From 3b4da95c8f59d31a466c9576720f1176b7265336 Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Thu, 27 Aug 2026 15:54:29 +0200 Subject: [PATCH 1/2] ci(e2e): add fedora rootful podman lane Signed-off-by: Evan Lezar --- .agents/skills/test-release-canary/SKILL.md | 37 +++++++- .github/workflows/branch-e2e.yml | 70 ++++++++++++++- .github/workflows/release-canary.yml | 86 +++++++------------ TESTING.md | 6 ++ e2e/configs/gateway/podman-rootful.toml | 29 +++++++ e2e/run.sh | 47 ++++++++-- nix/test-guest/README.md | 20 +++-- nix/test-guest/cache.sh | 2 +- .../configuration/podman-rootful.yml | 52 +++++++++++ nix/test-guest/default.nix | 1 + nix/test-guest/run.sh | 2 +- tasks/test.toml | 4 + 12 files changed, 278 insertions(+), 78 deletions(-) create mode 100644 e2e/configs/gateway/podman-rootful.toml create mode 100644 nix/test-guest/configuration/podman-rootful.yml diff --git a/.agents/skills/test-release-canary/SKILL.md b/.agents/skills/test-release-canary/SKILL.md index 5e8bbf394c..ad000d25be 100644 --- a/.agents/skills/test-release-canary/SKILL.md +++ b/.agents/skills/test-release-canary/SKILL.md @@ -13,7 +13,7 @@ The Release Canary (`.github/workflows/release-canary.yml`) smoke-tests the arti |---|---|---| | `macos` | `macos-latest-xlarge` | `install.sh` resolves the Homebrew formula, brew installs the cask, and `openshell status` reaches the brew-services–backed local gateway with the VM driver. | | `ubuntu` | `ubuntu-latest` | `install.sh` installs the Debian package, the post-install systemd user service starts, and `openshell status` reaches the local gateway with the Docker driver. | -| `fedora` | `fedora:latest` container | `install.sh` installs the RPM packages, the local gateway starts under Podman, and `openshell status` succeeds. | +| `fedora` | `linux-amd64-cpu8` + Fedora Nix VM | `install.sh` installs the RPM packages, the root-owned local gateway starts with rootful Podman, and `openshell status` succeeds. | | `kubernetes` | `ubuntu-latest` + kind | `helm install oci://ghcr.io/nvidia/openshell/helm-chart --version 0.0.0-dev` succeeds in a kind cluster, the gateway pod becomes Ready, port-forward exposes 8080, and the released CLI registers the in-cluster gateway and runs `openshell status` against it. | All canary jobs disable anonymous OpenShell telemetry. Host package jobs inject @@ -116,6 +116,41 @@ Swap `0.0.0-dev` for `0.0.0-dev.` to pin to a specific dev build. Tear down Loopback registration auto-derives the gateway name to `openshell` if `--name` is omitted, which collides with the `install.sh`-installed local gateway — always pass `--name kind` (or another distinct name) when registering in addition to a local install. +## Local Fedora reproduction + +The `fedora` job uses the repository's Nix test-guest harness instead of +running Fedora inside Docker. It can be reproduced on a Linux host with Nix, +KVM, and the repository checkout: + +```shell +export INSTALL_SH_URL="https://raw.githubusercontent.com/NVIDIA/OpenShell/$(git rev-parse HEAD)/install.sh" +nix run .