Skip to content

ci: add in-container CI tests#385

Draft
cyphar wants to merge 8 commits into
mainfrom
ci-in-ctr
Draft

ci: add in-container CI tests#385
cyphar wants to merge 8 commits into
mainfrom
ci-in-ctr

Conversation

@cyphar
Copy link
Copy Markdown
Owner

@cyphar cyphar commented Jun 2, 2026

Fixes #372
Implements #376

@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 2, 2026

Codecov Report

❌ Patch coverage is 94.46809% with 13 lines in your changes missing coverage. Please review.

Files with missing lines Patch % Lines
src/tests/common/handle.rs 75.00% 4 Missing ⚠️
src/tests/test_root_ops.rs 96.52% 4 Missing ⚠️
src/tests/test_resolve.rs 85.71% 3 Missing ⚠️
src/tests/capi/test_compat.rs 96.77% 2 Missing ⚠️

📢 Thoughts on this report? Let us know!

@cyphar cyphar force-pushed the ci-in-ctr branch 27 times, most recently from eef58a6 to c42e237 Compare June 4, 2026 11:49
We made pretty judicious use of ?, which leads to problems if you have
an error somewhere deep as there is little information at the error
source about what was being attempted.

The goal here is to just improve the overall amount of information we
are providing when an error happens deep within some helper. This is
really dumb grunt work so I used an LLM for it.

Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
cyphar added 5 commits June 4, 2026 21:50
O_NOATIME requires privileges that we might not have and appears to be
problematic in containers. O_NOCTTY is a better "dummy" flag to use.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
When we start running tests in containers, mknod(2) is blocked by the
devices cgroup and so will fail even for root.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Minor quality of life improvement when running this script from inside a
container.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
In a container we actually do run as root by default, so we should
handle that case automatically in a similar way to --sudo.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
This will be needed to make it easier to exfiltrate test data from
containers into a volume without making targets/llvm-cov-target a volume
(which has some other potential downsides).

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
@cyphar cyphar force-pushed the ci-in-ctr branch 3 times, most recently from ef2beab to 3ed1412 Compare June 4, 2026 12:14
The primary use-case for this image is for CI, but I've included a very
minimal install image that you could in principle use to make use of
libpathrs on container infrastructure without needing to build it
yourself.

Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
Signed-off-by: Aleksa Sarai <aleksa@amutable.com>
@cyphar
Copy link
Copy Markdown
Owner Author

cyphar commented Jun 4, 2026

TODO:

  • Detect and skip tests that require mount to handle the AppArmor problem if running in a container as root without custom settings.
  • Either skip the /proc/sys tests, or implement the statmount thing...?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

container workloads with /proc/sys ro mount are problematic

1 participant