Skip to content

Commit 6a5b46c

Browse files
committed
test/e2e: fix 'block all syscalls' seccomp for runc
Error messages between runc and crun are not synchronized, and in some case exit codes can be different, too. Commit dd1bcab ("CI: use local registry, part 2 of 3: fix tests") removed the special case handling for runc from the "podman run --seccomp-policy image (block all syscalls)" test case, and so it fails, for example, like this: Error: failed to connect to container's attach socket: /tmp/podman-e2e-2877753109/subtest-1698249469/p/root/overlay-containers/62585e98da7dc3fdb32d3b6de0980c762a8a6cde008ed35c68727fb97f5369c7/userdata/attach: no such file or directory [FAILED] Command exited with status 127 (expected 126) or this: time="2025-08-29T17:16:52-07:00" level=error msg="cannot start a container that has stopped" Error: `/usr/bin/runc start 63ce789f7037d9545cde832d29343704cab842e7288046407d0efa347d5ecb77` failed: exit status 1 [FAILED] Command exited 126 as expected, but did not emit 'OCI runtime error: runc: read from the init process' (depending on runc version, phase of the moon etc.) We can not reasonably expect a specific error message and exit code in such an unusual scenario, but let's try. With this commit, the above test passes successfully on my machine. Tested with: make localintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc make remoteintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc Fixes: dd1bcab ("CI: use local registry, part 2 of 3: fix tests") Reported-by: Yiqiao Pu <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
1 parent 6d0b28a commit 6a5b46c

File tree

1 file changed

+15
-5
lines changed

1 file changed

+15
-5
lines changed

test/e2e/run_seccomp_test.go

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
package integration
44

55
import (
6-
"fmt"
6+
"path"
77

88
. "github.com/containers/podman/v5/test/utils"
99
. "github.com/onsi/ginkgo/v2"
@@ -55,11 +55,21 @@ var _ = Describe("Podman run", func() {
5555
session := podmanTest.Podman([]string{"run", "--seccomp-policy", "image", img, "ls"})
5656
session.WaitWithDefaultTimeout()
5757

58-
expect := fmt.Sprintf("OCI runtime error: %s: read from the init process", podmanTest.OCIRuntime)
59-
if IsRemote() {
60-
expect = fmt.Sprintf("for attach: %s: read from the init process: OCI runtime error", podmanTest.OCIRuntime)
58+
switch path.Base(podmanTest.OCIRuntime) {
59+
case "crun":
60+
// "crun create" fails with "read from the init process" error.
61+
Expect(session).To(ExitWithError(126, "read from the init process"))
62+
case "runc":
63+
// "runc create" succeeds, then...
64+
Expect(session).To(Or(
65+
// either "runc start" fails with "cannot start a container that has stopped",
66+
ExitWithError(126, "cannot start a container that has stopped"),
67+
// or podman itself fails with "failed to connect to container's attach socket".
68+
ExitWithError(127, "failed to connect to container's attach socket"),
69+
))
70+
default:
71+
Expect(session.ExitCode()).To(BeNumerically(">", 0), "Exit status using generic runtime")
6172
}
62-
Expect(session).To(ExitWithError(126, expect))
6373
})
6474

6575
It("podman run --seccomp-policy image (bogus profile)", func() {

0 commit comments

Comments
 (0)