Skip to content

Commit b9b6679

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #6511 from nalind/relabel-binds-1.39
[release-1.39] run: handle relabeling bind mounts ourselves, tag 1.39.6
2 parents 5688531 + 46b3277 commit b9b6679

23 files changed

+786
-60
lines changed

‎.cirrus.yml‎

Lines changed: 67 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,8 @@ env:
2222
IN_PODMAN: 'false'
2323
# root or rootless
2424
PRIV_NAME: root
25+
# default "mention the $BUILDAH_RUNTIME in the task alias, with initial whitespace" value
26+
RUNTIME_N: ""
2527

2628
####
2729
#### Cache-image names to test with
@@ -197,36 +199,66 @@ conformance_task:
197199

198200

199201
integration_task:
200-
name: "Integration $DISTRO_NV w/ $STORAGE_DRIVER"
202+
name: "Integration $DISTRO_NV$RUNTIME_N w/ $STORAGE_DRIVER"
201203
alias: integration
202204
skip: *not_build_docs
203205
depends_on: *smoke_vendor
204206

205207
matrix:
206208
# VFS
209+
- env:
210+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
211+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
212+
STORAGE_DRIVER: 'vfs'
213+
BUILDAH_RUNTIME: crun
214+
RUNTIME_N: " using crun"
207215
- env:
208216
DISTRO_NV: "${FEDORA_NAME}"
209217
IMAGE_NAME: "${FEDORA_CACHE_IMAGE_NAME}"
210218
STORAGE_DRIVER: 'vfs'
211-
# Disabled until we update to f40/41 as f39 does not have go 1.22
212-
# - env:
213-
# DISTRO_NV: "${PRIOR_FEDORA_NAME}"
214-
# IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
215-
# STORAGE_DRIVER: 'vfs'
219+
BUILDAH_RUNTIME: runc
220+
RUNTIME_N: " using runc"
221+
- env:
222+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
223+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
224+
STORAGE_DRIVER: 'vfs'
225+
BUILDAH_RUNTIME: crun
226+
RUNTIME_N: " using crun"
227+
- env:
228+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
229+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
230+
STORAGE_DRIVER: 'vfs'
231+
BUILDAH_RUNTIME: runc
232+
RUNTIME_N: " using runc"
216233
- env:
217234
DISTRO_NV: "${DEBIAN_NAME}"
218235
IMAGE_NAME: "${DEBIAN_CACHE_IMAGE_NAME}"
219236
STORAGE_DRIVER: 'vfs'
220237
# OVERLAY
238+
- env:
239+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
240+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
241+
STORAGE_DRIVER: 'overlay'
242+
BUILDAH_RUNTIME: crun
243+
RUNTIME_N: " using crun"
221244
- env:
222245
DISTRO_NV: "${FEDORA_NAME}"
223246
IMAGE_NAME: "${FEDORA_CACHE_IMAGE_NAME}"
224247
STORAGE_DRIVER: 'overlay'
225-
# Disabled until we update to f40/41 as f39 does not have go 1.22
226-
# - env:
227-
# DISTRO_NV: "${PRIOR_FEDORA_NAME}"
228-
# IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
229-
# STORAGE_DRIVER: 'overlay'
248+
BUILDAH_RUNTIME: runc
249+
RUNTIME_N: " using runc"
250+
- env:
251+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
252+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
253+
STORAGE_DRIVER: 'overlay'
254+
BUILDAH_RUNTIME: crun
255+
RUNTIME_N: " using crun"
256+
- env:
257+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
258+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
259+
STORAGE_DRIVER: 'overlay'
260+
BUILDAH_RUNTIME: runc
261+
RUNTIME_N: " using runc"
230262
- env:
231263
DISTRO_NV: "${DEBIAN_NAME}"
232264
IMAGE_NAME: "${DEBIAN_CACHE_IMAGE_NAME}"
@@ -255,25 +287,42 @@ integration_task:
255287
golang_version_script: '$GOSRC/$SCRIPT_BASE/logcollector.sh golang'
256288

