incus-user: Don't set raw.idmap when uid/gid aren't in system map #324

Workflow file for this run

	name: Tests
	on:
	push:
	branches:
	- main
	- stable-*
	pull_request:

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	code-tests:
	name: Code
	runs-on: ubuntu-22.04
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Dependency Review
	uses: actions/dependency-review-action@v3
	if: github.event_name == 'pull_request'

	# XXX: `make static-analysis` also run shellcheck but this one provides
	# useful feedback in the PR through github-code-scanning bot
	- id: ShellCheck
	name: Differential ShellCheck
	uses: redhat-plumbers-in-action/differential-shellcheck@v5
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	if: github.event_name == 'pull_request'

	- name: Upload artifact with ShellCheck defects in SARIF format
	uses: actions/upload-artifact@v4
	with:
	name: Differential ShellCheck SARIF
	path: ${{ steps.ShellCheck.outputs.sarif }}
	if: github.event_name == 'pull_request'

	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: 1.20.x

	- name: Check compatible min Go version
	run: \|
	go mod tidy -go=1.20

	- name: Install dependencies
	run: \|
	sudo add-apt-repository ppa:ubuntu-lxc/daily -y --no-update
	sudo add-apt-repository ppa:cowsql/stable -y --no-update
	sudo apt-get update

	sudo apt-get install --no-install-recommends -y \
	curl \
	gettext \
	git \
	libacl1-dev \
	libcap-dev \
	libdbus-1-dev \
	libcowsql-dev \
	liblxc-dev \
	lxc-templates \
	libseccomp-dev \
	libselinux-dev \
	libsqlite3-dev \
	libtool \
	libudev-dev \
	make \
	pkg-config \
	shellcheck

	python3 -m pip install flake8

	- name: Download go dependencies
	run: \|
	go mod download

	- name: Run Incus build
	run: \|
	make

	- name: Run static analysis
	env:
	GITHUB_BEFORE: ${{ github.event.before }}
	run: \|
	make static-analysis

	- name: Unit tests (all)
	run: \|
	sudo --preserve-env=CGO_CFLAGS,CGO_LDFLAGS,CGO_LDFLAGS_ALLOW,LD_LIBRARY_PATH LD_LIBRARY_PATH=${LD_LIBRARY_PATH} env "PATH=${PATH}" go test ./...

	system-tests:
	env:
	CGO_LDFLAGS_ALLOW: "(-Wl,-wrap,pthread_create)\|(-Wl,-z,now)"
	INCUS_CEPH_CLUSTER: "ceph"
	INCUS_CEPH_CEPHFS: "cephfs"
	INCUS_CEPH_CEPHOBJECT_RADOSGW: "http://127.0.0.1"
	INCUS_CONCURRENT: "1"
	INCUS_VERBOSE: "1"
	INCUS_OFFLINE: "1"
	INCUS_TMPFS: "1"
	INCUS_REQUIRED_TESTS: "test_storage_buckets"
	name: System
	runs-on: ubuntu-22.04
	strategy:
	fail-fast: false
	matrix:
	go: ["1.20.x"]
	suite: ["cluster", "standalone"]
	backend: ["dir", "btrfs", "lvm", "zfs", "ceph", "random"]
	include:
	- go: stable
	suite: cluster
	backend: dir
	- go: stable
	suite: standalone
	backend: dir
	- go: tip
	suite: cluster
	backend: dir
	- go: tip
	suite: standalone
	backend: dir

	steps:
	- name: Performance tuning
	run: \|
	set -eux
	# optimize ext4 FSes for performance, not reliability
	for fs in $(findmnt --noheading --type ext4 --list --uniq \| awk '{print $1}'); do
	# nombcache and data=writeback cannot be changed on remount
	sudo mount -o remount,noatime,barrier=0,commit=6000 "${fs}"
	done

	# disable dpkg from calling sync()
	echo "force-unsafe-io" \| sudo tee /etc/dpkg/dpkg.cfg.d/force-unsafe-io

	- name: Reclaim some space
	run: \|
	# This was inspired from https://github.com/easimon/maximize-build-space
	set -eux
	df -h /
	# dotnet
	sudo rm -rf /usr/share/dotnet
	# android
	sudo rm -rf /usr/local/lib/android
	# haskell
	sudo rm -rf /opt/ghc
	df -h /

	- name: Checkout
	uses: actions/checkout@v4

	- name: Install Go (stable)
	uses: actions/setup-go@v5
	with:
	go-version: ${{ matrix.go }}
	if: matrix.go != 'tip'

