mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-30 07:33:59 +08:00
Naveen Malik
f1ed347a40
Rootless Podman sandbox containers reach the host through pasta's local connection bypass, which translates L2 frames to L4 host sockets. The dev gateway script binds to 127.0.0.1 by default, which is not routable through pasta. Auto-detect rootless mode and bind to 0.0.0.0 so sandbox containers can connect to the gateway. - Auto-detect rootless Podman in gateway.sh and export OPENSHELL_BIND_ADDRESS=0.0.0.0 when not explicitly set - Add e2e:podman:rootless mise task and CI matrix entry to validate rootless Podman networking end-to-end - CI creates a non-root user inside the privileged container to trigger Podman's rootless code paths (pasta, user namespace isolation) Signed-off-by: Naveen Malik <nmalik@redhat.com>
19 lines
657 B
Bash
Executable File
19 lines
657 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Run the Podman e2e suite and verify rootless mode.
|
|
#
|
|
# Identical to e2e-podman.sh but fails fast if Podman is not running
|
|
# rootless. Use this to explicitly validate the rootless networking
|
|
# path (pasta, host-gateway, bind address).
|
|
|
|
set -euo pipefail
|
|
|
|
if podman info --format '{{.Host.Security.Rootless}}' 2>/dev/null | grep -q false; then
|
|
echo "ERROR: podman is not running rootless; this test requires rootless mode" >&2
|
|
exit 2
|
|
fi
|
|
|
|
exec "$(dirname "${BASH_SOURCE[0]}")/e2e-podman.sh"
|