mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-14 04:51:43 +00:00
f7878cc385
Docker 26+ configures container networking (veth pair, IP addresses, routes) after task creation rather than before. Kata's endpoint scan runs during CreateSandbox, before the interfaces exist, resulting in VMs starting without network connectivity (no -netdev passed to QEMU). Add RescanNetwork() which runs asynchronously after the Start RPC. It polls the network namespace until Docker's interfaces appear, then hotplugs them to QEMU and informs the guest agent to configure them inside the VM. Additional fixes: - mountinfo parser: find fs type dynamically instead of hardcoded field index, fixing parsing with optional mount tags (shared:, master:) - IsDockerContainer: check CreateRuntime hooks for Docker 26+ - DockerNetnsPath: extract netns path from libnetwork-setkey hook args with path traversal protection - detectHypervisorNetns: verify PID ownership via /proc/pid/cmdline to guard against PID recycling - startVM guard: rescan when len(endpoints)==0 after VM start Fixes: #9340 Signed-off-by: llink5 <llink5@users.noreply.github.com>
167 lines
5.2 KiB
YAML
167 lines
5.2 KiB
YAML
name: CI | Basic s390x tests
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
tarball-suffix:
|
|
required: false
|
|
type: string
|
|
commit-hash:
|
|
required: false
|
|
type: string
|
|
target-branch:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
run-containerd-sandboxapi:
|
|
name: run-containerd-sandboxapi
|
|
strategy:
|
|
# We can set this to true whenever we're 100% sure that
|
|
# the all the tests are not flaky, otherwise we'll fail
|
|
# all the tests due to a single flaky instance.
|
|
fail-fast: false
|
|
matrix:
|
|
containerd_version: ['active']
|
|
vmm: ['qemu-runtime-rs']
|
|
# TODO: enable me when https://github.com/containerd/containerd/issues/11640 is fixed
|
|
if: false
|
|
runs-on: s390x-large
|
|
env:
|
|
CONTAINERD_VERSION: ${{ matrix.containerd_version }}
|
|
GOPATH: ${{ github.workspace }}
|
|
KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
SANDBOXER: "shim"
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ inputs.commit-hash }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Rebase atop of the latest target branch
|
|
run: |
|
|
./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
env:
|
|
TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
- name: Install yq
|
|
run: |
|
|
./ci/install_yq.sh
|
|
env:
|
|
INSTALL_IN_GOPATH: false
|
|
|
|
- name: Read properties from versions.yaml
|
|
run: |
|
|
go_version="$(yq '.languages.golang.version' versions.yaml)"
|
|
[ -n "$go_version" ]
|
|
echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
|
|
|
|
- name: Setup Golang version ${{ env.GO_VERSION }}
|
|
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
|
|
- name: Install dependencies
|
|
run: bash tests/integration/cri-containerd/gha-run.sh install-dependencies
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
- name: get-kata-tarball
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
|
|
path: kata-artifacts
|
|
|
|
- name: Install kata
|
|
run: bash tests/integration/cri-containerd/gha-run.sh install-kata kata-artifacts
|
|
|
|
- name: Run containerd-sandboxapi tests
|
|
timeout-minutes: 10
|
|
run: bash tests/integration/cri-containerd/gha-run.sh run
|
|
|
|
run-containerd-stability:
|
|
name: run-containerd-stability
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
containerd_version: ['lts', 'active']
|
|
vmm: ['qemu']
|
|
runs-on: s390x-large
|
|
env:
|
|
CONTAINERD_VERSION: ${{ matrix.containerd_version }}
|
|
GOPATH: ${{ github.workspace }}
|
|
KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
SANDBOXER: "podsandbox"
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ inputs.commit-hash }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Rebase atop of the latest target branch
|
|
run: |
|
|
./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
env:
|
|
TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
- name: Install dependencies
|
|
run: bash tests/stability/gha-run.sh install-dependencies
|
|
|
|
- name: get-kata-tarball
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
|
|
path: kata-artifacts
|
|
|
|
- name: Install kata
|
|
run: bash tests/stability/gha-run.sh install-kata kata-artifacts
|
|
|
|
- name: Run containerd-stability tests
|
|
timeout-minutes: 15
|
|
run: bash tests/stability/gha-run.sh run
|
|
|
|
run-docker-tests:
|
|
name: run-docker-tests
|
|
strategy:
|
|
# We can set this to true whenever we're 100% sure that
|
|
# all the tests are not flaky, otherwise we'll fail them
|
|
# all due to a single flaky instance.
|
|
fail-fast: false
|
|
matrix:
|
|
vmm: ['qemu']
|
|
runs-on: s390x-large
|
|
env:
|
|
KATA_HYPERVISOR: ${{ matrix.vmm }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ inputs.commit-hash }}
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Rebase atop of the latest target branch
|
|
run: |
|
|
./tests/git-helper.sh "rebase-atop-of-the-latest-target-branch"
|
|
env:
|
|
TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
|
|
- name: Install dependencies
|
|
run: bash tests/integration/docker/gha-run.sh install-dependencies
|
|
|
|
- name: get-kata-tarball
|
|
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
|
|
with:
|
|
name: kata-static-tarball-s390x${{ inputs.tarball-suffix }}
|
|
path: kata-artifacts
|
|
|
|
- name: Install kata
|
|
run: bash tests/integration/docker/gha-run.sh install-kata kata-artifacts
|
|
|
|
- name: Run docker smoke test
|
|
timeout-minutes: 5
|
|
run: bash tests/integration/docker/gha-run.sh run
|