podman: improve runtime patching

[the-sun-will-rise-tomorrow]

Description of changes

Change the approach used to integrate runtimes, in order to:

• Better support macOS
• Make obscure OCI runtimes optional
• Work around a panic due to runtimes having no paths

Fixes #306398.

Context:

• podman.sock: runtime error: index out of range [0] with length 0 containers/podman#22561
• podman: 4.9.3 -> 5.0.1 #301553 (comment)
• podman: 4.9.3 -> 5.0.1 #301553 (comment)

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[the-sun-will-rise-tomorrow]

@ofborg build podman.passthru.tests

[the-sun-will-rise-tomorrow]

@heitorPB @kevincox @cyrillzadra @lunik1 Could you test this, please?

[heitorPB]

@WxNzEMof how do I test this? Never reviewed/tested a nixpkgs PR before.

[cyrillzadra]

I switched my input to your podman fix branch

  inputs = {
    nixpkgs = {
#      url = "github:NixOS/nixpkgs/nixos-unstable";
      url = "github:WxNzEMof/nixpkgs/podman-5-fixes";
    };
  };

updated my system with

nix flake update 
nixos-rebuild switch --flake .#nixos

Now executing curl --unix-socket /var/run/user/1000/podman/podman.sock http://localhost/info returns a json instead of an 500 error. 👍

[heitorPB]

@cyrillzadra Would you be so kind to share the json you got?

I'd like to changing my inputs completely as to keep the rest of my system intact. Would an overlay to podman do the trick?

[cyrillzadra]

@cyrillzadra Would you be so kind to share the json you got?

{
	"ID": "9c377965-fa0a-4871-94a3-6525a141a904",
	"Containers": 65,
	"ContainersRunning": 0,
	"ContainersPaused": 0,
	"ContainersStopped": 62,
	"Images": 112,
	"Driver": "overlay",
	"DriverStatus": [
		[
			"Supports d_type",
			"true"
		],
		[
			"Native Overlay Diff",
			"true"
		],
		[
			"Using metacopy",
			"false"
		],
		[
			"Supports shifting",
			"false"
		],
		[
			"Supports volatile",
			"true"
		],
		[
			"Backing Filesystem",
			"btrfs"
		]
	],
	"Plugins": {
		"Volume": [
			"local"
		],
		"Network": [
			"bridge",
			"macvlan",
			"ipvlan"
		],
		"Authorization": null,
		"Log": [
			"k8s-file",
			"none",
			"passthrough",
			"journald"
		]
	},
	"MemoryLimit": true,
	"SwapLimit": false,
	"CpuCfsPeriod": false,
	"CpuCfsQuota": false,
	"CPUShares": false,
	"CPUSet": false,
	"PidsLimit": true,
	"IPv4Forwarding": false,
	"BridgeNfIptables": false,
	"BridgeNfIp6tables": false,
	"Debug": false,
	"NFd": 11,
	"OomKillDisable": false,
	"NGoroutines": 13,
	"SystemTime": "2024-05-09T15:03:32.83130335+02:00",
	"LoggingDriver": "",
	"CgroupDriver": "systemd",
	"NEventsListener": 0,
	"KernelVersion": "6.6.30",
	"OperatingSystem": "nixos",
	"OSVersion": "24.05",
	"OSType": "linux",
	"Architecture": "amd64",
	"IndexServerAddress": "",
	"RegistryConfig": {
		"AllowNondistributableArtifactsCIDRs": [],
		"AllowNondistributableArtifactsHostnames": [],
		"InsecureRegistryCIDRs": [],
		"IndexConfigs": {},
		"Mirrors": []
	},
	"NCPU": 24,
	"MemTotal": 67282857984,
	"GenericResources": null,
	"DockerRootDir": "/home/user/.local/share/containers/storage",
	"HttpProxy": "",
	"HttpsProxy": "",
	"NoProxy": "",
	"Name": "nixos",
	"Labels": null,
	"ExperimentalBuild": true,
	"ServerVersion": "5.0.2",
	"Runtimes": {
		"crun": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/crun"
		},
		"crun-vm": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/crun-vm"
		},
		"crun-wasm": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/crun-wasm"
		},
		"kata": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/kata-runtime"
		},
		"krun": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/krun"
		},
		"ocijail": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/ocijail"
		},
		"runc": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/runc"
		},
		"runj": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/runj"
		},
		"runsc": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/runsc"
		},
		"youki": {
			"path": "/nix/store/nki3a4ym9nkaadbdwkns1h6ar9jcqgcj-podman-helper-binary-wrapper/bin/youki"
		}
	},
	"DefaultRuntime": "crun",
	"Swarm": {
		"NodeID": "",
		"NodeAddr": "",
		"LocalNodeState": "inactive",
		"ControlAvailable": false,
		"Error": "",
		"RemoteManagers": null
	},
	"LiveRestoreEnabled": false,
	"Isolation": "",
	"InitBinary": "",
	"ContainerdCommit": {
		"ID": "",
		"Expected": ""
	},
	"RuncCommit": {
		"ID": "",
		"Expected": ""
	},
	"InitCommit": {
		"ID": "",
		"Expected": ""
	},
	"SecurityOptions": [
		"name=seccomp,profile=default",
		"name=rootless"
	],
	"ProductLicense": "Apache-2.0",
	"CDISpecDirs": null,
	"Warnings": [],
	"BuildahVersion": "1.35.3",
	"CPURealtimePeriod": false,
	"CPURealtimeRuntime": false,
	"CgroupVersion": "2",
	"Rootless": true,
	"SwapFree": 0,
	"SwapTotal": 0,
	"Uptime": "23h 33m 51.00s (Approximately 0.96 days)"
}

[kevincox]

Result of nixpkgs-review pr 310182 run on x86_64-linux 1

3 packages built:

• out-of-tree
• podman
• podman.man

[kevincox]

This fixes the issue for me.

Is it ready to merge?

[SuperSandro2000]

LGTM

[tricktron]

Builds successfully and fixes the ERROR: runtime error: index out of range [0] with length 0 on x86_64-linux.

[kevincox]

@WxNzEMof is there anything holding this back? It is a pretty major regression so I would like to merge it.

[the-sun-will-rise-tomorrow]

@WxNzEMof is there anything holding this back?

No.

I would have liked to add a test for this functionality, so it doesn't regress again, but I don't know how to reproduce it inside a NixOS test.

It is a pretty major regression so I would like to merge it.

Be my guest, we can add the test separately later.

[kevincox]

Ok thanks. Unless there are objections soon I will merge later today.

A test would be nice but I think that it can be a separate PR. I would rather it not block the fix.

[kevincox]

Thanks @WxNzEMof and everyone else who helped!