Skip to content

test(e2e): run rootless podman tests in guest - #3004

Merged
elezar merged 7 commits into
codex/2980-rootless-podman-nix-vmsfrom
codex/demo-prebuilt-e2e-artifacts
Aug 28, 2026
Merged

elezar merged 7 commits into
codex/2980-rootless-podman-nix-vmsfrom
codex/demo-prebuilt-e2e-artifacts

Conversation

@elezar

@elezar elezar commented Aug 28, 2026 •

Copy link
Copy Markdown
Member

Summary

Demonstrates running the Rust Podman E2E tests inside the Ubuntu 26.04 Nix test guest using prebuilt Linux test artifacts. This avoids host-local dynamic fixtures being unreachable from gateway/sandbox processes running inside the VM.

Related Issue

Related to #2980.
Follow-up hardening tracked in #3005.

Changes

  • Added --tests-in-vm support to e2e/run.sh for cross-building Linux E2E test binaries, copying artifacts into the Nix guest, and executing the tests there.
  • Added guest artifact copying/launch support to the Nix test-guest tooling.
  • Switched the rootless Podman test flow to run with --features e2e_podman.
  • Added an e2e_podman Cargo feature alias for the existing e2e-podman feature.
  • Updated the Ubuntu 26.04 amd64 guest image hash to match the current upstream cloud image and unblock the VM lane.

Testing

  • mise run pre-commit passes
  • bash -n e2e/run.sh
  • bash -n nix/test-guest/run.sh
  • nix-instantiate --parse nix/test-guest/distros/ubuntu-26-04.nix
  • git diff --check codex/2980-rootless-podman-nix-vms..HEAD
  • e2e/run.sh --vm ubuntu-26-04 --with podman-rootless --tests-in-vm --gateway-config e2e/configs/gateway/podman.toml --features e2e-podman --suite credential_gating passes
  • e2e/run.sh --vm ubuntu-26-04 --with podman-rootless --tests-in-vm --cli-bin <linux-musl-openshell> --gateway-config e2e/configs/gateway/podman.toml --features e2e-podman --suite credential_gating passes

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)

Signed-off-by: Evan Lezar <elezar@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Aug 28, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@elezar elezar added the test:e2e Requires end-to-end coverage label Aug 28, 2026
@elezar

elezar commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

/ok-to-test 478484b

@github-actions

Copy link
Copy Markdown

Label test:e2e applied, but pull-request/3004 does not exist yet. A maintainer needs to comment /ok to test 478484b9060e8a16cb1222bd75dbfb78adb1a46f to mirror this PR. Once the mirror exists, re-apply the label or re-run Branch E2E Checks from the Actions tab.

Signed-off-by: Evan Lezar <elezar@nvidia.com>
@elezar

elezar commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

/ok-to-test 1e0f8e6

elezar added 4 commits August 28, 2026 11:24
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
Signed-off-by: Evan Lezar <elezar@nvidia.com>
@elezar

elezar commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

/ok-to-test 03c5039

Signed-off-by: Evan Lezar <elezar@nvidia.com>
@elezar

elezar commented Aug 28, 2026

Copy link
Copy Markdown
Member Author

/ok-to-test cd189f4

@elezar
elezar merged commit cd189f4 into codex/2980-rootless-podman-nix-vms Aug 28, 2026
50 of 51 checks passed
@elezar
elezar deleted the codex/demo-prebuilt-e2e-artifacts branch August 28, 2026 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

test:e2e Requires end-to-end coverage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant