test(e2e): run podman suite with tmachine

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

.github/workflows/branch-e2e.yml

@@ -261,6 +261,7 @@ jobs:
       test-matrix: >-
         [
           {"environment":"fedora-podman-rootful","installer":"binaries","testsuite":"driver-podman"},
+          {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"e2e-podman"},
           {"environment":"fedora-podman-rootless","installer":"binaries","testsuite":"driver-podman"}
         ]
 

TESTING.md

@@ -254,6 +254,23 @@ Rust tests that still apply. Run the Podman-backed Rust CLI e2e suite:
 mise run e2e:podman
 ```
 
+Run the portable subset in a disposable rootless Podman guest:
+
+```shell
+nix run .#build-artifacts
+nix run .#tmachine -- test fedora-podman-rootless binaries e2e-podman
+nix run .#tmachine -- test fedora-podman-rootless binaries driver-podman
+```
+
+The `e2e-podman` testsuite runs a nextest archive built with the corresponding
+Rust feature. The separate `driver-podman` testsuite compares OpenShell and
+direct Podman user-namespace mappings for the default, `auto`, `keep-id`, and
+private profiles. The E2E archive excludes binaries that still depend on
+wrapper-owned gateway controls, host fixtures, missing guest tools, or
+nondeterministic relay setup.
+`tests/artifacts.nix` keeps the explicit follow-up list so those binaries cannot
+appear as false passes or silently re-enter the archive.
+
 Run the VM-backed Rust CLI e2e suite:
 
 ```shell

e2e/rust/tests/live_policy_update.rs

@@ -32,6 +32,11 @@ use openshell_e2e::harness::output::{extract_field, strip_ansi};
 use openshell_e2e::harness::sandbox::SandboxGuard;
 use tempfile::NamedTempFile;
 
+const SPARSE_POLICY: &str = include_str!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../examples/policy-advisor/sandbox-policy.yaml"
+));
+
 // ---------------------------------------------------------------------------
 // Policy YAML builders
 // ---------------------------------------------------------------------------
@@ -126,6 +131,15 @@ landlock:
     Ok(file)
 }
 
+fn write_sparse_policy() -> Result<NamedTempFile, String> {
+    let mut file = NamedTempFile::new().map_err(|e| format!("create temp policy file: {e}"))?;
+    file.write_all(SPARSE_POLICY.as_bytes())
+        .map_err(|e| format!("write temp policy file: {e}"))?;
+    file.flush()
+        .map_err(|e| format!("flush temp policy file: {e}"))?;
+    Ok(file)
+}
+
 // ---------------------------------------------------------------------------
 // CLI helpers
 // ---------------------------------------------------------------------------
@@ -629,18 +643,18 @@ async fn live_policy_update_from_empty_network_policies() {
 /// no revision remaining `Pending` once the acknowledgement lands.
 #[tokio::test]
 async fn initial_sparse_policy_is_acknowledged_as_loaded() {
-    // Repo-relative path to the sparse network-only policy fixture.
-    let sparse_policy = concat!(
-        env!("CARGO_MANIFEST_DIR"),
-        "/../../examples/policy-advisor/sandbox-policy.yaml"
-    );
+    let sparse_policy = write_sparse_policy().expect("write sparse policy fixture");
+    let sparse_policy_path = sparse_policy
+        .path()
+        .to_str()
+        .expect("sparse policy path is not UTF-8");
 
     let mut guard = SandboxGuard::create_keep_with_args(
         &[
             "--name",
             "e2e-sparse-enrich",
             "--policy",
-            sparse_policy,
+            sparse_policy_path,
             "--no-tty",
         ],
         &["sh", "-c", "echo Ready && sleep infinity"],

