test: skip test on rootless cgroupsv1 #11798
Conversation
openshift-ci
bot
added
the
approved
|
Should the podman run/create code prevent the user from doing this? |
There was a problem hiding this comment.
Thank you for adding a helper! Could you also use it in
podman/test/system/420-cgroups.bats
Lines 11 to 13 in cd10304
test/system/helpers.bash
Outdated
| if is_rootless; then | ||
| if ! is_cgroupsv2; then | ||
| local msg=$(_add_label_if_missing "$1" "rootless cgroupvs1") | ||
| skip "${msg:-not applicable under rootless podman}" |
There was a problem hiding this comment.
This is misleading; it should include something about cgroupsv1 as well. Perhaps:
...not supported as rootless under cgroupsv1}"
skip the test "podman selinux: shared context in (some) namespaces" on cgroupsv1 when running as rootless since the tests requires --pid=container:. If the container runtime cannot use cgroupsv1 and the container has no pid namespace. then it is not possible to correctly terminate the container. Without a cgroup or a pid namespace, the runtime has no control on what processes are in the container. Closes: containers#11785 Signed-off-by: Giuseppe Scrivano <[email protected]>
Signed-off-by: Giuseppe Scrivano <[email protected]>
giuseppe
force-pushed
the
skip-pid-shared-ns-on-rootless-cgroups-v1
branch
from
dad88bc to
5c1b3e8
Compare
It should be the OCI runtime to raise an error since it creates the cgroup, and if it fails then it can check if there is a PID namespace. I am not sure though if we block valid use cases doing so., the worse that can happen is to leak processes in the initial container PID namespace |
|
LGTM, thank you! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, Luap99 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
openshift-ci
bot
added
the
do-not-merge/hold
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
github-actions
bot
added
the
locked - please file new issue/PR
skip the test "podman selinux: shared context in (some) namespaces" on
cgroupsv1 when running as rootless since the tests requires
--pid=container:.
If the container runtime cannot use cgroupsv1 and the container has no
pid namespace. then it is not possible to correctly terminate the
container. Without a cgroup or a pid namespace, the runtime has no
control on what processes are in the container.
Closes: #11785
Signed-off-by: Giuseppe Scrivano [email protected]
What this PR does / why we need it:
fix a failing test on rootless and cgroups v1
How to verify it
run the test on cgroups v1 and rootless
Which issue(s) this PR fixes:
Fixes #11785
Special notes for your reviewer: