[PATCH v2 1/2] testsuite: Support cleanup on rootless build files in test-container

[PATCH v2 1/2] testsuite: Support cleanup on rootless build files in test-container

[Zhihang Wei]

When running tests with rootless builds, some files created with the user
namespace inside the container cannot be removed by the calling user after
the test-container exits without sudo. Add the `--clean-rootless-files`
option to the test-container entrypoint to clean up such files before
leaving the container.

The cleanup is only performed for rootless builds and only removes files
that cannot be cleaned up without sudo outside the container. Other build
artifacts are left untouched so they remain available for CI artifact
collection and post-test inspection.

Signed-off-by: Zhihang Wei <wzh@ilbers.de>
---
 .../dockerdata/test-container-entrypoint      | 38 +++++++++++++++++--
 1 file changed, 34 insertions(+), 4 deletions(-)

diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
index e4714942..745d181b 100755
--- a/testsuite/dockerdata/test-container-entrypoint
+++ b/testsuite/dockerdata/test-container-entrypoint
@@ -17,6 +17,8 @@ else
 	shift 1
 fi
 
+clean_rootless_files=0
+
 export args="--max-parallel-tasks=1 --disable-sysinfo"
 for arg in $*; do
 	case "$arg" in
@@ -29,15 +31,19 @@ for arg in $*; do
 	--shell)
 		export start_shell=1
 		;;
+	--clean-rootless-files)
+		clean_rootless_files=1
+		;;
 	--help)
 		cat <<EOF
 Usage: run-tests.sh [params] ...
 
 Supported parameters:
-  --clean		Purge results of previous test runs before starting.
-  --debug		Use '--show=app,test' log settings for avocado.
-  --shell		Drop into shell rather than starting tests.
-  --help		Show this help message.
+  --clean					Purge results of previous test runs before starting.
+  --debug					Use '--show=app,test' log settings for avocado.
+  --shell					Drop into shell rather than starting tests.
+  --clean-rootless-files	Clean up files created by rootless builds with unshare after the tests finish. 
+  --help					Show this help message.
 
 Any other parameters are passed to "avocado run". Its usage is:
 
@@ -59,6 +65,15 @@ case "$args" in
 	;;
 esac
 
+case "$args" in
+	*"-p rootless=1"*)
+		;;
+	*)
+		clean_rootless_files=0
+		;;
+esac
+export clean_rootless_files
+
 mkdir /isar
 
 busybox syslogd
@@ -72,6 +87,21 @@ echo exit | /container-entrypoint
 gosu builder sh -c '
 set -e
 
+cleanup_rootless_files()
+{
+	rc=$?
+
+	if [ "${clean_rootless_files}" = 1 ]; then
+		find build \
+			\( ! -user "$(whoami)" -type d -prune \) \
+			-exec ./scripts/isar-clean-builddir --rootless {} \;
+	fi
+
+	exit ${rc}
+}
+
+trap cleanup_rootless_files EXIT
+
 base_dir=/work/build/testsuite
 
 mkdir -p ${base_dir}/overlay/upper
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260716144145.1495181-1-wzh%40ilbers.de.

[PATCH v2 2/2] ci: Add GitLab CI pipeline for rootless builds

[Zhihang Wei]

Add a GitLab CI pipeline to test rootless builds.

The pipeline reuses the existing test-container and is intended to run on
a rootless shell runner.

Signed-off-by: Zhihang Wei <wzh@ilbers.de>
---
 .gitlab-ci.yml | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0711f200..c880663b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -34,6 +34,36 @@ variables:
     when: always
     expire_in: 1 week
 
+.rootless-build: &rootless-build
+  stage: build
+  variables:
+    RUNNER_AFTER_SCRIPT_TIMEOUT: 15m
+  before_script:
+    - export http_proxy=$HTTP_PROXY
+    - export https_proxy=$HTTPS_PROXY
+    - export ftp_proxy=$FTP_PROXY
+    - export no_proxy=$NO_PROXY
+    - export DISTRO_APT_PREMIRRORS=$DISTRO_APT_PREMIRRORS
+  after_script:
+    - |
+      if [[ -n "${SSTATE_LOCATION}" ]] && [[ -d "sstate-cache" ]]; then
+        echo "=== Upload sstate artifacts to ${SSTATE_LOCATION} ==="
+        ./scripts/isar-sstate --filter '^(?!isar-image-)' upload "sstate-cache" "${SSTATE_LOCATION}"
+        ./scripts/isar-sstate info -v "${SSTATE_LOCATION}"
+      fi
+
+  artifacts:
+    name: "logs-$CI_JOB_ID"
+    paths:
+      - build/testsuite/tmp*/work/*/*/*/temp
+      - build/testsuite/job-results
+      - build/testsuite/vm_start
+    reports:
+      junit:
+        - build/testsuite/job-results/job*/results.xml
+    when: always
+    expire_in: 1 week
+
 
