From 711b4ebfb81fdb7a79aa253709958fbefa0d967d Mon Sep 17 00:00:00 2001 From: Adrian Reber Date: Sat, 14 Mar 2026 14:30:41 +0000 Subject: [PATCH] ci: port Vagrant Fedora Rawhide test to GitHub Actions Cirrus CI reports "Failed to start an instance: FAILED_PRECONDITION: Monthly compute limit exceeded!" making the Vagrant Fedora Rawhide test unusable. Replace the Cirrus CI Vagrant-based Fedora Rawhide test with a Lima VM-based equivalent in GitHub Actions. This follows the same pattern used by the runc project (lima-vm/lima-actions). The new vagrant-fedora-rawhide-test job: - Starts a Lima Fedora VM with KVM acceleration - Installs the latest vanilla kernel - Reboots the VM to activate the new kernel - Runs the fedora-rawhide CI target inside a podman container Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Adrian Reber --- .cirrus.yml | 20 ------------- .github/workflows/ci.yml | 35 ++++++++++++++++++++++ scripts/ci/Makefile | 1 + scripts/ci/lima.sh | 63 ++++++++++++++++++++++++++++++++++++++++ 4 files changed, 99 insertions(+), 20 deletions(-) create mode 100755 scripts/ci/lima.sh diff --git a/.cirrus.yml b/.cirrus.yml index 72dbb3898..adf4b5830 100644 --- a/.cirrus.yml +++ b/.cirrus.yml @@ -48,26 +48,6 @@ task: build_script: | make -C scripts/ci local SKIP_CI_PREP=1 CC=gcc CD_TO_TOP=1 ZDTM_OPTS="-x zdtm/static/socket-raw" -task: - name: Vagrant Fedora Rawhide based test - environment: - HOME: "/root" - CIRRUS_WORKING_DIR: "/tmp/criu" - - compute_engine_instance: - image_project: cirrus-images - image: family/docker-kvm - platform: linux - cpu: 4 - memory: 16G - nested_virtualization: true - - setup_script: | - contrib/apt-install make gcc pkg-config git perl-modules iproute2 kmod wget cpu-checker - sudo kvm-ok - build_script: | - make -C scripts/ci vagrant-fedora-rawhide - task: name: Vagrant Fedora based test (non-root) environment: diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 233754c1c..7e35b6d13 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -131,6 +131,41 @@ jobs: # FIXME: https://github.com/containers/podman/issues/14920 run: sudo -E XDG_RUNTIME_DIR= make -C scripts/ci fedora-rawhide CONTAINER_RUNTIME=podman BUILD_OPTIONS="--security-opt seccomp=unconfined" + vagrant-fedora-rawhide-test: + name: Vagrant Fedora Rawhide based test + needs: [alpine-test] + runs-on: ubuntu-24.04 + timeout-minutes: 60 + steps: + - uses: actions/checkout@v4 + - name: Install Lima + uses: lima-vm/lima-actions/setup@v1 + - name: Cache Lima images + uses: actions/cache@v4 + with: + path: ~/.cache/lima + key: lima-fedora-${{ github.sha }} + restore-keys: lima-fedora- + - name: Start Fedora VM + run: limactl start --plain --name=default --cpus=4 --memory=12 template://fedora + - name: Copy source into VM + run: | + lima sudo mkdir -p /home/criu + lima sudo chown "$(lima whoami)" /home/criu + limactl copy -r . default:/home/criu + - name: Setup VM + run: lima sudo /home/criu/scripts/ci/lima.sh fedora-rawhide-setup + - name: Reboot VM to activate new kernel + run: | + limactl stop default + limactl start default + - name: Show VM info + run: | + lima uname -a + lima cat /proc/cmdline + - name: Run tests + run: ssh -tt lima-default sudo -i /home/criu/scripts/ci/lima.sh fedora-rawhide-test + gcov-test: needs: [alpine-test] runs-on: ubuntu-22.04 diff --git a/scripts/ci/Makefile b/scripts/ci/Makefile index e286bf5f8..bfb2f3d23 100644 --- a/scripts/ci/Makefile +++ b/scripts/ci/Makefile @@ -42,6 +42,7 @@ ifeq ($(CONTAINER_RUNTIME),podman) # Podman limits the number of processes in a container using cgroups. # Disable it as it breaks the thread-bomb test CONTAINER_OPTS += --pids-limit=-1 + CONTAINER_OPTS += --ulimit nproc=-1:-1 endif export ZDTM_OPTS diff --git a/scripts/ci/lima.sh b/scripts/ci/lima.sh new file mode 100755 index 000000000..3d801cb0a --- /dev/null +++ b/scripts/ci/lima.sh @@ -0,0 +1,63 @@ +#!/bin/bash + +# This script runs inside a Lima Fedora VM to set up and run +# the Fedora Rawhide based CI tests with a vanilla kernel. +# It mirrors the logic from vagrant.sh's setup() and fedora-rawhide(). +# +# lima.sh fedora-rawhide-setup +# lima.sh fedora-rawhide-test + + +set -e +set -x + +CRIU_DIR="${CRIU_DIR:-/home/criu}" + +fedora-rawhide-setup() { + # Disable sssd to avoid zdtm test failures in pty04 due to sssd socket + systemctl mask sssd + + # Upgrade the kernel to the latest vanilla one + dnf -y copr enable @kernel-vanilla/stable + # The shellcheck tool misunderstands the "do" to be from a loop + # shellcheck disable=SC1010 + dnf -y do --action=upgrade \* --action=install make podman +} + +fedora-rawhide-test() { + # Increase the max thread limit for the thread-bomb test + sysctl -w kernel.threads-max=100000 + + # Allow memory overcommit. The thread-bomb test creates 1024 + # threads that each create a successor after restore. In a + # memory-constrained VM the heuristic overcommit check can + # deny mmap for new thread stacks, and glibc maps ENOMEM to + # EAGAIN in pthread_create. + sysctl -w vm.overcommit_memory=1 + + # Newer systemd versions limit the number of tasks per scope/slice + # via cgroup pids controller. Set the system-wide default to + # unlimited and also remove the limit for the root user's slice. + # Without this, podman container scopes inherit the default + # TasksMax and thread-bomb fails with EAGAIN. + mkdir -p /etc/systemd/system.conf.d + printf '[Manager]\nDefaultTasksMax=infinity\n' \ + > /etc/systemd/system.conf.d/50-tasks.conf + systemctl daemon-reload + systemctl set-property user-0.slice TasksMax=infinity + + # Some tests in the container need selinux to be disabled. + # In the container it is not possible to change the state of selinux. + # Let's just disable it for this test run completely. + setenforce Permissive + + cd "${CRIU_DIR}" + # excluding zdtm/static/socket-tcpbuf-local in this setup as it fails + # sometimes: https://github.com/checkpoint-restore/criu/issues/2987 + make -C scripts/ci fedora-rawhide \ + CONTAINER_RUNTIME=podman \ + BUILD_OPTIONS="--security-opt seccomp=unconfined" \ + ZDTM_OPTS="-x zdtm/static/socket-tcpbuf-local" +} + +"$@"