Repository navigation
Run the real-bubblewrap test suites in CI, refusing to skip - #171
Merged
Merged
Conversation
GitHub's ubuntu-latest is Ubuntu 24.04, where kernel.apparmor_restrict_unprivileged_userns=1 makes every bwrap jail fail, and tests/bwrap_isolation.rs and tests/bwrap_fd_leak.rs then print "skipped" and pass. No job set TINYBOX_REQUIRE_BWRAP, so main's CI never ran them. A bwrap-live job now makes unprivileged bwrap usable (new scripts/ci/prepare-bwrap.sh, shared with the native-resource setup) and runs both suites and the bwrap unit tests with TINYBOX_REQUIRE_BWRAP=1, so a skip fails the job.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Title check |  |
This assessment has not completed. The check will be retried on the next pre-merge check run. |
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Tiny Sweeper reviewReviewed head: Verdict: Ready for maintainer review · Priority: none Diagnostics and supporting detailsFull summaryPull request purpose (title): Run the real-bubblewrap test suites in CI, refusing to skip. Tiny Sweeper completed its review; deterministic results follow. Review snapshot
Completeness: Complete What changedAdds a `bwrap-live` CI job and a shared `scripts/ci/prepare-bwrap.sh` that installs bubblewrap and disables the AppArmor unprivileged-userns restriction; `prepare-rootless-native-resources.sh` now sources that script instead of duplicating the sysctl step. The job removes pasta and runs the bwrap integration and unit suites with `TINYBOX_REQUIRE_BWRAP=1`. Features
TestsNo supported feature-to-test mapping was produced. Test execution is not inferred. FindingsNo active actionable findings. Before mergeNone. Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
![tinysweeper[bot]](https://avatars.githubusercontent.com/in/4526585?s=60&v=4){kind=small}
tinysweeper
Bot
added
the
priority: p3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Main's CI never ran the real-bubblewrap tests.
ubuntu-latestis now Ubuntu 24.04, wherekernel.apparmor_restrict_unprivileged_userns=1makes every unprivileged bwrap jail fail.tests/bwrap_isolation.rsandtests/bwrap_fd_leak.rsthen printskipped: bwrap or unprivileged user namespaces unavailableand pass, unlessTINYBOX_REQUIRE_BWRAP=1is set.A new
bwrap-livejob:scripts/ci/prepare-bwrap.sh, which installsbubblewrapand lifts the AppArmor sysctl;TINYBOX_REQUIRE_BWRAP=1, so an unusable bwrap fails the job instead of skipping.prepare-rootless-native-resources.shnow sources the same script for its sysctl step, so the setup lives in one place.This job removes the image's preinstalled
passtfirst (it comes in as a podman Recommends) and checks thatpastais gone, so it covers the default shared-host-network path. The pasta job in #170 covers the private-network path with the same setup script pluspasst.Related issue
None filed. Found while proving #160 and #161, whose bwrap tests had only been run on our Linux CI runner.
API or behavior changes
None. CI only.
Validation
This PR's own
bwrap-liverun is the proof. It must show the bwrap tests running, with[bwrap-real]lines in the log and noskipped:lines. The same suites, withTINYBOX_REQUIRE_BWRAP=1, pass on our Linux CI runner (bubblewrap 0.9.0).Checklist
#[allow(...)],#[ignore], or relaxed lints.envcontents in the diff or the description