 .test-container: &test-container
   image: ghcr.io/ilbers/isar/test-container:1
@@ -113,6 +143,17 @@ full-ci-isar:
   script:
     - scripts/ci_build.sh --sstate 1 -T full
 
+
+dev-rootless-ci:
+  tags:
+    - shell-rootless
+  <<: *rootless-build
+  rules:
+    - if: $TESTSUITE == 'dev-rootless' || $CI_PIPELINE_SOURCE != 'schedule'
+  script:
+    - scripts/run-tests.sh --debug --clean-rootless-files testsuite/citest.py:test_dev$ -p rootless=1
+
+
 sstate-cache-info:
   stage: build
   when: manual
-- 
2.39.5

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260716144145.1495181-2-wzh%40ilbers.de.

Re: [PATCH v2 1/2] testsuite: Support cleanup on rootless build files in test-container

[Zhihang Wei]

Applied to next.

Zhihang

On 7/16/26 16:41, Zhihang Wei wrote:
> When running tests with rootless builds, some files created with the user
> namespace inside the container cannot be removed by the calling user after
> the test-container exits without sudo. Add the `--clean-rootless-files`
> option to the test-container entrypoint to clean up such files before
> leaving the container.
>
> The cleanup is only performed for rootless builds and only removes files
> that cannot be cleaned up without sudo outside the container. Other build
> artifacts are left untouched so they remain available for CI artifact
> collection and post-test inspection.
>
> Signed-off-by: Zhihang Wei <wzh@ilbers.de>
> ---
>   .../dockerdata/test-container-entrypoint      | 38 +++++++++++++++++--
>   1 file changed, 34 insertions(+), 4 deletions(-)
>
> diff --git a/testsuite/dockerdata/test-container-entrypoint b/testsuite/dockerdata/test-container-entrypoint
> index e4714942..745d181b 100755
> --- a/testsuite/dockerdata/test-container-entrypoint
> +++ b/testsuite/dockerdata/test-container-entrypoint
> @@ -17,6 +17,8 @@ else
>   	shift 1
>   fi
>   
> +clean_rootless_files=0
> +
>   export args="--max-parallel-tasks=1 --disable-sysinfo"
>   for arg in $*; do
>   	case "$arg" in
> @@ -29,15 +31,19 @@ for arg in $*; do
>   	--shell)
>   		export start_shell=1
>   		;;
> +	--clean-rootless-files)
> +		clean_rootless_files=1
> +		;;
>   	--help)
>   		cat <<EOF
>   Usage: run-tests.sh [params] ...
>   
>   Supported parameters:
> -  --clean		Purge results of previous test runs before starting.
> -  --debug		Use '--show=app,test' log settings for avocado.
> -  --shell		Drop into shell rather than starting tests.
> -  --help		Show this help message.
> +  --clean					Purge results of previous test runs before starting.
> +  --debug					Use '--show=app,test' log settings for avocado.
> +  --shell					Drop into shell rather than starting tests.
> +  --clean-rootless-files	Clean up files created by rootless builds with unshare after the tests finish.
> +  --help					Show this help message.
>   
>   Any other parameters are passed to "avocado run". Its usage is:
>   
> @@ -59,6 +65,15 @@ case "$args" in
>   	;;
>   esac
>   
> +case "$args" in
> +	*"-p rootless=1"*)
> +		;;
> +	*)
> +		clean_rootless_files=0
> +		;;
> +esac
> +export clean_rootless_files
> +
>   mkdir /isar
>   
>   busybox syslogd
> @@ -72,6 +87,21 @@ echo exit | /container-entrypoint
>   gosu builder sh -c '
>   set -e
>   
> +cleanup_rootless_files()
> +{
> +	rc=$?
> +
> +	if [ "${clean_rootless_files}" = 1 ]; then
> +		find build \
> +			\( ! -user "$(whoami)" -type d -prune \) \
> +			-exec ./scripts/isar-clean-builddir --rootless {} \;
> +	fi
> +
> +	exit ${rc}
> +}
> +
> +trap cleanup_rootless_files EXIT
> +
>   base_dir=/work/build/testsuite
>   
>   mkdir -p ${base_dir}/overlay/upper

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/0d8b791d-3115-48a5-b811-7f13f732d07f%40ilbers.de.