	- name: Install Go (tip)
	run: \|
	for i in $(seq 20); do
	curl -sSfL https://storage.googleapis.com/go-build-snap/go/linux-amd64/$(git ls-remote https://github.com/golang/go.git HEAD \| awk '{print $1;}').tar.gz -o gotip.tar.gz && break
	sleep 30
	done

	mkdir -p ~/sdk/gotip
	tar -C ~/sdk/gotip -xzf gotip.tar.gz
	rm gotip.tar.gz
	~/sdk/gotip/bin/go version
	echo "PATH=$HOME/go/bin:$HOME/sdk/gotip/bin/:$PATH" >> $GITHUB_ENV
	if: matrix.go == 'tip'

	- name: Install dependencies
	run: \|
	set -x
	sudo add-apt-repository ppa:ubuntu-lxc/daily -y --no-update
	sudo add-apt-repository ppa:cowsql/stable -y --no-update
	sudo apt-get update

	sudo snap remove lxd --purge
	sudo snap remove core20 --purge \|\| true
	sudo apt-get autopurge moby-containerd docker uidmap -y
	sudo ip link delete docker0
	sudo nft flush ruleset

	sudo systemctl mask lxc.service
	sudo systemctl mask lxc-net.service

	sudo apt-get install --no-install-recommends -y \
	curl \
	git \
	libacl1-dev \
	libcap-dev \
	libdbus-1-dev \
	libcowsql-dev \
	liblxc-dev \
	libseccomp-dev \
	libselinux-dev \
	libsqlite3-dev \
	libtool \
	libudev-dev \
	make \
	pkg-config\
	acl \
	attr \
	bind9-dnsutils \
	btrfs-progs \
	busybox-static \
	dnsmasq-base \
	easy-rsa \
	gettext \
	jq \
	lxc-utils \
	lvm2 \
	nftables \
	quota \
	rsync \
	s3cmd \
	socat \
	sqlite3 \
	squashfs-tools \
	tar \
	tcl \
	thin-provisioning-tools \
	uuid-runtime \
	xfsprogs \
	xz-utils \
	zfsutils-linux

	# reclaim some space
	sudo apt-get clean

	mkdir -p "$(go env GOPATH)/bin"
	curl -sSfL https://dl.min.io/server/minio/release/linux-amd64/minio --output "$(go env GOPATH)/bin/minio"
	chmod +x "$(go env GOPATH)/bin/minio"

	# Download latest release of openfga server.
	curl -sSfL https://api.github.com/repos/openfga/openfga/releases/latest \| jq -r '.assets \| .[] \| .browser_download_url \| select(. \| test("_linux_amd64.tar.gz$"))' \| xargs -I {} curl -sSfL {} -o openfga.tar.gz
	tar -xzf openfga.tar.gz -C "$(go env GOPATH)/bin/"

	# Download latest release of openfga cli.
	curl -sSfL https://api.github.com/repos/openfga/cli/releases/latest \| jq -r '.assets \| .[] \| .browser_download_url \| select(. \| test("_linux_amd64.tar.gz$"))' \| xargs -I {} curl -sSfL {} -o fga.tar.gz
	tar -xzf fga.tar.gz -C "$(go env GOPATH)/bin/"

	- name: Download go dependencies
	run: \|
	go mod download

	- name: Run Incus build
	run: \|
	make

	- name: Setup MicroCeph
	if: ${{ matrix.backend == 'ceph' }}
	run: \|
	set -x

	# If the rootfs and the ephemeral part are on the same physical disk, giving the whole
	# disk to microceph would wipe our rootfs. Since it is pretty rare for GitHub Action
	# runners to have a single disk, we immediately bail rather than trying to gracefully
	# handle it. Once snapd releases with https://github.com/snapcore/snapd/pull/13150,
	# we will be able to stop worrying about that special case.
	if [ "$(stat -c '%d' /)" = "$(stat -c '%d' /mnt)" ]; then
	echo "FAIL: rootfs and ephemeral part on the same disk, aborting"
	exit 1
	fi

	sudo snap install microceph --edge
	sudo apt-get install --no-install-recommends -y ceph-common
	sudo microceph cluster bootstrap
	sudo microceph.ceph config set global osd_pool_default_size 1
	sudo microceph.ceph config set global mon_allow_pool_delete true
	sudo microceph.ceph config set global osd_memory_target 939524096
	sudo microceph.ceph osd crush rule rm replicated_rule
	sudo microceph.ceph osd crush rule create-replicated replicated default osd
	for flag in nosnaptrim noscrub nobackfill norebalance norecover noscrub nodeep-scrub; do
	sudo microceph.ceph osd set $flag
	done
	# Repurpose the ephemeral disk for ceph OSD.
	sudo swapoff /mnt/swapfile
	ephemeral_disk="$(findmnt --noheadings --output SOURCE --target /mnt \| sed 's/[0-9]\+$//')"
	sudo umount /mnt
	sudo microceph disk add --wipe "${ephemeral_disk}"
	sudo rm -rf /etc/ceph
	sudo ln -s /var/snap/microceph/current/conf/ /etc/ceph
	sudo microceph enable rgw
	sudo microceph.ceph osd pool create cephfs_meta 32
	sudo microceph.ceph osd pool create cephfs_data 32
	sudo microceph.ceph fs new cephfs cephfs_meta cephfs_data
	sudo microceph.ceph fs ls
	sleep 30
	sudo microceph.ceph status
	# Wait until there are no more "unkowns" pgs
	for _ in $(seq 60); do
	if sudo microceph.ceph pg stat \| grep -wF unknown; then
	sleep 1
	else
	break
	fi
	done
	sudo microceph.ceph status
	sudo rm -f /snap/bin/rbd