#test-guest -- \ + --distro fedora \ + --with podman-rootful \ + -- \ + sudo env \ + SUDO_USER=root \ + HOME=/root \ + XDG_RUNTIME_DIR=/run/user/0 \ + DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0/bus \ + OPENSHELL_TELEMETRY_ENABLED=false \ + INSTALL_SH_URL="$INSTALL_SH_URL" \ + bash -s <<'EOF' +set -euo pipefail +mkdir -p "${XDG_RUNTIME_DIR}" +chmod 700 "${XDG_RUNTIME_DIR}" +systemctl start user-runtime-dir@0.service || true +systemctl start user@0.service +systemctl --user daemon-reload +mkdir -p "${HOME}/.config/openshell" +printf 'OPENSHELL_DRIVERS=podman\nOPENSHELL_PODMAN_SOCKET=/run/podman/podman.sock\nOPENSHELL_TELEMETRY_ENABLED=%s\n' \ + "$OPENSHELL_TELEMETRY_ENABLED" > "${HOME}/.config/openshell/gateway.env" +podman --url unix:///run/podman/podman.sock info +curl -LsSf "${INSTALL_SH_URL}" | sh +openshell status +EOF +``` + ## Diagnosing failures | Symptom | Likely cause | Where to look | diff --git a/.github/workflows/branch-e2e.yml b/.github/workflows/branch-e2e.yml index 419dc011cb..77e90bfead 100644 --- a/.github/workflows/branch-e2e.yml +++ b/.github/workflows/branch-e2e.yml @@ -244,6 +244,74 @@ jobs: contents: read packages: read uses: ./.github/workflows/e2e-podman-test.yml + + podman-fedora-rootful-e2e: + name: E2E (rust-podman-rootful, Fedora Nix VM) + needs: [pr_metadata, build-cli, build-gateway, build-sandbox] + if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true' + permissions: + actions: read + contents: read + packages: read + runs-on: ubuntu-26.04 + timeout-minutes: 60 + env: + MISE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: ./.github/actions/setup-e2e-cli + + - uses: ./.github/actions/setup-e2e-gateway + + - uses: ./.github/actions/setup-e2e-sandbox + + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1 + with: + github_access_token: ${{ secrets.GITHUB_TOKEN }} + + - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 + with: + name: openshell + + - name: Install mise + run: | + curl https://mise.run | MISE_VERSION=v2026.4.25 sh + echo "$HOME/.local/bin" >> "$GITHUB_PATH" + echo "$HOME/.local/share/mise/shims" >> "$GITHUB_PATH" + + - name: Install tools + run: mise install --locked + + - name: Install system dependencies + run: | + sudo apt-get update + sudo apt-get install -y --no-install-recommends \ + build-essential \ + clang \ + cmake \ + libclang-dev \ + libssl-dev \ + libz3-dev \ + openssh-client \ + pkg-config + + - name: Run Fedora rootful Podman E2E + run: | + set -euo pipefail + + mise x -- e2e/run.sh \ + --vm fedora \ + --with podman-rootful \ + --guest-gateway-user root \ + --cli-bin "$OPENSHELL_BIN" \ + --gateway-bin "$OPENSHELL_GATEWAY_BIN" \ + --sandbox-bin "$OPENSHELL_SANDBOX_BIN" \ + --gateway-config e2e/configs/gateway/podman-rootful.toml \ + --features e2e-podman \ + --suite sandbox_lifecycle vm-e2e: needs: [pr_metadata, build-cli, build-gateway, build-vm-driver] if: needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true' @@ -394,7 +462,7 @@ jobs: core-e2e-result: name: Core E2E result - needs: [pr_metadata, docker-e2e, podman-e2e, vm-e2e, docker-external-driver-e2e, vm-external-driver-e2e, kubernetes-e2e, kubernetes-external-driver-e2e, kubernetes-workspace-managed-e2e, kubernetes-workspace-operator-e2e] + needs: [pr_metadata, docker-e2e, podman-e2e, podman-fedora-rootful-e2e, vm-e2e, docker-external-driver-e2e, vm-external-driver-e2e, kubernetes-e2e, kubernetes-external-driver-e2e, kubernetes-workspace-managed-e2e, kubernetes-workspace-operator-e2e] if: always() && needs.pr_metadata.outputs.should_run == 'true' && needs.pr_metadata.outputs.run_core_e2e == 'true' runs-on: ubuntu-latest steps: diff --git a/.github/workflows/release-canary.yml b/.github/workflows/release-canary.yml index 937e774db7..1507e41e4a 100644 --- a/.github/workflows/release-canary.yml +++ b/.github/workflows/release-canary.yml @@ -61,53 +61,43 @@ jobs: name: Fedora RPM if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }} runs-on: linux-amd64-cpu8 - timeout-minutes: 