[matthewgrossman]

Summary

Trim the host Podman lane (podman-e2e / E2E (rust-podman-ci, ubuntu-26.04)) to the six e2e/rust binaries that no other lane runs, and stop it running conformance. tmachine already covers everything else this lane ran.

Related Issue

Closes #5423 (part of #5281)

Changes

• e2e/rust/e2e-podman.sh: PODMAN_CI_TESTS goes from 23 binaries to 6. The ci set no longer runs openshell-conformance.
• .github/workflows/branch-e2e.yml: podman-e2e no longer needs build-conformance or downloads the prebuilt conformance program.
• tests/tmachine/artifacts.nix: the podmanE2eFollowUpBinaries comment points at the new host list.
• tasks/test.toml: the e2e:podman:ci description says what it now runs.

Verification

I compared the jobs in Branch E2E run 42694439028: the host lane, podman-e2e-integration (tmachine e2e-podman row), the tmachine conformance rows, and docker-e2e / rust-docker.

1. e2e/rust binaries. The tmachine row ran 58 tests across 36 binaries, all passing. It includes 17 of the 23 host binaries, plus about 11 the host lane didn't run. The six it doesn't cover:

Binary	Why tmachine skips it	Other coverage
provider_token_exchange	needs the SPIFFE fixture	none (needs e2e-podman)
podman_corporate_proxy	wrapper-owned gateway config	Docker and VM equivalents only
podman_gateway_start	wrapper-owned gateway restart	Docker equivalent only
local_driver_token_restart	wrapper-owned gateway restart	rust-docker
driver_config_volume	needs allow_driver_config and enable_bind_mounts	rust-docker
otlp_relay	runs, but only the host lane sets OPENSHELL_E2E_OTLP_ENDPOINT. Elsewhere its two collector cases skip themselves and pass.	none for the collector cases

The first five are the "wrapper lane" entries in podmanE2eFollowUpBinaries. The host lane keeps the env it set for these: the SPIFFE fixture and the OTLP endpoint are still set, because both are keyed on the selected tests. The host lane runs Ubuntu 26.04 with Ubuntu's Podman 5.7.0 as the runner user. The tmachine row runs Fedora rootless Podman with a binaries-installed gateway.

2. Conformance. The host lane and the tmachine fedora-podman-rootless row ran the same 15 openshell-conformance tests (checked against that row's junit.xml). The fedora-podman-rootful row runs them too. Nothing is lost by skipping it here.

3. Other callers. No other workflow uses this lane or e2e:podman:ci: not Release Dev, Pre-release or Release Canary. Core E2E result still needs podman-e2e, unchanged. podman-additional-ca-e2e and podman-external-driver-e2e are separate lanes and unchanged. No skills or docs pages name this lane.

Why trim instead of delete

The #5297 plan ports all six binaries to testkit: driver_config_volume and local_driver_token_restart in PR5, the rest in PR6. Deleting the lane now would leave them uncovered until those land. Trimming keeps their coverage, and each port removes its entry from PODMAN_CI_TESTS. After PR6, the podman-e2e job and e2e:podman:ci can be deleted.

Trade-off

• Kept: the six host-only binaries still run on Ubuntu's packaged Podman on a bare runner.
• Lost: the other 17 binaries and conformance no longer run on Ubuntu's Podman. They still run on Fedora Podman in tmachine.
• Saved: in the run above, conformance took about 1.5 min and the dropped tests about 5 min. I expect the lane to fall from about 13 to about 6.5 min, and it no longer waits on build-conformance. It still builds e2e/rust. It's not the slowest lane, so wall time doesn't improve. Fewer Podman stop/start tests run here, so it's less exposed to the ContainerExited flake (bug(podman): polled snapshot moves a restarting sandbox from Starting to Error (ContainerExited) #5258, fix in fix(server): skip the reconcile poll of a sandbox whose start is in progress #5265).

Testing

• shellcheck -x e2e/rust/e2e-podman.sh
• actionlint .github/workflows/branch-e2e.yml
• Branch E2E run 42707934133: podman-e2e ran only the six binaries (11 tests, all passed), skipped conformance, and took 5 min 44 s (was about 13 min). The first attempt failed on an unrelated GHCR push permission_denied in build-images / gateway; a rerun passed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[matthewgrossman]

/ok to test 48b2996

[github-actions]

Label test:e2e applied for 48b2996. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-5424.docs.buildwithfern.com/openshell

[matthewgrossman]

Closing without merging. Trimming the lane now adds a second list to keep in sync with podmanE2eFollowUpBinaries while the #5297 migration is moving these tests. The job will be deleted in one step after #5297 PR6 ports the last host-only binaries; tracked in #5423. The verification in this PR's description still applies.