[1.3] ci: fix conmon job - #5409
Open
kolyshkin wants to merge 2 commits into
Open
Conversation
On Ubuntu 24.04 runners, kernel.apparmor_restrict_unprivileged_userns is set to 1, so an unconfined process that creates a user namespace is transitioned to the unprivileged_userns AppArmor profile, which denies CAP_SYS_ADMIN. As a result, rootless runc creates and maps the user namespace fine and then fails to unshare the remaining ones: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF; runc init error(s): nsexec-1: failed to unshare remaining namespaces: Operation not permitted and dmesg shows: apparmor="AUDIT" operation="userns_create" info="Userns create - transitioning profile" profile="unconfined" comm="runc:[1:CHILD]" target="unprivileged_userns" apparmor="DENIED" operation="capable" profile="unprivileged_userns" comm="runc:[1:CHILD]" capability=21 capname="sys_admin" Use the same workaround as in test.yml: load an AppArmor profile for the runc binary being tested. This went unnoticed because the conmon tests skip when the test image can't be pulled, so the job was green whenever the pull failed, and only red when the tests actually ran. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> (cherry picked from commit bde597a)
conmon's test suite skips its container tests when the test image can't be pulled, and reports the run as successful, so the conmon job here was green whenever the pull failed and red only when the tests actually ran. Bump to conmon main, which contains containers/conmon#668 turning that into a hard failure, so that this job tests what it is supposed to test. To be replaced with a conmon tag once one is released (> v2.2.1). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> (cherry picked from commit 2048d84)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #5401 to release-1.3. Original description follows.
Fixes #5399.
The validate / conmon job was mostly passing only because it failed
to pull an image (due to running a big number of parallel pulls I guess)
and skipped the test. This is being fixed in
containers/conmon#668).
Recently the pull started to succeed sometimes, which resulted in
test being actually run, and fail due to nested userns restriction
in Ubuntu, and the missing fixup for that.
This PR adds the fixup, and uses a fixed conmon tests from
containers/conmon#668.