ci: don't run tests on overlayfs/tmpfs #1199
Conversation
|
☔ The latest upstream changes (presumably 75150fe) made this pull request unmergeable. Please resolve the merge conflicts. |
jlebon
force-pushed
the
pr/test-tmpdir
branch
from
2e23127 to
a193536
Compare
Allow developers to override the default /var/tmp dir, which e.g. might be on overlayfs and thus produces reduced coverage.
We use `setfattr` to determine whether the filesystem we're on supports xattrs, but we need to check that `setfattr` itself is available. We just make it a hard requirement but only if trying to run tests that ask about xattr support.
It occurred to me that a simple way of getting coverage for tests that don't work on overlayfs/tmpfs is to simply run them in a directory mounted from the host. To do this, we switch `f26-primary` to execute on a test node rather than in a container, and make use of the new `TEST_TMPDIR` var to point it at the mounted /srv dir. We also have to tweak the overlayfs detection logic only check the filesystem in which we're actually running the test, rather than just /.
jlebon
force-pushed
the
pr/test-tmpdir
branch
from
a193536 to
79295f6
Compare
.papr.yml
Outdated
| - ci/build-check.sh | ||
| - ci/ci-release-build.sh | ||
| - docker run -e TEST_TMPDIR -e CFLAGS -e GI_SCANNERFLAGS -e ASAN_OPTIONS | ||
| --privileged -v $PWD:$PWD --workdir $PWD -v /srv:/srv |
There was a problem hiding this comment.
There's nothing for this change that requires --privileged right? I suspect it's just SELinux labeling that we'd hit; relabeling with chcon -R -h -t container_file_t $PWD and doing the same with TEST_TMPDIR would let us avoid being privileged, and that in turn would help guarantee these tests can be run in Kube for example.
There was a problem hiding this comment.
Good point, I added a fixup to try that out. ⬇️
There was a problem hiding this comment.
Ahh, hmm, we're still hitting
error: lsetxattr: Permission denied
when trying to commit files (with a relabelfrom SELinux violation).
I suspect it's just SELinux labeling that we'd hit; relabeling with
chcon -R -h -t container_file_t $PWDand doing the same withTEST_TMPDIRwould let us avoid being privileged,
But we'll still be trying to re-apply all the labels when committing to a bare repo, right? Unless we teach libglnx to only update security.selinux if the label isn't already set to the wanted value, though that's quite a performance hit. We could hide the behaviour behind an env var, I guess? We could also put back --privileged (or at least --security-opt label:disable) and add another testsuite to make sure the in-container path doesn't break?
|
Woohoo! Before: After: |
|
Sure, split out #1207. |
|
I'd say we should unconditionally disable xattrs for |
|
To elaborate more concretely, I propose: Our unit-style tests i.e. Retain executing those tests in containers (which we should also make fully unprivileged and not just the docker default). The tests that use |
|
If you agree, I can take care of doing this. |
|
Agreed, that's a logical way to split the tests.
Sounds good! |
|
Moved to #1217 |
This was originally part of ostreedev#1199, but never got in. The work in ostreedev#1218 is awesome for CI, though for the developer workflow, I find it much easier to just set $TEST_TMPDIR to a non-overlayfs mount point. Teach the test libraries to just look at $PWD rather than /. Also export the function that does the overlayfs checking. Prep for a future patch.
This was originally part of #1199, but never got in. The work in #1218 is awesome for CI, though for the developer workflow, I find it much easier to just set $TEST_TMPDIR to a non-overlayfs mount point. Teach the test libraries to just look at $PWD rather than /. Also export the function that does the overlayfs checking. Prep for a future patch. Closes: #1170 Approved by: cgwalters
It occurred to me that a simple way of getting coverage for tests that don't work on overlayfs/tmpfs is to simply run them in a directory mounted from the host.
To do this, we switch
f26-primaryto execute on a test node rather than in a container, and make use of the newTEST_TMPDIRvar to point it at the mounted/srvdir.We also have to tweak the overlayfs detection logic only check the filesystem in which we're actually running the test, rather than just
/.