	- name: "Ensure offline mode (block image server)"
	run: \|
	sudo nft add table inet filter
	sudo nft add chain 'inet filter output { type filter hook output priority 10 ; }'
	sudo nft add rule inet filter output ip daddr 45.45.148.8 reject
	sudo nft add rule inet filter output ip6 daddr 2602:fc62:a:1::8 reject

	- name: "Run system tests (${{ matrix.go }}, ${{ matrix.suite }}, ${{ matrix.backend }})"
	run: \|
	chmod +x ~
	echo "root:1000000:1000000000" \| sudo tee /etc/subuid /etc/subgid
	cd test
	sudo --preserve-env=PATH,GOPATH,GITHUB_ACTIONS,INCUS_VERBOSE,INCUS_BACKEND,INCUS_CEPH_CLUSTER,INCUS_CEPH_CEPHFS,INCUS_CEPH_CEPHOBJECT_RADOSGW,INCUS_OFFLINE,INCUS_SKIP_TESTS,INCUS_REQUIRED_TESTS, INCUS_BACKEND=${{ matrix.backend }} ./main.sh ${{ matrix.suite }}

	client:
	name: Client
	strategy:
	fail-fast: false
	matrix:
	go:
	- 1.20.x
	os:
	- ubuntu-latest
	- macos-latest
	- windows-latest
	runs-on: ${{ matrix.os }}

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: ${{ matrix.go }}

	- name: Create build directory
	run: \|
	mkdir bin

	- name: Build static x86_64 incus
	env:
	CGO_ENABLED: 0
	GOARCH: amd64
	run: \|
	go build -o bin/incus.x86_64 ./cmd/incus

	- name: Build static aarch64 incus
	env:
	CGO_ENABLED: 0
	GOARCH: arm64
	run: \|
	go build -o bin/incus.aarch64 ./cmd/incus

	- name: Build static incus-migrate
	if: runner.os == 'Linux'
	env:
	CGO_ENABLED: 0
	run: \|
	GOARCH=amd64 go build -o bin/incus-migrate.x86_64 ./cmd/incus-migrate
	GOARCH=arm64 go build -o bin/incus-migrate.aarch64 ./cmd/incus-migrate

	- name: Unit tests (client)
	env:
	CGO_ENABLED: 0
	run: go test -v ./client/...

	- name: Unit tests (incus)
	env:
	CGO_ENABLED: 0
	run: go test -v ./cmd/incus/...

	- name: Unit tests (shared)
	env:
	CGO_ENABLED: 0
	run: go test -v ./shared/...

	- name: Upload incus client artifacts
	uses: actions/upload-artifact@v4
	continue-on-error: true
	with:
	name: ${{ runner.os }}
	path: bin/

	documentation:
	name: Documentation
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Install Go
	uses: actions/setup-go@v5
	with:
	go-version: 1.20.x

	- name: Install dependencies
	run: \|
	sudo apt-get install aspell aspell-en
	sudo snap install mdl

	- name: Run markdown linter
	run: \|
	make doc-lint

	- name: Run spell checker
	run: \|
	make doc-spellcheck

	- name: Run inclusive naming checker
	uses: get-woke/woke-action@v0
	with:
	fail-on-error: true
	woke-args: ".md /.md -c https://github.com/canonical/Inclusive-naming/raw/main/config.yml"

	- name: Run link checker
	run: \|
	make doc-linkcheck

	- name: Build docs (Sphinx)
	run: make doc

	- name: Print warnings (Sphinx)
	run: if [ -s doc/.sphinx/warnings.txt ]; then cat doc/.sphinx/warnings.txt; exit 1; fi

	- name: Upload documentation artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: documentation
	path: doc/html

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

incus-user: Don't set raw.idmap when uid/gid aren't in system map #324

Workflow file

incus-user: Don't set raw.idmap when uid/gid aren't in system map #324

Jobs

Run details

Workflow file for this run