tests/ansible/playbooks/drivers/podman/e2e.yaml

@@ -0,0 +1,95 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+---
+- name: Run Podman E2E archive tests
+  hosts: all
+  gather_facts: false
+  vars:
+    podman_e2e_test_root: /var/lib/openshell-driver-tests/podman-e2e
+  tasks:
+    - name: Wait for SSH
+      ansible.builtin.wait_for_connection:
+
+    - name: Create Podman E2E test directory
+      become: true
+      ansible.builtin.file:
+        path: "{{ podman_e2e_test_root }}"
+        state: directory
+        owner: tmachine
+        group: tmachine
+        mode: "0700"
+
+    - name: Install Podman E2E test bundle
+      become: true
+      ansible.builtin.unarchive:
+        src: "{{ openshell_podman_e2e_test_bundle }}"
+        dest: "{{ podman_e2e_test_root }}"
+        owner: tmachine
+        group: tmachine
+
+    - name: Remove any previous OpenShell gateway registration
+      ansible.builtin.command:
+        argv: [/usr/local/bin/openshell, gateway, remove, tmachine]
+      changed_when: false
+      failed_when: false
+
+    - name: Register the configured OpenShell gateway
+      ansible.builtin.command:
+        argv: [/usr/local/bin/openshell, gateway, add, http://127.0.0.1:17670, --local, --name, tmachine]
+
+    - name: Run Podman E2E archive tests
+      ansible.builtin.command:
+        argv:
+          - cargo-nextest
+          - nextest
+          - run
+          - --archive-file
+          - "{{ podman_e2e_test_root }}/tests.tar.zst"
+          - --workspace-remap
+          - "{{ podman_e2e_test_root }}"
+          - --test-threads
+          - "1"
+          - --no-fail-fast
+      environment:
+        CONTAINER_ENGINE: podman
+        CONTAINER_HOST: unix:///run/user/1000/podman/podman.sock
+        HOME: /home/tmachine
+        OPENSHELL_BIN: /usr/local/bin/openshell
+        OPENSHELL_E2E_CONTAINER_ENGINE_UNSET_XDG_CONFIG_HOME: "1"
+        OPENSHELL_E2E_DRIVER: podman
+        OPENSHELL_E2E_NETWORK_NAME: tmachine
+        OPENSHELL_E2E_SANDBOX_NAMESPACE: tmachine
+        OPENSHELL_GATEWAY: tmachine
+        OPENSHELL_PODMAN_SOCKET: /run/user/1000/podman/podman.sock
+        XDG_RUNTIME_DIR: /run/user/1000
+      register: podman_e2e_test_result
+      changed_when: false
+      failed_when: false
+
+    - name: Show Podman E2E test diagnostics
+      ansible.builtin.debug:
+        var: podman_e2e_test_result.stderr_lines
+
+    - name: Show Podman E2E test result
+      ansible.builtin.debug:
+        var: podman_e2e_test_result.stdout_lines
+
+    - name: Capture OpenShell gateway journal after Podman E2E test failure
+      become: true
+      ansible.builtin.command:
+        argv: [journalctl, --unit, openshell-gateway.service, --no-pager, --lines, "200"]
+      changed_when: false
+      failed_when: false
+      when: podman_e2e_test_result.rc != 0
+      register: podman_e2e_gateway_journal
+
+    - name: Show OpenShell gateway journal after Podman E2E test failure
+      ansible.builtin.debug:
+        var: podman_e2e_gateway_journal.stdout_lines
+      when: podman_e2e_test_result.rc != 0
+
+    - name: Require Podman E2E archive success
+      ansible.builtin.assert:
+        that: [podman_e2e_test_result.rc == 0]
+        fail_msg: Podman E2E archive tests failed

tests/ansible/roles/openshell_gateway/templates/gateway-podman.toml.j2

@@ -9,4 +9,5 @@ sandbox_runtime_image = "docker.io/openshell/sandbox:tmachine"
 supervisor_image = "docker.io/openshell/supervisor:tmachine"
 network_name = "tmachine"
 health_check_interval_secs = 10
+stop_timeout_secs = 15
 {% endblock %}

tests/artifacts.nix

@@ -24,6 +24,8 @@ let
       package,
       target,
       output,
+      features ? null,
+      filter ? "kind(test)",
     }:
     pkgs.writeShellApplication {
       name = "build-${name}-test-archive";
@@ -56,7 +58,8 @@ let
           --manifest-path "$manifest_path" \
           --target ${target} \
           -p ${package} \
-          -E 'kind(test)' \
+          ${pkgs.lib.optionalString (features != null) "--features ${pkgs.lib.escapeShellArg features}"} \
+          -E ${pkgs.lib.escapeShellArg filter} \
           --archive-file "$bundle_dir/tests.tar.zst"
 