20 + timeout-minutes: 30 env: - FEDORA_CANARY_CONTAINER: openshell-fedora-canary-${{ github.run_id }}-${{ github.run_attempt }} + INSTALL_SH_URL: https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh steps: - - name: Start Fedora systemd container and root user manager - run: | - set -euo pipefail + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - docker run --detach \ - --name "${FEDORA_CANARY_CONTAINER}" \ - --privileged \ - --cgroupns=host \ - --tmpfs /run \ - --tmpfs /tmp \ - --volume /sys/fs/cgroup:/sys/fs/cgroup:rw \ - fedora:latest \ - bash -lc 'dnf install -y curl dbus-daemon podman systemd && exec /usr/sbin/init' - - for _ in $(seq 1 120); do - if docker exec "${FEDORA_CANARY_CONTAINER}" systemctl list-units --no-pager >/dev/null 2>&1; then - break - fi - if [ "$(docker inspect -f '{{.State.Running}}' "${FEDORA_CANARY_CONTAINER}")" != "true" ]; then - echo "::error::Fedora systemd container exited before systemd became reachable" - docker logs "${FEDORA_CANARY_CONTAINER}" >&2 || true - exit 1 - fi - sleep 1 - done + - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1 + with: + github_access_token: ${{ secrets.GITHUB_TOKEN }} - if ! docker exec "${FEDORA_CANARY_CONTAINER}" systemctl list-units --no-pager >/dev/null 2>&1; then - echo "::error::Fedora systemd container did not become reachable within 120s" - docker logs "${FEDORA_CANARY_CONTAINER}" >&2 || true - exit 1 - fi + - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 + with: + name: openshell + + - name: Install RPM in Fedora rootful Podman VM and check status + run: | + set -euo pipefail - docker exec --interactive "${FEDORA_CANARY_CONTAINER}" env \ + nix run .#test-guest -- \ + --distro fedora \ + --with podman-rootful \ + -- \ + sudo env \ + SUDO_USER=root \ HOME=/root \ XDG_RUNTIME_DIR=/run/user/0 \ DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0/bus \ + OPENSHELL_TELEMETRY_ENABLED="$OPENSHELL_TELEMETRY_ENABLED" \ + INSTALL_SH_URL="$INSTALL_SH_URL" \ bash -s <<'EOF' set -euo pipefail - # install.sh manages the RPM gateway as a systemd user unit. This - # container is booted with systemd as PID 1, but it still has no - # login session. Start root's user manager explicitly so the - # installer can test service restart and gateway registration - # instead of its "restart later" fallback. + + # install.sh manages the RPM gateway as a systemd user unit. Start + # root's user manager explicitly so the canary exercises the rootful + # service path on a real Fedora VM. mkdir -p "${XDG_RUNTIME_DIR}" chmod 700 "${XDG_RUNTIME_DIR}" systemctl start user-runtime-dir@0.service || true @@ -125,33 +115,15 @@ jobs: systemctl --user status --no-pager >&2 || true exit 1 fi - EOF - - - name: Install and check status - run: | - set -euo pipefail - docker exec --interactive "${FEDORA_CANARY_CONTAINER}" env \ - HOME=/root \ - XDG_RUNTIME_DIR=/run/user/0 \ - DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/0/bus \ - OPENSHELL_TELEMETRY_ENABLED="$OPENSHELL_TELEMETRY_ENABLED" \ - INSTALL_SH_URL="https://raw.githubusercontent.com/NVIDIA/OpenShell/${{ github.event.workflow_run.head_sha || github.sha }}/install.sh" \ - bash -s <<'EOF' - set -euo pipefail mkdir -p "${HOME}/.config/openshell" - printf 'OPENSHELL_DRIVERS=podman\nOPENSHELL_TELEMETRY_ENABLED=%s\n' \ + printf 'OPENSHELL_DRIVERS=podman\nOPENSHELL_PODMAN_SOCKET=/run/podman/podman.sock\nOPENSHELL_TELEMETRY_ENABLED=%s\n' \ "$OPENSHELL_TELEMETRY_ENABLED" > "${HOME}/.config/openshell/gateway.env" - podman info + podman --url unix:///run/podman/podman.sock info curl -LsSf "${INSTALL_SH_URL}" | sh openshell status EOF - - name: Stop Fedora systemd container - if: always() - run: | - docker rm -f "${FEDORA_CANARY_CONTAINER}" >/dev/null 2>&1 || true - ubuntu-snap: name: Ubuntu Snap if: ${{ github.event.workflow_run.conclusion == 'success' }} diff --git a/TESTING.md b/TESTING.md index 94e457d6ba..3643ca7d22 100644 --- a/TESTING.md +++ b/TESTING.md @@ -181,6 +181,12 @@ Run the rootless Podman suite in an Ubuntu 26.04 Nix test guest: mise run e2e:podman:rootless ``` +Run the focused rootful Podman suite in a Fedora Nix test guest: + +```shell +mise run e2e:podman:fedora-rootful +``` + Run the VM-backed Rust CLI e2e suite: ```shell diff --git a/e2e/configs/gateway/podman-rootful.toml b/e2e/configs/gateway/podman-rootful.toml new file mode 100644 index 0000000000..57bf093ed0 --- /dev/null +++ b/e2e/configs/gateway/podman-rootful.toml @@ -0,0 +1,29 @@ +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +[openshell] +version = 1 + +[openshell.gateway] +bind_address = "127.0.0.1:8080" +log_level = "info" +compute_drivers = ["podman"] +disable_tls = true + +[openshell.gateway.auth] +allow_unauthenticated_users = true + +[openshell.gateway.gateway_jwt] +signing_key_path = ".cache/openshell-e2e/gateway-jwt/signing.pem" +public_key_path = ".cache/openshell-e2e/gateway-jwt/public.pem" +kid_path = ".cache/openshell-e2e/gateway-jwt/kid" +gateway_id = "openshell-e2e" +ttl_secs = 0 + +[openshell.drivers.podman] +socket_path = "/run/podman/podman.sock" +default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest" +image_pull_policy = "missing" +network_name = "openshell-e2e" +grpc_endpoint = "http://host.containers.internal:8080" +supervisor_image = "localhost/openshell/supervisor:e2e-vm" diff --git a/e2e/run.sh b/e2e/run.sh index bf364f6176..bba07e3e8b 100755 --- a/e2e/run.sh +++ b/e2e/run.sh @@ -30,6 +30,8 @@ Options: --cli-bin PATH Use a prebuilt openshell CLI instead of building it --gateway-bin PATH Use a prebuilt openshell-gateway instead of building it --sandbox-bin PATH Use a prebuilt openshell-sandbox instead of building it + --guest-gateway-user USER + Run the VM guest gateway as USER (openshell or root) --gateway-config PATH Fully resolved gateway TOML --features FEATURES Rust e2e feature set to enable (default: e2e) @@ -103,6 +105,7 @@ gateway_config= gateway_bin= cli_bin= sandbox_bin= +guest_gateway_user=openshell e2e_features=e2e suite_name= tests_in_vm=0 @@ -139,6 +142,11 @@ while [ "$#" -gt 0 ]; do sandbox_bin="$(resolve_file "$2")" || die "--sandbox-bin does not name a file: $2" shift 2 ;; + --guest-gateway-user) + require_value "$1" "$#" "${2:-}" + guest_gateway_user=$2 + shift 2 + ;; --gateway-config) require_value "$1" "$#" "${2:-}" gateway_config=$2 @@ -184,6 +192,10 @@ print(tomllib.load(open(sys.argv[1], "rb"))["openshell"]["gateway"]["compute_dri if [ -z "${e2e_features}" ]; then die "--features must not be empty" fi +case "${guest_gateway_user}" in +openshell | root) ;; +*) die "--guest-gateway-user must be 'openshell' or 'root'" ;; +esac if [ -n "${suite_name}" ]; then if [[ ! ${suite_name} =~ ^[a-z0-9][a-z0-9_-]*$ ]]; then die "suite name must contain only lowercase letters, digits, underscores, and hyphens: ${suite_name}" @@ -534,6 +546,7 @@ gateway_endpoint="http://127.0.0.1:${host_port}" export OPENSHELL_GATEWAY_ENDPOINT="${gateway_endpoint}" export OPENSHELL_GATEWAY="${gateway_name}" export OPENSHELL_BIN="${cli_bin}" +export OPENSHELL_E2E_DRIVER="${gateway_driver}" if [ "${mode}" = host ]; then case "${gateway_driver}" in @@ -627,10 +640,17 @@ docker) "${supervisor_image}" >/dev/null ;; podman) - podman --url "unix:///run/user/\$(id -u)/podman/podman.sock" import \ - --change 'ENTRYPOINT ["/openshell-sandbox"]' \ - "${guest_supervisor_archive_path}" \ - "${supervisor_image}" >/dev/null + if [ '${guest_gateway_user}' = root ]; then + sudo podman --url unix:///run/podman/podman.sock import \ + --change 'ENTRYPOINT ["/openshell-sandbox"]' \ + "${guest_supervisor_archive_path}" \ + "${supervisor_image}" >/dev/null + else + podman --url "unix:///run/user/\$(id -u)/podman/podman.sock" import \ + --change 'ENTRYPOINT ["/openshell-sandbox"]' \ + "${guest_supervisor_archive_path}" \ + "${supervisor_image}" >/dev/null + fi ;; esac report_timing "${gateway_driver} supervisor import" "\${phase_started_at}" @@ -800,11 +820,22 @@ PY exit 0 fi -exec /usr/local/bin/openshell-gateway \ - --config "\${config_path}" \ - --bind-address 127.0.0.1 \ - --port ${guest_port} \ +gateway_args=( + /usr/local/bin/openshell-gateway + --config "\${config_path}" + --bind-address 127.0.0.1 + --port ${guest_port} --disable-tls +) +if [ '${guest_gateway_user}' = root ]; then + exec sudo env \ + XDG_CONFIG_HOME="\${XDG_CONFIG_HOME}" \ + XDG_CACHE_HOME="\${XDG_CACHE_HOME}" \ + XDG_DATA_HOME="\${XDG_DATA_HOME}" \ + XDG_STATE_HOME="\${XDG_STATE_HOME}" \ + "\${gateway_args[@]}" +fi +exec "\${gateway_args[@]}" EOF chmod 0755 "${guest_launcher}" diff --git a/nix/test-guest/README.md b/nix/test-guest/README.md index a65baf02a3..418b50b349 100644 --- a/nix/test-guest/README.md +++ b/nix/test-guest/README.md @@ -40,6 +40,7 @@ nix/test-guest/ │ └── rocky.nix └── configuration/ ├── docker.yml + ├── podman-rootful.yml ├── podman-rootless.yml ├── podman.yml └── selinux.yml @@ -58,13 +59,13 @@ The root [`flake.nix`](../../flake.nix) exposes this directory as the `test-gues ## Supported configurations -| Distro | Docker | Podman | Rootless Podman | SELinux | Package format | -| --- | --- | --- | --- | --- | --- | -| Ubuntu 24.04 | Yes | Yes | No | No | `.deb` | -| Ubuntu 26.04 | Yes | Yes | Yes | No | `.deb` | -| CentOS Stream 10 | No | Yes | No | Yes | `.rpm` | -| Fedora 44 | No | Yes | No | Yes | `.rpm` | -| Rocky Linux 9 | Yes | Yes | No | Yes | `.rpm` | +| Distro | Docker | Podman | Rootful Podman | Rootless Podman | SELinux | Package format | +| --- | --- | --- | --- | --- | --- | --- | +| Ubuntu 24.04 | Yes | Yes | No | No | No | `.deb` | +| Ubuntu 26.04 | Yes | Yes | No | Yes | No | `.deb` | +| CentOS Stream 10 | No | Yes | Yes | No | Yes | `.rpm` | +| Fedora 44 | No | Yes | Yes | No | Yes | `.rpm` | +| Rocky Linux 9 | Yes | Yes | Yes | No | Yes | `.rpm` | The `snapd` configuration is available for Ubuntu and prepares snapd for local Snap lifecycle experiments. It does not install Docker, because the Snap @@ -102,6 +103,7 @@ Other combinations use the same interface: nix run .#test-guest -- --distro rocky --with docker nix run .#test-guest -- --distro centos --with podman nix run .#test-guest -- --distro fedora --with podman +nix run .#test-guest -- --distro fedora --with podman-rootful nix run .