Repository navigation
Make Incus-based package tests pass on Ubuntu 26.04 runners - #1139
Draft
Watson1978 wants to merge 3 commits into
Draft
Watson1978 wants to merge 3 commits into
Watson1978 wants to merge 3 commits into
Conversation
On Ubuntu 25.04 and later hosts, the peer label of container processes
has a "//&unconfined" suffix. It does not match the generated
"signal peer=@{profile_name}" and "ptrace peer=@{profile_name}" rules.
So even root in the container cannot signal or inspect other processes,
and the postinst of fluent-package fails to kick the auto restart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Shizuo Fujita <fujita@clear-code.com>
On Ubuntu 26.04 hosts, rsyslogd in a container is also confined by the host profile for /usr/sbin/rsyslogd. That profile has no signal rules, so systemd in the container cannot stop it. "systemctl restart rsyslog" then leaves the old rsyslogd running, and it takes part of the syslog messages without forwarding them to Fluentd. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com>
On Ubuntu 26.04, the incus package depends on QEMU and other VM packages, so setting up Incus downloads about 117 MB. The tests only use containers, and incus-base is the container-only daemon. Ubuntu 24.04 does not have incus-base, so fall back to incus there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Shizuo Fujita <fujita@clear-code.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Ubuntu 26.04 runners, AppArmor stacking stops processes in an Incus container from signaling or inspecting each other. The update tests fail with "Permission denied" in postinst, and a stale rsyslogd drops syslog messages.
This adds the missing signal and ptrace rules to the Incus profile and unloads the host rsyslogd profile, which also confines rsyslogd in containers. It also installs incus-base when available, which cuts the setup download from about 117 MB to 30 MB. The release branch (#1107) pins the runners to ubuntu-24.04 for now, and that pin can be dropped after this is merged.
🤖 Generated with Claude Code