Skip to content

ci: remove the Podman checkpoint/restore job #123

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bilby91 merged 1 commit into from
Aug 28, 2026
+0 −83
Merged

ci: remove the Podman checkpoint/restore job #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 0 additions & 44 deletions .github/scripts/podman-cr.sh
View file
Open in desktop

This file was deleted.

39 changes: 0 additions & 39 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,42 +84,3 @@ jobs:
pattern="^($(echo "$selected" | paste -sd '|' -))$"
go test -race -count=1 -tags=integration -timeout=15m \
-run "$pattern" ./test/integration/...

# Real Podman + CRIU checkpoint/restore. The runtime/podman backend and
# the Engine checkpoint/restore + project-orchestrator paths only execute
# against a live Podman socket with CRIU (PODMAN_SOCKET-gated). The
# cross-node test (TestPodmanXNode_*) needs two hosts, so it skips here
# (no DCCKPT_XNODE_DIR) — run it on two machines by hand.
#
# Why a container: the hosted runner's apt podman is unusable (24.04 has
# no criu; 22.04's podman 3.4.4 can't checkpoint and predates the libpod
# v5 API). So we build the gated tests on the runner (compile coverage,
# static CGO_ENABLED=0 so they run on Fedora), then run them INSIDE a
# modern-podman container (podman 5.x + crun + criu) that's privileged +
# --cgroupns=host so CRIU can drive the runner's kernel. The script
# smoke-tests an actual checkpoint first and skips green (with the real
# reason) if this runner can't — e.g. nested cgroup-freezer perms — so a
# capable runner runs for real while an incapable one stays green.
test-integration-podman:
runs-on: ubuntu-latest
needs: [lint, test-linux]
steps:
- uses: actions/checkout@v6
- uses: actions/setup-go@v6
with:
go-version: "1.25"
cache: true
- name: Build gated test binaries (static; compile coverage + run in container)
env:
CGO_ENABLED: "0"
run: |
go test -tags=integration -c ./test/integration -o ./int.test
go test -c ./runtime/podman -o ./podman.test
Comment on lines -103 to -117

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot Aug 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MEDIUM] [R8] Removing the only live Podman gate leaves checkpoint/restore regressions invisible to CI

  • Witness: Command: git show 29ce1d948b03c493b59b9811bb1d34059b0989c7:design/podman-backend.md | nl -ba | grep -i -A6 -B4 -E 'integration|test' | head -100\nRaw output: 281\t### Phase 2 — the Podman backend ... 288\t- Integration tests behind a real-podman gate (mirror the existing / 289\t real-docker compose integration-test gate). and 318\t- **Integration (real podman gate):** bring a container up via the Podman / 319\t backend, checkpoint→remove→restore, assert memory + networking resume / 320\t — the bench test, codified.\n\nThe deleted job was the only CI path that compiled and ran the live tests (go test -c ./runtime/podman, then /w/podman.test -test.run TestIntegration and /w/int.test -test.run '^TestPodman'). The remaining workflow only runs go test -tags=integration ./test/integration/... against Docker and does not set PODMAN_SOCKET; the Podman tests explicitly call t.Skip when that variable is absent (runtime/podman/integration_test.go:27-30, test/integration/podman_checkpoint_restore_test.go:36-38). Thus a broken libpod checkpoint/restore or build endpoint can pass every remaining check, directly contradicting the backend design's required real-Podman gate.
  • Consumer: runtime/podman/integration_test.go:27-30 and test/integration/podman_checkpoint_restore_test.go:36-38 read PODMAN_SOCKET and skip without it; .github/workflows/ci.yml:74-86 runs the remaining integration suite without providing that socket, so no remaining CI consumer exercises the Podman backend against a daemon.
  • Fix: Keep a real-Podman integration gate, or replace it with an equivalent scheduled/hosted or self-hosted job that provisions Podman + CRIU, sets PODMAN_SOCKET, and runs the runtime-level and engine/project checkpoint tests. If intentionally abandoning this guarantee, update design/podman-backend.md and the backend's support/validation contract rather than silently deleting the gate.

@dap-code-review-by-crunchloop dap-code-review-by-crunchloop Bot Aug 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dismissed — the reviewer retracted this finding.

Reason: After re-reading the repository standard and its cited evidence, I no longer stand behind this as a defect in this PR. The factual coverage loss remains real, but R8 explicitly allows a backend-specific path to be untested when the change makes an explicit statement of which backend is untested; the PR description does exactly that. The referenced podman-backend design is marked “Draft for review,” and design/README.md:10-15 says such records are not kept in sync and that code is authoritative, so my original “required gate/design contradiction” framing was not valid. The preceding #121/#122 removal sequence also establishes that this retirement work intentionally removes backend coverage without rewriting design records. The deleted job was best-effort (it intentionally exited green when CRIU was unavailable), and no evidence shows a current supported Podman consumer that this CI deletion breaks.

The review comment above records what was claimed at the time, and is left unedited.

- name: Checkpoint/restore in a modern-podman privileged container
run: |
docker run --rm --privileged --cgroupns=host \
--security-opt seccomp=unconfined \
--security-opt apparmor=unconfined \
--security-opt label=disable \
-v "$PWD":/w -w /w \
quay.io/podman/stable bash /w/.github/scripts/podman-cr.sh