macOS: resolve volume source symlinks to fix /tmp mounts

pkg/specgen/volumes.go

@@ -120,6 +120,14 @@ func GenVolumeMounts(volumeFlag []string) (map[string]spec.Mount, map[string]*Na
 			splitVol[0] = src
 		}
 
+		// Resolve symlinks for absolute host paths
+		if filepath.IsAbs(src) {
+			if resolved := ResolveVolumeSourcePath(src); resolved != src {
+				src = resolved
+				splitVol[0] = resolved
+			}
+		}
+
 		if len(splitVol) == 1 {
 			// This is an anonymous named volume. Only thing given
 			// is destination.

pkg/specgen/volumes_darwin.go

@@ -0,0 +1,16 @@
+//go:build darwin
+
+package specgen
+
+import "path/filepath"
+
+// ResolveVolumeSourcePath follows symlinks for absolute host paths so they
+// line up with the actual on-disk location (e.g. /tmp -> /private/tmp).
+// If resolution fails, the original path is returned unchanged.
+func ResolveVolumeSourcePath(src string) string {
+	resolved, err := filepath.EvalSymlinks(src)
+	if err != nil {
+		return src
+	}
+	return resolved
+}

pkg/specgen/volumes_darwin_test.go

@@ -0,0 +1,24 @@
+//go:build darwin
+
+package specgen
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveVolumeSourcePathTmpSymlink(t *testing.T) {
+	dir, err := os.MkdirTemp("/tmp", "podman-vol-")
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		_ = os.RemoveAll(dir)
+	})
+
+	resolved := ResolveVolumeSourcePath(dir)
+	require.NotEmpty(t, resolved)
+	assert.True(t, strings.HasPrefix(resolved, "/private/tmp/"), "resolved path should point at /private/tmp")
+}

pkg/specgen/volumes_other.go

@@ -0,0 +1,8 @@
+//go:build !darwin
+
+package specgen
+
+// ResolveVolumeSourcePath is a no-op on non-macOS platforms.
+func ResolveVolumeSourcePath(src string) string {
+	return src
+}