-
Notifications
You must be signed in to change notification settings - Fork 2.8k
test/e2e: fix 'block all syscalls' seccomp for runc #26934
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
It's missing the https://openqa.opensuse.org/tests/5277949/file/podman_e2e-remoteintegration.txt
|
@ricardobranco777 thanks! Can you please test the updated patch? |
Error messages between runc and crun are not synchronized, and in some case exit codes can be different, too. Commit dd1bcab ("CI: use local registry, part 2 of 3: fix tests") removed the special case handling for runc from the "podman run --seccomp-policy image (block all syscalls)" test case, and so it fails, for example, like this: Error: failed to connect to container's attach socket: /tmp/podman-e2e-2877753109/subtest-1698249469/p/root/overlay-containers/62585e98da7dc3fdb32d3b6de0980c762a8a6cde008ed35c68727fb97f5369c7/userdata/attach: no such file or directory [FAILED] Command exited with status 127 (expected 126) or this: time="2025-08-29T17:16:52-07:00" level=error msg="cannot start a container that has stopped" Error: `/usr/bin/runc start 63ce789f7037d9545cde832d29343704cab842e7288046407d0efa347d5ecb77` failed: exit status 1 [FAILED] Command exited 126 as expected, but did not emit 'OCI runtime error: runc: read from the init process' (depending on runc version, phase of the moon etc.) We can not reasonably expect a specific error message and exit code in such an unusual scenario, but let's try. With this commit, the above test passes successfully on my machine. Tested with: make localintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc make remoteintegration FOCUS="block all syscalls" OCI_RUNTIME=/usr/local/bin/runc While at it, simplify the error message check for crun (we don't have to check for the entire message, [the same] substring is fine for both local and remote cases). Fixes: dd1bcab ("CI: use local registry, part 2 of 3: fix tests") Reported-by: Yiqiao Pu <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore. |
Now it works. Thanks! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM again, @containers/podman-maintainers PTAL
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kolyshkin, Luap99 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
It still may somestimes fail because https://openqa.opensuse.org/tests/5284084/file/podman_e2e-remoteintegration.txt
|
@ricardobranco777 do you want us to hold merging this then ? |
Yes because it fails sometimes. |
Frankly I don't understand. The log clearly shows the message:
The issue might be that the message is printed on stdout not stderr. I have checked it is not the case:
Will keep digging. |
@kolyshkin I think the problem is that this is in the remote test, the stdout/err of the runtime is attach to the server process not the podman-remote run process. As such this is not getting captured on the right process. I think this is why we need the IsRemote() there. |
Error messages between runc and crun are not synchronized, and in some case exit codes can be different, too.
Commit dd1bcab ("CI: use local registry, part 2 of 3: fix tests") removed the special case handling for runc from the "podman run --seccomp-policy image (block all syscalls)" test case, and so it fails, for example, like this:
or this:
(depending on runc version, phase of the moon etc.)
We can not reasonably expect a specific error message and exit code in such an unusual scenario, but let's try.
With this commit, the above test passes successfully on my machine.
Fixes: dd1bcab ("CI: use local registry, part 2 of 3: fix tests")
Reported-by: Yiqiao Pu [email protected]
Does this PR introduce a user-facing change?