#test-guest -- --distro ubuntu-26-04 --with podman-rootless ``` @@ -189,7 +191,7 @@ Cache command options: ```text --distro NAME Base distro: ubuntu-24-04, ubuntu-26-04, centos, fedora, or rocky ---with NAME Apply docker, podman, or selinux; repeatable +--with NAME Apply docker, podman, podman-rootful, podman-rootless, or selinux; repeatable --repository REF OCI repository without a tag --digest DIGEST Trusted OCI manifest digest required for pulls --cache-dir PATH Override the local prepared-disk cache directory @@ -264,7 +266,7 @@ The destination must be an absolute guest path. Copied files are installed with ```text --distro NAME Base distro: ubuntu-24-04, ubuntu-26-04, centos, fedora, or rocky ---with NAME Apply docker, podman, or selinux; repeatable +--with NAME Apply docker, podman, podman-rootful, podman-rootless, or selinux; repeatable --install PATH Install a .deb or .rpm package; repeatable --copy SRC:DEST Copy a regular file into the guest, preserving its host mode; repeatable diff --git a/nix/test-guest/cache.sh b/nix/test-guest/cache.sh index 35e3ac441c..f229143e47 100644 --- a/nix/test-guest/cache.sh +++ b/nix/test-guest/cache.sh @@ -13,7 +13,7 @@ Usage: Options: --distro NAME Base distro: ubuntu-24-04, ubuntu-26-04, centos, fedora, or rocky - --with NAME Apply a configuration; repeatable (docker, podman, podman-rootless, selinux) + --with NAME Apply a configuration; repeatable (docker, podman, podman-rootful, podman-rootless, selinux) --repository REF OCI repository without a tag --digest DIGEST Trusted OCI manifest digest required for pulls --cache-dir PATH Override the local prepared-disk cache directory diff --git a/nix/test-guest/configuration/podman-rootful.yml b/nix/test-guest/configuration/podman-rootful.yml new file mode 100644 index 0000000000..9947635f1a --- /dev/null +++ b/nix/test-guest/configuration/podman-rootful.yml @@ -0,0 +1,52 @@ +--- +# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. +# SPDX-License-Identifier: Apache-2.0 + +# PROTOTYPE: Configure rootful Podman in a disposable test guest. + +- name: Configure rootful Podman + hosts: test_vm + become: true + gather_facts: true + + tasks: + - name: Validate rootful Podman support + ansible.builtin.assert: + that: + - ansible_facts.distribution in ["CentOS", "Fedora", "Rocky"] + fail_msg: >- + Rootful Podman guest coverage is supported on RPM-family guests, not + {{ ansible_facts.distribution }}. + + - name: Install rootful Podman + ansible.builtin.package: + name: podman + state: present + + - name: Enable the rootful Podman API socket + ansible.builtin.systemd_service: + name: podman.socket + enabled: true + state: started + + - name: Verify rootful Podman + ansible.builtin.command: + argv: + - podman + - --url + - unix:///run/podman/podman.sock + - info + changed_when: false + + - name: Verify rootful Podman mode + ansible.builtin.command: + argv: + - podman + - --url + - unix:///run/podman/podman.sock + - info + - --format + - "{% raw %}{{.Host.Security.Rootless}}{% endraw %}" + changed_when: false + register: podman_rootless + failed_when: podman_rootless.stdout != "false" diff --git a/nix/test-guest/default.nix b/nix/test-guest/default.nix index b2249e1f4e..a95901f733 100644 --- a/nix/test-guest/default.nix +++ b/nix/test-guest/default.nix @@ -28,6 +28,7 @@ let configurations = { docker = ./configuration/docker.yml; podman = ./configuration/podman.yml; + podman-rootful = ./configuration/podman-rootful.yml; podman-rootless = ./configuration/podman-rootless.yml; selinux = ./configuration/selinux.yml; snapd = ./configuration/snapd.yml; diff --git a/nix/test-guest/run.sh b/nix/test-guest/run.sh index 9e5d19baef..3bc954bf83 100644 --- a/nix/test-guest/run.sh +++ b/nix/test-guest/run.sh @@ -13,7 +13,7 @@ Usage: Options: --distro NAME Base distro: ubuntu-24-04, ubuntu-26-04, centos, fedora, or rocky - --with NAME