From 1eadcede2f75b62f1d7a8f3f0ba5961735ac9c16 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 5 Apr 2023 15:05:37 -0700 Subject: [PATCH 1/7] ci: bump bats 1.3.0 -> 1.8.2 This version is already used by Cirrus CI Fedora 37 job, but other CI jobs are still using 1.3.0. Bump it everywhere so we can enjoy new version features and fixes. For one thing, I noticed that new bats is reporting error location correctly. We will also be able to use "run !" and "run -N" commands. Signed-off-by: Kir Kolyshkin (cherry picked from commit 9dbb9f90b96cc383dbb86b746847d015bd7f1e3b) Signed-off-by: Kir Kolyshkin --- .cirrus.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.cirrus.yml b/.cirrus.yml index 84e9c0c15..958bf276e 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -71,7 +71,7 @@ task: HOME: /root CIRRUS_WORKING_DIR: /home/runc GO_VERSION: "1.19.8" - BATS_VERSION: "v1.3.0" + BATS_VERSION: "v1.8.2" RPMS: gcc git iptables jq glibc-static libseccomp-devel make criu fuse-sshfs # yamllint disable rule:key-duplicates matrix: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 8dd73afab..7be4b9ec0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -70,7 +70,7 @@ jobs: - name: install bats uses: mig4/setup-bats@v1 with: - bats-version: 1.3.0 + bats-version: 1.8.2 - name: unit test if: matrix.rootless != 'rootless' diff --git a/Dockerfile b/Dockerfile index b5c333323..3fc17be96 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ ARG GO_VERSION=1.20 -ARG BATS_VERSION=v1.3.0 +ARG BATS_VERSION=v1.8.2 ARG LIBSECCOMP_VERSION=2.5.4 FROM golang:${GO_VERSION}-bullseye From 98a1b76c5354a2a57f83d5acfabb9cca92c16c48 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 5 Apr 2023 15:15:07 -0700 Subject: [PATCH 2/7] tests/int: fix some checks Apparently, bash with set -e deliberately ignores non-zero return codes from ! cmd, unless this is the last command. The workaround is to either use "! cmd || false', "or run ! cmd". Choose the latter, and require bash-core 1.5.0 (since this is when "run !" was added), replacing the older check. Alas I only learned this recently from the bash-core documentation. Signed-off-by: Kir Kolyshkin (cherry picked from commit 9b71787be0ca628956d0ade3cd059a8ea03e4b64) Signed-off-by: Kir Kolyshkin --- tests/integration/checkpoint.bats | 4 ++-- tests/integration/exec.bats | 4 ++-- tests/integration/helpers.bash | 8 ++------ 3 files changed, 6 insertions(+), 10 deletions(-) diff --git a/tests/integration/checkpoint.bats b/tests/integration/checkpoint.bats index 9bf999400..3c6f12cc2 100644 --- a/tests/integration/checkpoint.bats +++ b/tests/integration/checkpoint.bats @@ -344,7 +344,7 @@ function simple_cr() { runc checkpoint --work-path ./work-dir test_busybox grep -B 5 Error ./work-dir/dump.log || true [ "$status" -eq 0 ] - ! test -f ./work-dir/"$tmplog1" + run ! test -f ./work-dir/"$tmplog1" test -f ./work-dir/"$tmplog2" # after checkpoint busybox is no longer running @@ -355,7 +355,7 @@ function simple_cr() { runc restore -d --work-path ./work-dir --console-socket "$CONSOLE_SOCKET" test_busybox grep -B 5 Error ./work-dir/restore.log || true [ "$status" -eq 0 ] - ! test -f ./work-dir/"$tmplog1" + run ! test -f ./work-dir/"$tmplog1" test -f ./work-dir/"$tmplog2" # busybox should be back up and running diff --git a/tests/integration/exec.bats b/tests/integration/exec.bats index 47c047bd6..4770ae3c0 100644 --- a/tests/integration/exec.bats +++ b/tests/integration/exec.bats @@ -235,12 +235,12 @@ function check_exec_debug() { # Check we can join top-level cgroup (implicit). runc exec test_busybox cat /proc/self/cgroup [ "$status" -eq 0 ] - ! grep -v ":$REL_CGROUPS_PATH\$" <<<"$output" + run ! grep -v ":$REL_CGROUPS_PATH\$" <<<"$output" # Check we can join top-level cgroup (explicit). runc exec --cgroup / test_busybox cat /proc/self/cgroup [ "$status" -eq 0 ] - ! grep -v ":$REL_CGROUPS_PATH\$" <<<"$output" + run ! grep -v ":$REL_CGROUPS_PATH\$" <<<"$output" # Create a few subcgroups. # Note that cpu,cpuacct may be mounted together or separate. diff --git a/tests/integration/helpers.bash b/tests/integration/helpers.bash index b102d3f3d..b25755448 100644 --- a/tests/integration/helpers.bash +++ b/tests/integration/helpers.bash @@ -1,10 +1,6 @@ #!