Update images #10829

cevich · 2021-06-30T19:23:22Z

Revert temporary workaround commit and update all VM images.

Depends on: #11164, #11166

TomSweeneyRedHat · 2021-06-30T21:58:05Z

A quick scan and the changes look OK, but the test system is an ugly red....

cevich · 2021-07-01T14:51:33Z

OK, but the test system is an ugly red

Super-ugly actually...I wonder if the SELinux issue really isn't fixed yet. I think I'll let this PR sit until after the holiday week, then re-build VM images, cross my fingers, and hope.

cevich · 2021-07-12T14:42:56Z

I'm back now, started fresh build of VM images for CI.

cevich · 2021-07-12T15:35:06Z

Ref: containers/automation_images#82

rhatdan · 2021-07-12T18:12:27Z

@cevich Is this still valid?

cevich · 2021-07-12T19:20:23Z

@cevich Is this still valid?

Yep, it would be nice for consistency sake. More importantly it's not good for us to continue w/ giuseppe's workaround (different Ubuntu vs Fedora images) long-term. I'll look at the failures tomorrow and see what's what (we were waiting on an update to container-selinux or some other selinux related packages in Fedora).

cevich · 2021-07-14T20:50:12Z

Fedora 33:

Error: open /dev/dma_heap: permission denied

Fedora 34 and Ubuntu:

Failed to decode the keys [\"secret\" \"secret.opts\"] from \"/usr/share/containers/containers.conf\".

rhatdan · 2021-07-15T16:22:13Z

Error: open /dev/dma_heap: permission

Looks like an out of date selinux policy?
Latest is supposed to be: selinux-policy-3.14.6-38.fc33

Failed to decode the keys ["secret" "secret.opts"] from "/usr/share/containers/containers.conf".

Needs an updated containers-common. But this is not supposed to cause a failure.

rhatdan · 2021-07-15T16:38:09Z

I am updating the containers-common package in f34 with the correct secrets config options.

rhatdan · 2021-07-15T18:08:51Z

container-selinux-2.163.0-2.fc33 is needed to fix this.

cevich · 2021-07-15T19:51:48Z

Error: open /dev/dma_heap: permission
Looks like an out of date selinux policy?
Latest is supposed to be: selinux-policy-3.14.6-38.fc33

For F33, I don't have the policy package version at hand, but we're using container-selinux-2.160.2-1.fc33-noarch, so it sounds like that's too old anyway. Let me see if I can side-load in FEDORA-2021-862d1936a6 and FEDORA-2021-01325d81c4 into VMs manually, confirm they address some issues, and then I can also give karma...

vrothberg · 2021-07-16T10:46:49Z

Note: #10848 is now skipping "bud with --runtime and --runtime-flag" of the buildah-bud tests. Once the images are updated, we can revert that in test/buildah-bud/apply-podman-deltas.

The `IgnorePlatform` options has been removed from the `LookupImageOptions` in libimage to properly support multi-arch images. Skip one buildah-bud test which requires updated CI images. This is currently being done in github.com/containers/pull/10829 but we need to unblock merging common and buildah into podman. [NO TESTS NEEDED] Signed-off-by: Valentin Rothberg <[email protected]>

cevich · 2021-07-16T13:52:04Z

Once the images are updated, we can revert that in test/buildah-bud/apply-podman-deltas.

Oh gosh, I will be the first one to completely forget to do that. Let me add a commit here to take care of it...

cevich · 2021-07-16T18:25:58Z

Manual testing results:

On int podman fedora-34 root host tests + fully updated VM + FEDORA-2021-01325d81c4 the situation is greatly improved. Only a few tests flaked.
On int podman fedora-33 root host + fully updated VM + FEDORA-2021-862d1936a6 I did not see a noticeable improvement. The dma_heap permissions errors seem equally as plentiful 😞

cevich · 2021-07-16T18:30:07Z

@rhatdan would you mind poking me when the selinux-policy package update is ready for F33? I'm happy to test it / give bodhi karma.

