Cirrus: Use Fedora 34beta images

[cevich]

Signed-off-by: Chris Evich [email protected]

[cevich]

@giuseppe do you know if something in F34 kernel/crun change that would cause --blkio-weigh behavior to change w/ CgroupsV2?. I went into one of the new VMs and checked:

[root@cevich-fedora-c4917211555954688 podman]# stat -f -c %T /sys/fs/cgroup
cgroup2fs

Even running the command manually, seems to give an unexpected value:

[root@cevich-fedora-c4917211555954688 podman]# podman run --rm quay.io/libpod/alpine:l
atest sh -c 'cat /proc/self/cgroup'
0::/
[root@cevich-fedora-c4917211555954688 podman]# podman run --rm --blkio-weight=15 quay.
io/libpod/alpine:latest sh -c 'cat /sys/fs/cgroup/io.bfq.weight'
default 15

The test expects that value to scale to 51 😕

[vrothberg]

@cevich, could we break out the updates to the F33 images? I need them to fetch the updates to libcap to make certain PRs pass.

[giuseppe]

@cevich is this PR still needed?

[cevich]

@cevich is this PR still needed?

Yes, I'm periodically running tests to try and keep ahead of the F34 release and expose problems in our testing. In fact I could use help digging through the failures to see what adjustments are needed in the VM Image build PR: containers/automation_images#49

[cevich]

@vrothberg any idea why your unitterst is segfaulting on F34b?

Hint: There really isn't any TTY available 😁

Anything I can do to help fix this?

(I tried running the tests w/ go 1.16 and 1.13, same deal both ways 😞)

[vrothberg]

@vrothberg any idea why your unitterst is segfaulting on F34b?

Thanks for the ping.

They are segfaulting because the tests are sloppy (i.e., errors should be treated fatal). It's erroring because F34 is now in enforcing mode (see man containers-registries.conf).

Hint: There really isn't any TTY available grin

Anything I can do to help fix this?

I'll wrap up a PR. Just to set expectations: I expect more tests to fail because of the enforcement. (Cc: @rhatdan)

[vrothberg]

Opened #9800

[cevich]

(waiting for new images to finish building)

[rhatdan]

LGTM
/approve

[cevich]

@containers/podman-maintainers PTAL - The currently running tests are confirming the latest (3-29-21) nightly F34b image + Ubuntu 20.10 updates for crun and libcap2 for @lsm5. Assuming tests remain green (they should) feel free to merge.

[cevich]

F33 failure [Fail] Podman run with volumes [It] podman run with volumes and suid/dev/exec options seems genuine 😢 I'm able to reproduce it manually, using the container image quay.io/libpod/prior-fedora_podman:c6526331153285120 (run in privileged mode).

The only thing I changed was in the Makefile:

diff --git a/Makefile b/Makefile
index 7bed7f5dd..f6212351c 100644
--- a/Makefile
+++ b/Makefile
@@ -307,7 +307,7 @@ test: localunit localintegration remoteintegration localsystem remotesystem  ##

 .PHONY: ginkgo-run
 ginkgo-run:
-       $(GOBIN)/ginkgo -v $(TESTFLAGS) -tags "$(TAGS)" $(GINKGOTIMEOUT) -cover -flakeAttempts 3 -progress -trace -noColor -nodes 3 -debug test/e2e/. $(HACK)
+       $(GOBIN)/ginkgo -v $(TESTFLAGS) -tags "$(TAGS)" $(GINKGOTIMEOUT) -cover -flakeAttempts 3 -progress -trace -noColor -nodes 3 -focus='podman run with volumes and suid' -debug test/e2e/. $(HACK)

 .PHONY: ginkgo
 ginkgo:

This command (as root) should reproduce the problem - make sure $GOPATH is set:

podman run --rm --privileged --net=host --cgroupns=host -v /dev/fuse:/dev/fuse -v $GOPATH:/var/tmp/go:Z --workdir /var/tmp/go/src/github.com/containers/podman -e CONTAINER=1 '-e GOSRC=/var/tmp/go/src/github.com/containers/podman' '-e CTR_FQIN=quay.io/libpod/prior-fedora_podman:c6526331153285120' '-e FEDORA_CONTAINER_FQIN=quay.io/libpod/fedora_podman:c6526331153285120' '-e PRIOR_FEDORA_CACHE_IMAGE_NAME=prior-fedora-c6526331153285120' '-e TEST_ENVIRON=container' '-e VM_IMAGE_NAME=prior-fedora-c6526331153285120' '-e OCI_RUNTIME=crun' '-e PRIOR_FEDORA_CONTAINER_FQIN=quay.io/libpod/prior-fedora_podman:c6526331153285120' '-e SCRIPT_BASE=./contrib/cirrus' '-e GOCACHE=/var/tmp/go/cache' '-e FEDORA_CACHE_IMAGE_NAME=fedora-c6526331153285120' '-e CIRRUS_SHELL=/bin/bash' '-e PRIOR_UBUNTU_CONTAINER_FQIN=quay.io/libpod/prior-ubuntu_podman:c6526331153285120' '-e UBUNTU_CONTAINER_FQIN=quay.io/libpod/ubuntu_podman:c6526331153285120' '-e PRIOR_FEDORA_NAME=fedora-33' '-e FEDORA_NAME=fedora-34beta' '-e CIRRUS_CI=false' '-e PODBIN_NAME=podman' '-e DISTRO_NV=fedora-33' '-e PRIOR_UBUNTU_NAME=ubuntu-2004' '-e GOPATH=/var/tmp/go' '-e TEST_FLAVOR=int' '-e CIRRUS_BASE_SHA=b9e064ab84044f3db25e48384a1bd6fe5dc6ecdc' '-e UBUNTU_NAME=ubuntu-2010' '-e CIRRUS_REPO_NAME=podman' '-e CIRRUS_REPO_CLONE_URL=https://github.com/containers/podman.git' '-e PRIV_NAME=root' '-e PRIOR_UBUNTU_CACHE_IMAGE_NAME=prior-ubuntu-c6526331153285120' '-e CIRRUS_WORKING_DIR=/var/tmp/go/src/github.com/containers/podman' '-e CI=false' '-e CIRRUS_TASK_NAME=int\ podman\ fedora-33\ root\ container' '-e UBUNTU_CACHE_IMAGE_NAME=ubuntu-c6526331153285120' quay.io/libpod/prior-fedora_podman:c6526331153285120 bash -c './contrib/cirrus/setup_environment.sh && ./contrib/cirrus/runner.sh'

The problem does not appear to be happening on master (w/ old image), so it seems the problem could be related to the new images.

[cevich]

Oof, new VM images, same error.

@mheon should this 'Podman run with volumes [It] podman run with volumes and suid/dev/exec options ' test even be running inside a container environment?

[cevich]

Note: The int podman fedora-33 root container test failure is being tracked by a crun issue.

[cevich]

Update: As of this comment, the necessary crun-0.18-5 package just moved to stable but is not yet available in the updates repo. I'll try again tomorrow, then fingers-crossed this PR will be ready to go.

[cevich]

@containers/podman-maintainers PTAL quick while the tests are green 😁

Note: I did need to re-run a few system tests, otherwise things have been passing cleanly. These images also include @baude golang speed-mode changes for Ubuntu.

[giuseppe]

LGTM

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cevich, giuseppe, rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe,rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mheon]

/lgtm