Repository navigation
[pull] main from NVIDIA:main - #295
Merged
Merged
Conversation
…e CI gaps (#3690) * test(podman): run driver-podman userns suite against rootful Podman too The driver-specific-integration job only ran the driver-podman testsuite (default/auto/keep-id/private userns reference checks) against fedora-podman-rootless, leaving rootful behavior for this scenario unverified even though the compute driver auto-detects and explicitly supports rootful Podman. The default-userns-baseline and userns-profile playbooks hard-asserted a rootless tmachine gateway user, so pointing them at a rootful environment would have failed that assertion immediately rather than exercising anything. They now detect rootful vs. rootless via the existing tmachine_container_runtime role and branch the reference-capture user accordingly, while keeping the captured reference file itself owned by tmachine, since the archived test binary that reads it back always runs unprivileged as tmachine regardless of daemon mode. Signed-off-by: politerealism <burdcat17@gmail.com> * test(podman): add real-daemon coverage for resource limits and daemon failure Neither the Podman driver's resource-limit enforcement nor its behavior when the Podman daemon is unreachable had any test coverage against a real daemon; both were only exercised through unit tests against a mocked Podman client. podman_resource_limits.rs creates a sandbox with --cpu/--memory flags and reads /sys/fs/cgroup/memory.max and cpu.max from inside the sandbox itself, verifying the limit is actually enforced rather than just echoed back by the template API. Expected values are cross-checked against the driver's own parse_cpu_to_microseconds/parse_memory_to_bytes and against a real local `podman run --cpus/--memory` container. podman_preflight.rs spawns the standalone openshell-driver-podman binary against a guaranteed-nonexistent Podman socket and asserts it exits non-zero within its bounded retry window with an actionable error naming the socket path, rather than hanging or failing silently. Signed-off-by: politerealism <burdcat17@gmail.com> * test(podman): make rootful userns and cgroup checks pass Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(podman): match lifecycle containers by isolation role label Signed-off-by: Drew Newberry <anewberry@nvidia.com> * test(podman): accept non-expiring bootstrap tokens Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: politerealism <burdcat17@gmail.com> Signed-off-by: Drew Newberry <anewberry@nvidia.com> Co-authored-by: Drew Newberry <anewberry@nvidia.com>
Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(policy): restore policy.local and proposal conformance Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test(conformance): select policy scenarios by name Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test(conformance): reduce policy scenario timing flakes Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> * test(conformance): assert proposals target Bash Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com> --------- Signed-off-by: Piotr Mlocek <pmlocek@nvidia.com>
* fix(sandbox): preserve exec output through channel close Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(exec): propagate output delivery failures before exit Signed-off-by: Drew Newberry <anewberry@nvidia.com> * docs(cli): clarify exec output delivery failures Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* fix(cli): stream piped exec stdin across gRPC messages Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(cli): preserve small exec requests and surface stdin errors Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(cli): preserve exec stdin limit across gRPC streaming Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
* feat(cli): import provider profiles from HTTP URLs Signed-off-by: Drew Newberry <anewberry@nvidia.com> * fix(cli): initialize crypto provider for remote profiles Signed-off-by: Drew Newberry <anewberry@nvidia.com> --------- Signed-off-by: Drew Newberry <anewberry@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )