Dockerfile.test: add "cri-in-userns" (aka rootless) test stage#5700
Merged
estesp merged 1 commit intocontainerd:mainfrom Jul 9, 2021
Merged
Dockerfile.test: add "cri-in-userns" (aka rootless) test stage#5700estesp merged 1 commit intocontainerd:mainfrom
estesp merged 1 commit intocontainerd:mainfrom
Conversation
|
Skipping CI for Draft Pull Request. |
AkihiroSuda
force-pushed
the
test-cri-in-userns
branch
3 times, most recently
from
deafa71 to
ec67e55
Compare
AkihiroSuda
force-pushed
the
test-cri-in-userns
branch
from
ec67e55 to
a76ee4a
Compare
AkihiroSuda
force-pushed
the
test-cri-in-userns
branch
from
a76ee4a to
d6d21cd
Compare
AkihiroSuda
force-pushed
the
test-cri-in-userns
branch
from
d6d21cd to
ab3589f
Compare
|
Build succeeded.
|
Member
Author
|
/skip (Kubernetes CI has been broken recently #5695) |
mikebrow
approved these changes
Jul 8, 2021
Member
There was a problem hiding this comment.
nit... as far as names go "CGroupsV2 and SELinux Integration" and "CGroupsV2 (misc)" are not very descriptive names :-)
Suggest:
"CGroupsV2 - SELinux enforced CRI test (macOS nested)"
"CGroupsV2 - rootless CRI test (macOS nested)"
Member
Author
There was a problem hiding this comment.
Changed to CGroupsV2 - SELinux enforced and CGroupsV2 - rootless CRI test.
I don't think "macOS nested" is important here (and we don't want to use macOS just for nested VM)
The `cri-in-userns` stage is for testing "CRI-in-UserNS", which should be used in conjunction with "Kubelet-in-UserNS": https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless This feature is mostly expected to be used for `kind` and `minikube`. Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/ (Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves) Usage: ``` podman build --target cri-in-userns -t cri-in-userns -f contrib/Dockerfile.test . podman run -it --rm --privileged cri-in-userns ``` The stage is tested on CI with Rootless Podman on Fedora 34 on Vagrant. Signed-off-by: Akihiro Suda <[email protected]>
AkihiroSuda
force-pushed
the
test-cri-in-userns
branch
from
ab3589f to
aefabe5
Compare
|
Build succeeded.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
cri-in-usernsstage is for testing "CRI-in-UserNS", which should be used in conjunction with "Kubelet-in-UserNS":https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/2033-kubelet-in-userns-aka-rootless
This feature is mostly expected to be used for
kindandminikube(but not limited to them):Requires Rootless Docker/Podman/nerdctl with cgroup v2 delegation: https://rootlesscontaine.rs/getting-started/common/cgroup2/
Usage:
Rootless Docker/Podman/nerdctl prepares the UserNS, so we do not need to create UserNS by ourselves.
The stage is tested on CI with Rootless Podman on Fedora 34 on Vagrant.
(Podman was chosen simply because it is available in dnf)