/bin/bash -# bats-core v1.2.1 defines BATS_RUN_TMPDIR -if [ -z "$BATS_RUN_TMPDIR" ]; then - echo "bats >= v1.2.1 is required. Aborting." >&2 - exit 1 -fi +bats_require_minimum_version 1.5.0 # Root directory of integration tests. INTEGRATION_ROOT=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")") @@ -347,7 +343,7 @@ function have_criu() { # Workaround for https://github.com/opencontainers/runc/issues/3532. local ver ver=$(rpm -q criu 2>/dev/null || true) - ! grep -q '^criu-3\.17-[123]\.el9' <<<"$ver" + run ! grep -q '^criu-3\.17-[123]\.el9' <<<"$ver" } # Allows a test to specify what things it requires. If the environment can't From 27b86b4cc7b2737d5f91d580b020dc5284c85497 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 26 Apr 2023 15:13:59 -0700 Subject: [PATCH 3/7] ci/cirrus: use vagrant from hashicorp repo A version of vagrant available from the stock repos (2.2.19) is too old and contains a bug that prevents downloading Fedora 38 image (see [1]). Use packages from hashicorp repo, which currently has vagrant 2.3.4. This resolves the problem of downloading the latest Fedora image. Also, vagrant-libvirt plugin from Ubuntu repos is not working with vagrant from hashicorp, so switch to using "vagrant plugin install". The downside it, this takes extra 4 minutes or so in our CI, and I am not sure how to cache it or speed it up. [1] https://github.com/opencontainers/runc/pull/3835#issuecomment-1519321619 Signed-off-by: Kir Kolyshkin (cherry picked from commit 33b6ec2925feac9146d07e7c775443d08558e2d1) Signed-off-by: Kir Kolyshkin --- .cirrus.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.cirrus.yml b/.cirrus.yml index 958bf276e..d2ab324ef 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -37,9 +37,15 @@ task: echo "-----" df -T install_libvirt_vagrant_script: | + curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg + echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list + sudo sed -i 's/^# deb-src/deb-src/' /etc/apt/sources.list apt-get update - apt-get install -y libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt + apt-get install -y libvirt-daemon libvirt-daemon-system vagrant systemctl enable --now libvirtd + apt-get build-dep -y vagrant ruby-libvirt + apt-get install -y --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev + vagrant plugin install vagrant-libvirt vagrant_cache: fingerprint_script: uname -s ; cat Vagrantfile.$DISTRO folder: /root/.vagrant.d From bbddb6bdd7c52b00843bb7864da44089c58a8bde Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 26 Apr 2023 15:46:31 -0700 Subject: [PATCH 4/7] Vagrantfile.fedora: bump to 38 Signed-off-by: Kir Kolyshkin (cherry picked from commit a19200096e287a72d43ed0e8a50a2ba4a9d6cc17) Signed-off-by: Kir Kolyshkin --- Vagrantfile.fedora | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Vagrantfile.fedora b/Vagrantfile.fedora index b6f9e4e07..0df6115d5 100644 --- a/Vagrantfile.fedora +++ b/Vagrantfile.fedora @@ -3,7 +3,7 @@ Vagrant.configure("2") do |config| # Fedora box is used for testing cgroup v2 support - config.vm.box = "fedora/37-cloud-base" + config.vm.box = "fedora/38-cloud-base" config.vm.provider :virtualbox do |v| v.memory = 2048 v.cpus = 2 From e2265a92cd7757db0c580960482e6ad447929fdd Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Wed, 26 Apr 2023 15:48:03 -0700 Subject: [PATCH 5/7] ci: bump bats 1.8.2 -> 1.9.0 As Fedora 38 uses bats 1.9.0, let's switch to this version in other places. Signed-off-by: Kir Kolyshkin (cherry picked from commit 13091eeefaea7dc5367f6ea70e8fcec6da492d8c) Signed-off-by: Kir Kolyshkin --- .cirrus.yml | 2 +- .github/workflows/test.yml | 2 +- Dockerfile | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.cirrus.yml b/.cirrus.yml index d2ab324ef..aa66ca434 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -77,7 +77,7 @@ task: HOME: /root CIRRUS_WORKING_DIR: /home/runc GO_VERSION: "1.19.8" - BATS_VERSION: "v1.8.2" + BATS_VERSION: "v1.9.0" RPMS: gcc git iptables jq glibc-static libseccomp-devel make criu fuse-sshfs # yamllint disable rule:key-duplicates matrix: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 7be4b9ec0..5b8356a7f 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -70,7 +70,7 @@ jobs: - name: install bats uses: mig4/setup-bats@v1 with: - bats-version: 1.8.2 + bats-version: 1.9.0 - name: unit test if: matrix.rootless != 'rootless' diff --git a/Dockerfile b/Dockerfile index 3fc17be96..0c6b15bed 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ ARG GO_VERSION=1.20 -ARG BATS_VERSION=v1.8.2 +ARG BATS_VERSION=v1.9.0 ARG LIBSECCOMP_VERSION=2.5.4 FROM golang:${GO_VERSION}-bullseye From e9c1ca081ec1a9b1099de97d0a5222893d859fc4 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Mon, 22 May 2023 17:40:27 -0700 Subject: [PATCH 6/7] Fix Vagrant caching As of today, vagrant stopped working, my best guess is due to bad caching. Here's an excerpt from logs: ... vagrant plugin install vagrant-libvirt Installing the 'vagrant-libvirt' plugin. This can take a few minutes... Building native extensions. This could take a while... Installed the plugin 'vagrant-libvirt (0.12.1)'! ... uname -s ; cat Vagrantfile.$DISTRO Linux ... Downloaded 481Mb in 4.096201s. Cache hit for vagrant-8be35383dc00f23d080ff00b2a724c938d650254861f26b67624c28e3fe5e6ae! ... Vagrant failed to initialize at a very early stage: The plugins failed to initialize correctly. This may be due to manual modifications made within the Vagrant home directory. ... Error message given during initialization: Unable to resolve dependency: user requested 'vagrant-libvirt (= 0.12.0)' ... The problem is, vagrant cache overwrites newer plugin with an older one. Let's only cache the downloaded image. Also, change the cache fingerprint script (remove "Linux"). Signed-off-by: Kir Kolyshkin (cherry picked from commit 650efb2c2234dd7c85191d9e051392044dd12fae) Signed-off-by: Kir Kolyshkin --- .cirrus.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.cirrus.yml b/.cirrus.yml index aa66ca434..fcc82f37d 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -47,8 +47,8 @@ task: apt-get install -y --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev vagrant plugin install vagrant-libvirt vagrant_cache: - fingerprint_script: uname -s ; cat Vagrantfile.$DISTRO - folder: /root/.vagrant.d + fingerprint_script: cat Vagrantfile.$DISTRO + folder: /root/.vagrant.d/boxes vagrant_up_script: | ln -sf Vagrantfile.$DISTRO Vagrantfile # Retry if it fails (download.fedoraproject.org returns 404 sometimes) From 7fa912ed2300ee559c12201bbf04ad6a2bf5406e Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 23 May 2023 11:48:49 -0700 Subject: [PATCH 7/7] ci/cirrus: limit numcpu ... so we can run all four jobs in parallel. While at it, fix the comment in the file. Signed-off-by: Kir Kolyshkin (cherry picked from commit bb4dbbc4f506a4565d08764ccec50e9bf4523142) Signed-off-by: Kir Kolyshkin --- .cirrus.yml | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/.cirrus.yml b/.cirrus.yml index fcc82f37d..6ad738e35 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -1,7 +1,8 @@ --- -# We use Cirrus for Vagrant tests and native CentOS 7 and 8, because macOS -# instances of GHA are too slow and flaky, and Linux instances of GHA do not -# support KVM. +# We use Cirrus for CentOS (native) and Fedora (in Vagrant), because neither +# CentOS nor Fedora is available on GHA natively, so the only option is VM. +# In GHA, nested virtualization is only supported on macOS instances, which +# are slow and flaky. # NOTE Cirrus execution environments lack a terminal, needed for # some integration tests. So we use `ssh -tt` command to fake a terminal. @@ -24,9 +25,9 @@ task: platform: linux nested_virtualization: true # CPU limit: `16 / NTASK`: see https://cirrus-ci.org/faq/#are-there-any-limits - cpu: 8 + cpu: 4 # Memory limit: `4GB * NCPU` - memory: 32G + memory: 16G host_info_script: | uname -a