
 
 	logrus.Debugf("decompressing (if needed) %s to %s", d.tempLocation.GetPath(), d.finalPath.GetPath())
-	return compression.Decompress(d.tempLocation, d.finalPath.GetPath())
+	if err := compression.Decompress(d.tempLocation, d.finalPath.GetPath()); err != nil {
+		return err
+	}
+
+	// Ensure image is writable
+	if err := os.Chmod(d.finalPath.GetPath(), 0600); err != nil {
+		return fmt.Errorf("failed to set permissions on pulled image %s: %w", d.finalPath.GetPath(), err)
+	}
+
+	return nil
 }
 
 func (d *DiskFromURL) pull() error {