         cd "$workspace_root"
@@ -92,6 +95,49 @@ let
     target = muslToolchain.target;
     output = "artifacts/test-archives/${muslToolchain.target}/provider-refresh-keycloak-tests.tar";
   };
+
+  # Follow-up: migrate these wrapper-coupled tests once tmachine provides their
+  # managed-gateway controls, SPIFFE fixtures, caller driver-config setting,
+  # guest tools, and matching workload-image identity behavior. The corporate
+  # proxy and gateway-start binaries currently self-skip without wrapper-owned
+  # gateway metadata, so exclude them rather than report false passes. The
+  # dedicated driver-podman suite retains user-namespace coverage.
+  podmanE2eExcludedBinaries = [
+    "credential_gating"
+    "driver_config_volume"
+    "forward_proxy_graphql_l7"
+    "forward_proxy_jsonrpc_l7"
+    "forward_proxy_l7_bypass"
+    "host_gateway_alias"
+    "landlock"
+    "local_driver_token_restart"
+    # Standalone tmachine runs can time out while opening the localhost relay.
+    # Follow up on making the relay setup deterministic before restoring it.
+    "no_proxy"
+    "podman_corporate_proxy"
+    "podman_gateway_start"
+    "podman_oci_identity"
+    "podman_userns"
+    "provider_auto_create"
+    "provider_refresh_handles"
+    "provider_token_exchange"
+    "proxy_egress_pipeline"
+    # Nextest archive filters cannot select individual tests. These binaries
+    # contain both passing cases and cases that need guest tools (`script` and
+    # `git`), so keep the complete binaries in the follow-up bucket.
+    "sandbox_lifecycle"
+    "sync"
+    # Needs a prebuilt musl DNS probe in guest artifact mode; tracked in #3009.
+    "transparent_tcp"
+    "websocket_conformance"
+    "workspace_lifecycle"
+  ];
+  podmanE2eArchiveFilter =
+    let
+      excludedBinaries = map (binary: "binary(=${binary})") podmanE2eExcludedBinaries;
+    in
+    "kind(test) and not (${pkgs.lib.concatStringsSep " or " excludedBinaries})";
+
   podmanDriverArchive = mkTestArchive {
     name = "podman-driver";
     workspacePath = "tests/suites/drivers";
@@ -100,9 +146,24 @@ let
     target = muslToolchain.target;
     output = "artifacts/test-archives/${muslToolchain.target}/openshell-podman-tests.tar";
   };
+  podmanE2eArchive = mkTestArchive {
+    name = "podman-e2e";
+    workspacePath = "e2e/rust";
+    manifestPath = "e2e/rust/Cargo.toml";
+    package = "openshell-e2e";
+    target = muslToolchain.target;
+    output = "artifacts/test-archives/${muslToolchain.target}/openshell-podman-e2e-tests.tar";
+    features = "e2e-podman";
+    filter = podmanE2eArchiveFilter;
+  };
 in
 rec {
-  inherit conformanceCliArchive providerRefreshKeycloakArchive podmanDriverArchive;
+  inherit
+    conformanceCliArchive
+    providerRefreshKeycloakArchive
+    podmanDriverArchive
+    podmanE2eArchive
+    ;
 
   binaries = pkgs.writeShellApplication {
     name = "build-artifacts-binaries";
@@ -148,17 +209,20 @@ rec {
       conformanceCliArchive
       providerRefreshKeycloakArchive
       podmanDriverArchive
+      podmanE2eArchive
     ];
     text = ''
       build-openshell-conformance-test-archive
       build-provider-refresh-keycloak-test-archive
       build-podman-driver-test-archive
+      build-podman-e2e-test-archive
     '';
   };
 
   images = pkgs.writeShellApplication {
     name = "build-artifacts-images";
     runtimeInputs = [
+      pkgs.coreutils
       pkgs.docker-client
       pkgs.git
     ];

tests/config.nix

@@ -133,6 +133,13 @@ let
           provider_refresh_keycloak_test_bundle = "../artifacts/test-archives/${muslTarget}/provider-refresh-keycloak-tests.tar";
         };
       }
+      {
+        name = "e2e-podman";
+        playbooks = [ "ansible/playbooks/drivers/podman/e2e.yaml" ];
+        inputs = {
+          openshell_podman_e2e_test_bundle = "../artifacts/test-archives/${muslTarget}/openshell-podman-e2e-tests.tar";
+        };
+      }
       {
         name = "driver-podman";
         playbooks = [