test: skip test on rootless cgroupsv1#11798
test: skip test on rootless cgroupsv1#11798openshift-merge-robot merged 2 commits intocontainers:mainfrom
Conversation
|
Should the podman run/create code prevent the user from doing this? |
edsantiago
left a comment
There was a problem hiding this comment.
Thank you for adding a helper! Could you also use it in
podman/test/system/420-cgroups.bats
Lines 11 to 13 in cd10304
test/system/helpers.bash
Outdated
There was a problem hiding this comment.
This is misleading; it should include something about cgroupsv1 as well. Perhaps:
...not supported as rootless under cgroupsv1}"
skip the test "podman selinux: shared context in (some) namespaces" on cgroupsv1 when running as rootless since the tests requires --pid=container:. If the container runtime cannot use cgroupsv1 and the container has no pid namespace. then it is not possible to correctly terminate the container. Without a cgroup or a pid namespace, the runtime has no control on what processes are in the container. Closes: containers#11785 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
dad88bc to
5c1b3e8
Compare
It should be the OCI runtime to raise an error since it creates the cgroup, and if it fails then it can check if there is a PID namespace. I am not sure though if we block valid use cases doing so., the worse that can happen is to leak processes in the initial container PID namespace |
|
LGTM, thank you! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, Luap99 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
|
/hold cancel |
skip the test "podman selinux: shared context in (some) namespaces" on
cgroupsv1 when running as rootless since the tests requires
--pid=container:.
If the container runtime cannot use cgroupsv1 and the container has no
pid namespace. then it is not possible to correctly terminate the
container. Without a cgroup or a pid namespace, the runtime has no
control on what processes are in the container.
Closes: #11785
Signed-off-by: Giuseppe Scrivano gscrivan@redhat.com
What this PR does / why we need it:
fix a failing test on rootless and cgroups v1
How to verify it
run the test on cgroups v1 and rootless
Which issue(s) this PR fixes:
Fixes #11785
Special notes for your reviewer: