[bug#52174] [PATCH] gnu: Add podman

[Timmy Douglas via Guix-patches via <guix-patches@gnu.org>]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi,
>
>> Timmy Douglas <mail@timmydouglas.com> skribis:
>>
>> Maybe my original reply wasn't clear--they all pass when I cd into the
>> tmp (--keep-failed) directory and run them manually. They fail when the builder runs
>> them. I think I put the reasons in the v3 patch. For crun, it's because
>> it needs the /sys/fs/cgroup mount which doesn't seem to be there for the
>> builder. For the others, it's a similar situation--off the top of my
>> head, they were either missing that mount or a /dev device.
>
> Oh I see.  I pushed v3 as 637dec9d45db4df2a3e6aa565fa2c5cf6bb77768 with
> minor tweaks (long lines and one or two synopses/descriptions tweaked.)

thanks for the help Ludo!

> IWBN to see if we can still run those tests somehow, or at least the
> subset of them that doesn’t rely on /sys/fs/cgroup.  I’d argue that the
> test harness should automatically skip tests that cannot be run; perhaps
> worth raising upstream?

I'd like to get the tests to run also, but the builder sandbox appears
to be blocking some pretty major functionality that the tests would rely
on.

I think pretty much all of the container/crun ones would rely on the
cgroup mount because that's the kernel interface into the container
APIs... Is there some way that guix and the builder could eventually
expose those by default? I don't know how receptive upstream would be
towards an ask to run container tests with the container interface
disabled?

For the networking ones that fail, they try to use /dev/net/tun. Like
the cgroup one, I assume this is a kernel interface needed to perform
network operations. I guess the builders disable this as a part of the
network disabling stuff because the tests pass outside of the builder
sandbox.

The cni-plugins (cni=container network interface) use /var/run to mount
network namespaces. /var/run is present on my machine but I don't think
it exists inside the builder sandbox. The actual directory used can be
set with XDG_RUNTIME_DIR, but it appears the code still checks the
ownership of /var/run to see if it's running in a user namespace:
https://github.com/containernetworking/plugins/blob/2c46a726805bcf13e2f78580c57b21e9de107285/pkg/testutils/netns_linux.go