257289
integration_rootless_task:
258-
name: "Integration rootless $DISTRO_NV w/ $STORAGE_DRIVER"
290+
name: "Integration rootless $DISTRO_NV$RUNTIME_N w/ $STORAGE_DRIVER"
259291
alias: integration_rootless
260292
skip: *not_build_docs
261293
depends_on: *smoke_vendor
262294

263295
matrix:
264296
# Running rootless tests on overlay
265297
# OVERLAY
298+
- env:
299+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
300+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
301+
STORAGE_DRIVER: 'overlay'
302+
PRIV_NAME: rootless
303+
BUILDAH_RUNTIME: runc
304+
RUNTIME_N: " using runc"
266305
- env:
267306
DISTRO_NV: "${FEDORA_NAME}"
268307
IMAGE_NAME: "${FEDORA_CACHE_IMAGE_NAME}"
269308
STORAGE_DRIVER: 'overlay'
270309
PRIV_NAME: rootless
271-
# Disabled until we update to f40/41 as f39 does not have go 1.22
272-
# - env:
273-
# DISTRO_NV: "${PRIOR_FEDORA_NAME}"
274-
# IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
275-
# STORAGE_DRIVER: 'overlay'
276-
# PRIV_NAME: rootless
310+
BUILDAH_RUNTIME: crun
311+
RUNTIME_N: " using crun"
312+
- env:
313+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
314+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
315+
STORAGE_DRIVER: 'overlay'
316+
PRIV_NAME: rootless
317+
BUILDAH_RUNTIME: runc
318+
RUNTIME_N: " using runc"
319+
- env:
320+
DISTRO_NV: "${PRIOR_FEDORA_NAME}"
321+
IMAGE_NAME: "${PRIOR_FEDORA_CACHE_IMAGE_NAME}"
322+
STORAGE_DRIVER: 'overlay'
323+
PRIV_NAME: rootless
324+
BUILDAH_RUNTIME: crun
325+
RUNTIME_N: " using crun"
277326
- env:
278327
DISTRO_NV: "${DEBIAN_NAME}"
279328
IMAGE_NAME: "${DEBIAN_CACHE_IMAGE_NAME}"

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
# Changelog
44

5+
## v1.39.6 (2025-11-18)
6+
7+
CI: run integration tests on Fedora with both crun and runc
8+
buildah-build(1): clarify that --cgroup-parent affects RUN instructions
9+
runUsingRuntime: use named constants for runtime states
10+
Add a dummy "runtime" that just dumps its config file
11+
run: handle relabeling bind mounts ourselves
12+
513
## v1.39.5 (2025-11-06)
614

715
[release-1.39] Bump runc to v1.2.8 - CVE-2025-52881

‎Makefile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ endif
5555
# Note: Uses the -N -l go compiler options to disable compiler optimizations
5656
# and inlining. Using these build options allows you to subsequently
5757
# use source debugging tools like delve.
58-
all: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial docs
58+
all: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial bin/dumpspec docs
5959

6060
# Update nix/nixpkgs.json its latest stable commit
6161
.PHONY: nixpkgs
@@ -103,6 +103,9 @@ bin/buildah.%: $(SOURCES)
103103
mkdir -p ./bin
104104
GOOS=$(word 2,$(subst ., ,$@)) GOARCH=$(word 3,$(subst ., ,$@)) $(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ -tags "containers_image_openpgp" ./cmd/buildah
105105

106+
bin/dumpspec: $(SOURCES)
107+
$(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ $(BUILDFLAGS) ./tests/dumpspec
108+
106109
bin/imgtype: $(SOURCES)
107110
$(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ $(BUILDFLAGS) ./tests/imgtype/imgtype.go
108111

