Skip to content

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458

Merged
lsm5 merged 4 commits into
podman-container-tools:v4.2.0-rhelfrom
cevich:backport_runc_fix
Apr 13, 2026
Merged

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458
lsm5 merged 4 commits into
podman-container-tools:v4.2.0-rhelfrom
cevich:backport_runc_fix

Conversation

@cevich

@cevich cevich commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Followup to #27933 - Neglected to backport for fixes: https://issues.redhat.com/browse/RHEL-132863 https://issues.redhat.com/browse/RHEL-132860

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

  • Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
    commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
    the sign-off email address. See CONTRIBUTING.md
    for more information.
  • Referenced issues using Fixes: #00000 in commit message (if applicable)
  • Tests have been added/updated (or no tests are needed)
  • Documentation has been updated (or no documentation changes are needed)
  • All commits pass make validatepr (format/lint checks)
  • Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

None

Luap99 added 2 commits April 7, 2026 14:37
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.

Fixes: podman-container-tools#26938

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 7fda4df)
Signed-off-by: Chris Evich <cevich@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.

Fixes: podman-container-tools#26938
Fixes: https://issues.redhat.com/browse/RHEL-132532,
https://issues.redhat.com/browse/RHEL-132531

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 1e4a59d)
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich marked this pull request as draft April 7, 2026 18:42
@cevich

cevich commented Apr 7, 2026

Copy link
Copy Markdown
Contributor Author

Running system tests...tests finished. No surprises, exactly the same results as #27933

@cevich

cevich commented Apr 8, 2026

Copy link
Copy Markdown
Contributor Author

@TomSweeneyRedHat @lsm5 PTAL when you have a chance.

@lsm5

lsm5 commented Apr 8, 2026

Copy link
Copy Markdown
Contributor

Running tests on internal ranch. Will update here.

@lsm5 lsm5 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to backport PodmanExitCleanly if we need to actually run integration tests.

Comment thread test/e2e/run_volume_test.go
@lsm5

lsm5 commented Apr 8, 2026

Copy link
Copy Markdown
Contributor

system and other tests are good though.

@TomSweeneyRedHat

Copy link
Copy Markdown
Contributor

@cevich what @lsm5 said. He caught the test issue on my PR, and I believe you need to pick a9ac512 to fix it.

As this truly closes the runc CVEs, I'd add a note to that PR pointing here if you have not already, and then list the Jira cards that will be fixed in the Description.

Combined test for (exitcode == 0) && (nothing on stderr).
Returns more useful diagnostic messages than the default:

  old: Expected N to equal 0

  new: Command failed with exit status N
  new: Unexpected warnings seen on stderr: "...."

Adding fro the ExitCleanOnly function that is present
in some tests that were cherry picked for this PR.

Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 6cbd17c)
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
(cherry picked from commit a9ac512)
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich requested a review from lsm5 April 10, 2026 14:25
@lsm5

lsm5 commented Apr 10, 2026

Copy link
Copy Markdown
Contributor

@cevich need this one actually: 0c18beaea7 . Also, remove GinkgoHelper() from it as it's only ginkgo v2 https://github.com/containers/podman/pull/28450/changes#r3065869701

This significantly simplifies the ceromony of running a Podman command
in integration tests, from

> session := p.Podman([]string{"stop", id})
> session.WaitWithDefaultTimeout()
> Expect(session).Should(ExitCleanly())

to
> p.PodmanExitCleanly("stop", id)

There are >4650 instances of ExitCleanly() in the tests,
and many could be migrated; this does not do that.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
(cherry picked from commit 0c18bea)
Conflicts resolved with the assistance of AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich

cevich commented Apr 13, 2026

Copy link
Copy Markdown
Contributor Author

Backported, conflicts resolved by AI in favor of ginkgo v1. Both tests and project compiles fine. I did not run any tests though.

@lsm5 lsm5 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Integration tests compiled successfully.

LGTM

@lsm5 lsm5 merged commit 786fcba into podman-container-tools:v4.2.0-rhel Apr 13, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants