[2360611525] Upstream Reporter: Jonathan Lebon
Upstream issue status: Open
Upstream description:

Starting from systemd v256, systemd units in the initramfs run with `ProtectSystem=` by default. This means that `/usr` is now mounted read-only there:

https://github.com/systemd/systemd/blob/07748c53df5a72111d8b3eef49d275210d6018cd/NEWS#L168-L175

This breaks [`coreos-ignition-setup-user.sh`](https://github.com/coreos/fedora-coreos-config/blob/testing-devel/overlay.d/05core/usr/lib/dracut/modules.d/35coreos-ignition/coreos-ignition-setup-user.sh) which is used in various flows to copy the Ignition config to `/usr/lib/ignition/`.

Let's have Ignition also support sourcing from `/run` and `/etc`, which is standard nowadays for a lot of services. I think `coreos-ignition-setup-user` would probably want to use `/etc` since it's lifecycled with the initramfs, so we don't have to worry about cleaning it up.