‎changelog.txt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
- Changelog for v1.39.6 (2025-11-18)
2+
* CI: run integration tests on Fedora with both crun and runc
3+
* buildah-build(1): clarify that --cgroup-parent affects RUN instructions
4+
* runUsingRuntime: use named constants for runtime states
5+
* Add a dummy "runtime" that just dumps its config file
6+
* run: handle relabeling bind mounts ourselves
7+
18
- Changelog for v1.39.5 (2025-11-06)
29
* [release-1.39] Bump runc to v1.2.8 - CVE-2025-52881
310
* Builder.sbomScan(): don't break non-root scanners

‎chroot/pty_unsupported.go‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎chroot/run_common.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import (
1818
"syscall"
1919

2020
"github.com/containers/buildah/bind"
21+
"github.com/containers/buildah/internal/pty"
2122
"github.com/containers/buildah/util"
2223
"github.com/containers/storage/pkg/ioutils"
2324
"github.com/containers/storage/pkg/reexec"
@@ -217,7 +218,7 @@ func runUsingChrootMain() {
217218
var stderr io.Writer
218219
fdDesc := make(map[int]string)
219220
if options.Spec.Process.Terminal {
220-
ptyMasterFd, ptyFd, err := getPtyDescriptors()
221+
ptyMasterFd, ptyFd, err := pty.GetPtyDescriptors()
221222
if err != nil {
222223
logrus.Errorf("error opening PTY descriptors: %v", err)
223224
os.Exit(1)

‎define/types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ const (
2929
// identify working containers.
3030
Package = "buildah"
3131
// Version for the Package. Also used by .packit.sh for Packit builds.
32-
Version = "1.39.5"
32+
Version = "1.39.6"
3333

3434
// DefaultRuntime if containers.conf fails.
3535
DefaultRuntime = "runc"

‎docs/buildah-build.1.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ The default certificates directory is _/etc/containers/certs.d_.
189189

190190
**--cgroup-parent**=""
191191

192-
Path to cgroups under which the cgroup for the container will be created. If the path is not absolute, the path is considered to be relative to the cgroups path of the init process. Cgroups will be created if they do not already exist.
192+
Path to cgroups under which the cgroup for RUN instructions will be created. If the path is not absolute, the path is considered to be relative to the cgroups path of the init process. Cgroups will be created if they do not already exist.
193193

194194
**--cgroupns** *how*
195195

chroot/pty_posix.go renamed to internal/pty/pty_posix.go

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
//go:build freebsd && cgo
22

3-
package chroot
3+
package pty
44

55
// #include <fcntl.h>
66
// #include <stdlib.h>
@@ -37,7 +37,9 @@ func unlockpt(fd int) error {
3737
return nil
3838
}
3939

40-
func getPtyDescriptors() (int, int, error) {
40+
// GetPtyDescriptors allocates a new pseudoterminal and returns the control and
41+
// pseudoterminal file descriptors.
42+
func GetPtyDescriptors() (int, int, error) {
4143
// Create a pseudo-terminal and open the control side
4244
controlFd, err := openpt()
4345
if err != nil {

chroot/pty_ptmx.go renamed to internal/pty/pty_ptmx.go

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
//go:build linux
22

3-
package chroot
3+
package pty
44

55
import (
66
"fmt"
@@ -11,9 +11,11 @@ import (
1111
"golang.org/x/sys/unix"
1212
)
1313

14-
// Open a PTY using the /dev/ptmx device. The main advantage of using
15-
// this instead of posix_openpt is that it avoids cgo.
16-
func getPtyDescriptors() (int, int, error) {
14+
// GetPtyDescriptors allocates a new pseudoterminal and returns the control and
15+
// pseudoterminal file descriptors. This implementation uses the /dev/ptmx
16+
// device. The main advantage of using this instead of posix_openpt is that it
17+
// avoids cgo.
18+
func GetPtyDescriptors() (int, int, error) {
1719
// Create a pseudo-terminal -- open a copy of the master side.
1820
controlFd, err := unix.Open("/dev/ptmx", os.O_RDWR, 0o600)
1921
if err != nil {

0 commit comments

Comments
 (0)