ci: fix conmon job - #5401
Merged
Merged
Conversation
kolyshkin
force-pushed
the
conmon-userns
branch
2 times, most recently
from
August 13, 2026 20:38
6b687dd to
327873d
Compare
kolyshkin
changed the title
kolyshkin
added
backport/1.5-todo
On Ubuntu 24.04 runners, kernel.apparmor_restrict_unprivileged_userns is set to 1, so an unconfined process that creates a user namespace is transitioned to the unprivileged_userns AppArmor profile, which denies CAP_SYS_ADMIN. As a result, rootless runc creates and maps the user namespace fine and then fails to unshare the remaining ones: runc create failed: unable to start container process: can't get final child's PID from pipe: EOF; runc init error(s): nsexec-1: failed to unshare remaining namespaces: Operation not permitted and dmesg shows: apparmor="AUDIT" operation="userns_create" info="Userns create - transitioning profile" profile="unconfined" comm="runc:[1:CHILD]" target="unprivileged_userns" apparmor="DENIED" operation="capable" profile="unprivileged_userns" comm="runc:[1:CHILD]" capability=21 capname="sys_admin" Use the same workaround as in test.yml: load an AppArmor profile for the runc binary being tested. This went unnoticed because the conmon tests skip when the test image can't be pulled, so the job was green whenever the pull failed, and only red when the tests actually ran. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
conmon's test suite skips its container tests when the test image can't be pulled, and reports the run as successful, so the conmon job here was green whenever the pull failed and red only when the tests actually ran. Bump to conmon main, which contains containers/conmon#668 turning that into a hard failure, so that this job tests what it is supposed to test. To be replaced with a conmon tag once one is released (> v2.2.1). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
kolyshkin
force-pushed
the
conmon-userns
branch
from
August 14, 2026 23:04
327873d to
2048d84
Compare
Contributor
Author
|
Need this for green CI and better coverage; PTAL @opencontainers/runc-maintainers |
thaJeztah
reviewed
Aug 16, 2026
| ref: v2.2.1 | ||
| # XXX: this is conmon main with https://github.com/containers/conmon/pull/668, | ||
| # which makes the tests fail, rather than silently skip, and fixes a | ||
| # few other things. Switch to a released version once one is out |
Member
There was a problem hiding this comment.
do you know if a patch release is planned already?
Contributor
Author
There was a problem hiding this comment.
@jnovy might be able to answer; the test fixes alone is not good enough reason to cut a release but maybe there's something else in store.
For now I just want to fix the CI here, and am fine with a temporary sha (I mean, back in the day we had quite a few!)
Member
There was a problem hiding this comment.
heh; yeah, not blocking, just looking if there were plans potentially 😅
|
@kolyshkin filed PR for cri-o: to fix this upstream to avoid downstream workarounds: cri-o/cri-o#10244 |
Contributor
Author
|
We need green CI in order to work on other PRs. PTAL @opencontainers/runc-maintainers @AkihiroSuda @lifubang @rata |
AkihiroSuda
approved these changes
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #5399.
The validate / conmon job was mostly passing only because it failed
to pull an image (due to running a big number of parallel pulls I guess)
and skipped the test. This is being fixed in
containers/conmon#668).
Recently the pull started to succeed sometimes, which resulted in
test being actually run, and fail due to nested userns restriction
in Ubuntu, and the missing fixup for that.
This PR adds the fixup, and uses a fixed conmon tests from
containers/conmon#668.