From a0a79d5a36ad1f97e0041eb0ba7097bf9416aab6 Mon Sep 17 00:00:00 2001 From: Samuel K Date: Mon, 7 Sep 2026 18:13:36 +0000 Subject: [PATCH] ci: stabilize Linux Podman E2E setup Extract Podman CI setup from PR #1179: - Pin Podman E2E matrix runners to ubuntu-24.04 in .github/workflows/pr-ci.yml - Add hack/ci/setup-podman-linux.sh to manage rootless and rootful runtime configuration, crun enforcement, and AppArmor profiles --- .github/workflows/pr-ci.yml | 39 +++++++--------- hack/ci/setup-podman-linux.sh | 84 +++++++++++++++++++++++++++++++++++ 2 files changed, 99 insertions(+), 24 deletions(-) create mode 100755 hack/ci/setup-podman-linux.sh diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml index 4c682d64f..1d85e1f01 100644 --- a/.github/workflows/pr-ci.yml +++ b/.github/workflows/pr-ci.yml @@ -423,7 +423,7 @@ jobs: requires-secret: false - label: up-provider-podman-rootless-basic - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -433,7 +433,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootless-exec - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -443,7 +443,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootless-lifecycle - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -453,7 +453,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootless-config - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -463,7 +463,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootless-features - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -473,7 +473,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootful-basic - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -483,7 +483,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootful-lifecycle - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -493,7 +493,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootful-lifecycle-2 - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -503,7 +503,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootful-config - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -513,7 +513,7 @@ jobs: flake-attempts: 2 - label: up-provider-podman-rootful-features - runner: ubuntu-latest + runner: ubuntu-24.04 free-disk-space: false install-kind: false requires-secret: false @@ -781,26 +781,17 @@ jobs: command -v newuidmap >/dev/null || sudo apt-get install -y uidmap - - name: Install Podman (Linux rootless) + - name: Install Podman (Linux) if: matrix.install-podman == 'rootless' && runner.os == 'Linux' + shell: bash run: | - podman info - podman run --rm busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d echo "podman runtime preflight OK" + ./hack/ci/setup-podman-linux.sh rootless - name: Install Podman (Linux rootful) if: matrix.install-podman == 'rootful' && runner.os == 'Linux' + shell: bash run: | - sudo systemctl daemon-reload - sudo systemctl enable --now podman.socket - if ! timeout 30 bash -c 'until sudo podman --remote --url unix:///run/podman/podman.sock info >/dev/null 2>&1; do sleep 1; done'; then - echo "::error::podman service did not become ready within 30s" - sudo systemctl status podman.socket --no-pager || true - sudo journalctl -u podman.socket --no-pager -n 100 || true - exit 1 - fi - echo "DOCKER_HOST=unix:///run/podman/podman.sock" >> "$GITHUB_ENV" - sudo podman --remote --url unix:///run/podman/podman.sock info - sudo podman run --rm busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d echo "podman runtime preflight OK" + ./hack/ci/setup-podman-linux.sh rootful - name: get microsandbox latest version if: matrix.install-microsandbox == true && runner.os == 'Linux' diff --git a/hack/ci/setup-podman-linux.sh b/hack/ci/setup-podman-linux.sh new file mode 100755 index 000000000..acfbb4b33 --- /dev/null +++ b/hack/ci/setup-podman-linux.sh @@ -0,0 +1,84 @@ +#!/usr/bin/env bash + +set -euo pipefail + +mode="${1:-}" +if [[ "$mode" != "rootless" && "$mode" != "rootful" ]]; then + echo "::error::usage: $0 " + exit 2 +fi + +export PATH="/usr/local/bin:$PATH" + +if [[ ! -x /usr/local/bin/podman ]]; then + echo "::error::Expected Podman at /usr/local/bin/podman" + exit 1 +fi +if [[ ! -x /usr/local/bin/crun ]]; then + echo "::error::Expected bundled crun at /usr/local/bin/crun" + exit 1 +fi + +sudo mkdir -p /etc/containers/containers.conf.d +sudo tee /etc/containers/containers.conf.d/99-devsy-ci.conf >/dev/null <<'EOF' +[engine] +runtime = "crun" + +[engine.runtimes] +crun = ["/usr/local/bin/crun"] +EOF + +if [[ -f /etc/apparmor.d/podman ]]; then + sudo sed -Ei \ + 's!^profile podman /usr/bin/podman !profile podman /usr/{bin,local/bin}/podman !' \ + /etc/apparmor.d/podman + sudo apparmor_parser -r /etc/apparmor.d/podman +fi + +echo "Podman executable: $(command -v podman)" +podman --version +/usr/local/bin/crun --version +cat /etc/os-release +uname -a + +if [[ "$mode" == "rootful" ]]; then + sudo systemctl daemon-reload + sudo systemctl enable --now podman.socket + if ! timeout 30 bash -c \ + 'until sudo podman --remote --url unix:///run/podman/podman.sock info >/dev/null 2>&1; do sleep 1; done'; then + echo "::error::podman service did not become ready within 30s" + sudo systemctl status podman.socket --no-pager || true + sudo systemctl status podman.service --no-pager || true + sudo journalctl -u podman.socket --no-pager -n 100 || true + sudo journalctl -u podman.service --no-pager -n 100 || true + exit 1 + fi + + runtime_path="$( + sudo podman --remote --url unix:///run/podman/podman.sock \ + info --format '{{.Host.OCIRuntime.Path}}' + )" + echo "Podman OCI runtime: $runtime_path" + if [[ "$runtime_path" != "/usr/local/bin/crun" ]]; then + echo "::error::Unexpected Podman OCI runtime: $runtime_path" + exit 1 + fi + + echo "DOCKER_HOST=unix:///run/podman/podman.sock" >>"$GITHUB_ENV" + sudo podman --remote --url unix:///run/podman/podman.sock info + sudo podman --remote --url unix:///run/podman/podman.sock run --rm \ + busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d \ + true +else + runtime_path="$(podman info --format '{{.Host.OCIRuntime.Path}}')" + echo "Podman OCI runtime: $runtime_path" + if [[ "$runtime_path" != "/usr/local/bin/crun" ]]; then + echo "::error::Unexpected Podman OCI runtime: $runtime_path" + exit 1 + fi + + podman info + podman run --rm \ + busybox@sha256:fd8d9aa63ba2f0982b5304e1ee8d3b90a210bc1ffb5314d980eb6962f1a9715d \ + true +fi