Ref: containers#10829 (comment) Signed-off-by: Chris Evich <[email protected]>

cevich · 2021-08-18T15:01:47Z

In case it helps re: int podman ubuntu-2010 rootless host

Old (working) run:
https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/5453119912935424/html/int-podman-ubuntu-2010-rootless-host.log.html#t--podman-run-container-with-systemd-PID1--1

New (broken) run:

https://storage.googleapis.com/cirrus-ci-6707778565701632-fcae48/artifacts/containers/podman/4573521146806272/html/int-podman-ubuntu-2010-rootless-host.log.html#t--podman-run-container-with-systemd-PID1--1

TomSweeneyRedHat · 2021-08-18T15:38:09Z

Changes LGTM still, but needs a rebase.

This reverts commit 404d5ed. The replacement (updated) images include a fix for: containers/common#631 Also minor update to an unrelated FIXME comment. Signed-off-by: Chris Evich <[email protected]>

Ref: containers#10829 (comment) Signed-off-by: Chris Evich <[email protected]>

This becomes a problem on hosts with upgraded policies. Ref: containers#10522 Also, made a small change to compose-test setup to reduce runtime. Signed-off-by: Chris Evich <[email protected]>

These tests were originally enabled in a situation where CI provided false-positive results. Now that has been corrected, these tests all fail under a CGv1 container environment with the error: ``` Error: unable to load cgroup at /machine.slice/libpod-e4f...086.scope/libpod_parent/libpod-fbd...425: cgroup deleted ``` This commit simply disables the tests under this specific environment. Signed-off-by: Chris Evich <[email protected]>

Signed-off-by: Chris Evich <[email protected]>

cevich · 2021-08-18T17:08:17Z

In case it helps re: int podman ubuntu-2010 rootless host

This appears to be a flake, as now the test has passed. Sadly, I don't think it's the last time we'll encounter it w/o further deep investigation 😞

cevich · 2021-08-18T17:46:03Z

Re-ran sys podman fedora-34 root host test.

edsantiago

LGTM

edsantiago · 2021-08-18T18:25:41Z

contrib/cirrus/setup_environment.sh

@@ -208,7 +222,7 @@ case "$TEST_FLAVOR" in
    unit) ;;
    apiv2) ;&  # use next item
    compose)
-        dnf install -y $PACKAGE_DOWNLOAD_DIR/podman-docker*
+        rpm -ivh $PACKAGE_DOWNLOAD_DIR/podman-docker*


This is the only eyebrow-raiser I found: it could fail if a dependency of podman-docker is missing. I choose not to worry about it.

This is accounted for when the packages are downloaded. This same 'install from cache' mechanism is used in CI for other containers repos, so we'll notice pretty quickly if there's a problem. I think it's fine to not worry about it.

openshift-ci · 2021-08-18T18:26:32Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cevich, edsantiago

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [edsantiago]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

TomSweeneyRedHat · 2021-08-18T18:34:33Z

@cevich, is this still a WIP as the title claims?

cevich · 2021-08-18T18:36:46Z

@cevich, is this still a WIP as the title claims?

Oh thank finally, it passed with only 1 test re-run.

@containers/podman-maintainers PTAL - this is ready along with #11163

TomSweeneyRedHat · 2021-08-18T18:40:29Z

LGTM

TomSweeneyRedHat · 2021-08-18T18:40:37Z

/lgtm

cevich mentioned this pull request Jun 30, 2021

Cirrus: Update Ubuntu VM images #10709

Closed

cevich changed the title ~~Update images~~ [WIP] Update images Jul 2, 2021

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 2, 2021

cevich mentioned this pull request Jul 2, 2021

bash: error while loading shared libraries: libc.so.6: cannot change memory protections #10817

Closed

cevich force-pushed the update_images branch from ddfdd16 to 14894eb Compare July 12, 2021 15:23

cevich mentioned this pull request Jul 12, 2021

Cirrus: Freshen CI images containers/skopeo#1375

Merged

cevich force-pushed the update_images branch 2 times, most recently from 5ecaff7 to 61980c8 Compare July 13, 2021 17:37

cevich mentioned this pull request Jul 14, 2021

Failed to decode the keys ["secret" "secret.opts"] from "/usr/share/containers/containers.conf" #10934

Closed

This was referenced Jul 15, 2021

Update vendor of containers/common and containers/buildah #10899

Closed

flake: ubuntu 2010: systemd: Failed to create ... control group, EPERM #10386

Closed

cevich force-pushed the update_images branch from 61980c8 to 8716c94 Compare July 16, 2021 13:56

cevich force-pushed the update_images branch from 643f3c2 to 4fa078d Compare August 17, 2021 20:16

cevich added a commit to cevich/podman that referenced this pull request Aug 17, 2021

Restore buildah-bud test requiring new images

daa311d

Ref: containers#10829 (comment) Signed-off-by: Chris Evich <[email protected]>

openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 18, 2021

cevich added 5 commits August 18, 2021 12:04

Revert ".cirrus.yml: use fresh images for all VMs"

14f3658

This reverts commit 404d5ed. The replacement (updated) images include a fix for: containers/common#631 Also minor update to an unrelated FIXME comment. Signed-off-by: Chris Evich <[email protected]>

Restore buildah-bud test requiring new images

77f6652

Ref: containers#10829 (comment) Signed-off-by: Chris Evich <[email protected]>

Fix AVC denials in tests of volume mounts

dc70382

This becomes a problem on hosts with upgraded policies. Ref: containers#10522 Also, made a small change to compose-test setup to reduce runtime. Signed-off-by: Chris Evich <[email protected]>

Cirrus: Confirm CGv1 / CGv2 VM expectations

9dd088e

Signed-off-by: Chris Evich <[email protected]>

cevich force-pushed the update_images branch from 4fa078d to 9dd088e Compare August 18, 2021 16:04

openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 18, 2021

edsantiago approved these changes Aug 18, 2021

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 18, 2021

cevich changed the title ~~[WIP] Update images~~ Update images Aug 18, 2021

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 18, 2021

openshift-ci bot assigned TomSweeneyRedHat Aug 18, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Aug 18, 2021

openshift-merge-robot merged commit 4ec2270 into containers:main Aug 18, 2021

cevich deleted the update_images branch April 18, 2023 14:43

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Aug 31, 2023

github-actions bot locked as resolved and limited conversation to collaborators Aug 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update images #10829

Update images #10829

cevich commented Jun 30, 2021 •

edited

Loading

TomSweeneyRedHat commented Jun 30, 2021

cevich commented Jul 1, 2021

cevich commented Jul 12, 2021

cevich commented Jul 12, 2021

rhatdan commented Jul 12, 2021

cevich commented Jul 12, 2021

cevich commented Jul 14, 2021 •

edited

Loading

rhatdan commented Jul 15, 2021

rhatdan commented Jul 15, 2021

rhatdan commented Jul 15, 2021

cevich commented Jul 15, 2021

vrothberg commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

cevich commented Aug 18, 2021

cevich commented Aug 18, 2021

edsantiago left a comment

edsantiago Aug 18, 2021

cevich Aug 18, 2021

openshift-ci bot commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

cevich commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

Update images #10829

Update images #10829

Conversation

cevich commented Jun 30, 2021 • edited Loading

TomSweeneyRedHat commented Jun 30, 2021

cevich commented Jul 1, 2021

cevich commented Jul 12, 2021

cevich commented Jul 12, 2021

rhatdan commented Jul 12, 2021

cevich commented Jul 12, 2021

cevich commented Jul 14, 2021 • edited Loading

rhatdan commented Jul 15, 2021

rhatdan commented Jul 15, 2021

rhatdan commented Jul 15, 2021

cevich commented Jul 15, 2021

vrothberg commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Jul 16, 2021

cevich commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

cevich commented Aug 18, 2021

cevich commented Aug 18, 2021

edsantiago left a comment

Choose a reason for hiding this comment

edsantiago Aug 18, 2021

Choose a reason for hiding this comment

cevich Aug 18, 2021

Choose a reason for hiding this comment

openshift-ci bot commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

cevich commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

TomSweeneyRedHat commented Aug 18, 2021

cevich commented Jun 30, 2021 •

edited

Loading

cevich commented Jul 14, 2021 •

edited

Loading