ci: port Vagrant Fedora Rawhide test to GitHub Actions

Cirrus CI reports "Failed to start an instance:
FAILED_PRECONDITION: Monthly compute limit exceeded!" making the
Vagrant Fedora Rawhide test unusable.

Replace the Cirrus CI Vagrant-based Fedora Rawhide test with a
Lima VM-based equivalent in GitHub Actions. This follows the same
pattern used by the runc project (lima-vm/lima-actions).

The new vagrant-fedora-rawhide-test job:
- Starts a Lima Fedora VM with KVM acceleration
- Installs the latest vanilla kernel
- Reboots the VM to activate the new kernel
- Runs the fedora-rawhide CI target inside a podman container

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Adrian Reber <areber@redhat.com>

.cirrus.yml

@@ -48,26 +48,6 @@ task:
   build_script: |
     make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_OPTS="-x zdtm/static/socket-raw"
 
-task:
-  name: Vagrant Fedora Rawhide based test
-  environment:
-    HOME: "/root"
-    CIRRUS_WORKING_DIR: "/tmp/criu"
-
-  compute_engine_instance:
-    image_project: cirrus-images
-    image: family/docker-kvm
-    platform: linux
-    cpu: 4
-    memory: 16G
-    nested_virtualization: true
-
-  setup_script: |
-    contrib/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker
-    sudo kvm-ok
-  build_script: |
-    make -C scripts/ci vagrant-fedora-rawhide
-
 task:
   name: Vagrant Fedora based test (non-root)
   environment:

.github/workflows/ci.yml

@@ -131,6 +131,41 @@ jobs:
       # FIXME: https://github.com/containers/podman/issues/14920
       run: sudo -E XDG_RUNTIME_DIR= make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined"
 
+  vagrant-fedora-rawhide-test:
+    name: Vagrant Fedora Rawhide based test
+    needs: [alpine-test]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install Lima
+      uses: lima-vm/lima-actions/setup@v1
+    - name: Cache Lima images
+      uses: actions/cache@v4
+      with:
+        path: ~/.cache/lima
+        key: lima-fedora-${{ github.sha }}
+        restore-keys: lima-fedora-
+    - name: Start Fedora VM
+      run: limactl start --plain --name=default --cpus=4 --memory=12 template://fedora
+    - name: Copy source into VM
+      run: |
+        lima sudo mkdir -p /home/criu
+        lima sudo chown "$(lima whoami)" /home/criu
+        limactl copy -r . default:/home/criu
+    - name: Setup VM
+      run: lima sudo /home/criu/scripts/ci/lima.sh fedora-rawhide-setup
+    - name: Reboot VM to activate new kernel
+      run: |
+        limactl stop default
+        limactl start default
+    - name: Show VM info
+      run: |
+        lima uname -a
+        lima cat /proc/cmdline
+    - name: Run tests
+      run: ssh -tt lima-default sudo -i /home/criu/scripts/ci/lima.sh fedora-rawhide-test
+
   gcov-test:
     needs: [alpine-test]
     runs-on: ubuntu-22.04

scripts/ci/Makefile

@@ -42,6 +42,7 @@ ifeq ($(CONTAINER_RUNTIME),podman)
 	# Podman limits the number of processes in a container using cgroups.
 	# Disable it as it breaks the thread-bomb test
 	CONTAINER_OPTS += --pids-limit=-1
+	CONTAINER_OPTS += --ulimit nproc=-1:-1
 endif
 
 export ZDTM_OPTS

scripts/ci/lima.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+# This script runs inside a Lima Fedora VM to set up and run
+# the Fedora Rawhide based CI tests with a vanilla kernel.
+# It mirrors the logic from vagrant.sh's setup() and fedora-rawhide().
+#
+#   lima.sh fedora-rawhide-setup
+#   lima.sh fedora-rawhide-test
+
+
+set -e
+set -x
+
+CRIU_DIR="${CRIU_DIR:-/home/criu}"
+
+fedora-rawhide-setup() {
+	# Disable sssd to avoid zdtm test failures in pty04 due to sssd socket
+	systemctl mask sssd
+
+	# Upgrade the kernel to the latest vanilla one
+	dnf -y copr enable @kernel-vanilla/stable
+	# The shellcheck tool misunderstands the "do" to be from a loop
+	# shellcheck disable=SC1010
+	dnf -y do --action=upgrade \* --action=install make podman
+}
+
+fedora-rawhide-test() {
+	# Increase the max thread limit for the thread-bomb test
+	sysctl -w kernel.threads-max=100000
+
+	# Allow memory overcommit. The thread-bomb test creates 1024
+	# threads that each create a successor after restore. In a
+	# memory-constrained VM the heuristic overcommit check can
+	# deny mmap for new thread stacks, and glibc maps ENOMEM to
+	# EAGAIN in pthread_create.
+	sysctl -w vm.overcommit_memory=1
+
+	# Newer systemd versions limit the number of tasks per scope/slice
+	# via cgroup pids controller. Set the system-wide default to
+	# unlimited and also remove the limit for the root user's slice.
+	# Without this, podman container scopes inherit the default
+	# TasksMax and thread-bomb fails with EAGAIN.
+	mkdir -p /etc/systemd/system.conf.d
+	printf '[Manager]\nDefaultTasksMax=infinity\n' \
+		> /etc/systemd/system.conf.d/50-tasks.conf
+	systemctl daemon-reload
+	systemctl set-property user-0.slice TasksMax=infinity
+
+	# Some tests in the container need selinux to be disabled.
+	# In the container it is not possible to change the state of selinux.
+	# Let's just disable it for this test run completely.
+	setenforce Permissive
+
+	cd "${CRIU_DIR}"
+	# excluding zdtm/static/socket-tcpbuf-local in this setup as it fails
+	# sometimes: https://github.com/checkpoint-restore/criu/issues/2987
+	make -C scripts/ci fedora-rawhide \
+		CONTAINER_RUNTIME=podman \
+		BUILD_OPTIONS="--security-opt seccomp=unconfined" \
+		ZDTM_OPTS="-x zdtm/static/socket-tcpbuf-local"
+}
+
+"$@"