Apply a configuration; repeatable (docker, podman, podman-rootless, selinux, snapd) + --with NAME Apply a configuration; repeatable (docker, podman, podman-rootful, podman-rootless, selinux, snapd) --install PATH Install a .deb or .rpm package; repeatable --copy SRC:DEST Copy a regular file to an absolute guest path, preserving its host mode; repeatable diff --git a/tasks/test.toml b/tasks/test.toml index 49e8df7f1a..cdd9db6001 100644 --- a/tasks/test.toml +++ b/tasks/test.toml @@ -140,6 +140,10 @@ run = [ description = "Run Rust Podman e2e inside a rootless Ubuntu 26.04 Nix test guest" run = "e2e/run.sh --vm ubuntu-26-04 --with podman-rootless --tests-in-vm --gateway-config e2e/configs/gateway/podman.toml --features e2e-podman" +["e2e:podman:fedora-rootful"] +description = "Run focused Podman e2e against a rootful Fedora Nix test guest" +run = "e2e/run.sh --vm fedora --with podman-rootful --guest-gateway-user root --gateway-config e2e/configs/gateway/podman-rootful.toml --features e2e-podman --suite sandbox_lifecycle" + ["e2e:podman:gpu"] description = "Run GPU e2e against a standalone gateway with the Podman compute driver" env = { OPENSHELL_E2E_PODMAN_GPU = "1", OPENSHELL_E2E_PODMAN_TEST = "gpu", OPENSHELL_E2E_PODMAN_FEATURES = "e2e-podman-gpu" } From af677843d8735ccca306b90f36709c951f883704 Mon Sep 17 00:00:00 2001 From: Evan Lezar Date: Mon, 31 Aug 2026 13:08:45 +0200 Subject: [PATCH 2/2] test(e2e): generalize rootful podman guest setup Signed-off-by: Evan Lezar --- nix/test-guest/README.md | 5 +++-- nix/test-guest/configuration/podman-rootful.yml | 10 +--------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/nix/test-guest/README.md b/nix/test-guest/README.md index 418b50b349..b82ec9eeba 100644 --- a/nix/test-guest/README.md +++ b/nix/test-guest/README.md @@ -61,8 +61,8 @@ The root [`flake.nix`](../../flake.nix) exposes this directory as the `test-gues | Distro | Docker | Podman | Rootful Podman | Rootless Podman | SELinux | Package format | | --- | --- | --- | --- | --- | --- | --- | -| Ubuntu 24.04 | Yes | Yes | No | No | No | `.deb` | -| Ubuntu 26.04 | Yes | Yes | No | Yes | No | `.deb` | +| Ubuntu 24.04 | Yes | Yes | Yes | No | No | `.deb` | +| Ubuntu 26.04 | Yes | Yes | Yes | Yes | No | `.deb` | | CentOS Stream 10 | No | Yes | Yes | No | Yes | `.rpm` | | Fedora 44 | No | Yes | Yes | No | Yes | `.rpm` | | Rocky Linux 9 | Yes | Yes | Yes | No | Yes | `.rpm` | @@ -104,6 +104,7 @@ nix run .#test-guest -- --distro rocky --with docker nix run .#test-guest -- --distro centos --with podman nix run .#test-guest -- --distro fedora --with podman nix run .#test-guest -- --distro fedora --with podman-rootful +nix run .#test-guest -- --distro ubuntu-24-04 --with podman-rootful nix run .#test-guest -- --distro ubuntu-26-04 --with podman-rootless ``` diff --git a/nix/test-guest/configuration/podman-rootful.yml b/nix/test-guest/configuration/podman-rootful.yml index 9947635f1a..3ae5467fa4 100644 --- a/nix/test-guest/configuration/podman-rootful.yml +++ b/nix/test-guest/configuration/podman-rootful.yml @@ -7,17 +7,9 @@ - name: Configure rootful Podman hosts: test_vm become: true - gather_facts: true + gather_facts: false tasks: - - name: Validate rootful Podman support - ansible.builtin.assert: - that: - - ansible_facts.distribution in ["CentOS", "Fedora", "Rocky"] - fail_msg: >- - Rootful Podman guest coverage is supported on RPM-family guests, not - {{ ansible_facts.distribution }}. - - name: Install rootful Podman ansible.builtin.package: name: podman