Support constrained ACME mount smoke fallback

Author: eldryoth

.github/workflows/ci.yml

@@ -113,7 +113,7 @@ jobs:
         run: cargo test
 
       - name: Run isolated ACME mount-boundary regression
-        run: scripts/smoke_acme_mount_boundary.sh
+        run: FLUXHEIM_ACME_MOUNT_TEST_MODE=container FLUXHEIM_ACME_MOUNT_TEST_RUNTIME=docker scripts/smoke_acme_mount_boundary.sh
 
       - name: Validate OWASP Top 10 2025 baseline
         run: scripts/validate-owasp-top10-2025.sh check

docs/certificate-renewal.md

@@ -86,11 +86,15 @@ The Linux bind-mount regression is deliberately marked ignored in ordinary
 Rust test runs because it requires mount capability and an isolated mount
 namespace. CI, the deep release gate, and `scripts/test_starter.py` execute
 `scripts/smoke_acme_mount_boundary.sh`, which runs that exact ignored test in a
-root-mapped user namespace and a private mount namespace. The test receives no
-host-root or privileged-container capability. Hosts that prohibit unprivileged
-user namespaces fail the dedicated smoke explicitly instead of silently
-skipping it or falling back to broader privilege. A normal test inventory
-therefore reports the Rust test as ignored rather than as a false pass.
+root-mapped user namespace and a private mount namespace. When a host prohibits
+unprivileged user namespaces, including GitHub-hosted runners, the script uses
+a digest-pinned disposable container with networking disabled, a read-only root
+filesystem, all capabilities dropped except `SYS_ADMIN`, and
+`no-new-privileges`. Docker's AppArmor profile is disabled for this one-shot
+container because that profile denies `mount(2)` independently of capabilities;
+Docker's seccomp profile and the other restrictions remain active. The script
+never uses unrestricted `--privileged` access. A normal test inventory therefore
+reports the Rust test as ignored rather than as a false pass.
 
 ```bash
 fluxheim --config path/to/fluxheim.toml --check-tls-storage

release-notes/RELEASE_NOTES_1.7.9.md

@@ -53,7 +53,9 @@ products.
   mount points. The bind-mount regression is explicitly ignored in
   ordinary Rust runs and executed by CI and the deep release gate through a
   dedicated smoke using root-mapped user and private mount namespaces, without
-  a privileged container.
+  a privileged container. Hosts that disable user namespaces use a
+  digest-pinned, network-isolated, read-only container with every capability
+  dropped except the mount operation's required `SYS_ADMIN` capability.
 - Managed ACME account generation now creates P-256 material in zeroizing
   RustCrypto secret/document types before importing it into Ring and retaining
   the durable copy in `sanitization::SecretVec`, removing the transient

scripts/smoke_acme_mount_boundary.sh

@@ -9,11 +9,6 @@ if [ "$(uname -s)" != "Linux" ]; then
     exit 1
 fi
 
-if ! command -v unshare >/dev/null 2>&1; then
-    echo "ACME mount-boundary smoke requires util-linux unshare" >&2
-    exit 1
-fi
-
 test_name=acme_directory::tests::owned_directory_reconciliation_rejects_bind_mount
 build_output=$(cargo test --locked -p fluxheim-acme --features acme-client \
     --no-run --message-format=json)
@@ -25,8 +20,83 @@ if [ -z "$test_binary" ] || [ ! -x "$test_binary" ]; then
     exit 1
 fi
 
-unshare --user --map-root-user --mount --propagation private --fork \
-    "$test_binary" \
-    --exact "$test_name" --ignored --nocapture
+run_in_user_namespace() {
+    unshare --user --map-root-user --mount --propagation private --fork \
+        "$test_binary" \
+        --exact "$test_name" --ignored --nocapture
+}
+
+run_in_constrained_container() {
+    runtime=${FLUXHEIM_ACME_MOUNT_TEST_RUNTIME:-}
+    if [ -z "$runtime" ]; then
+        if command -v podman >/dev/null 2>&1; then
+            runtime=podman
+        elif command -v docker >/dev/null 2>&1; then
+            runtime=docker
+        else
+            echo "ACME mount-boundary smoke requires user namespaces, Podman, or Docker" >&2
+            exit 1
+        fi
+    fi
+    case "$runtime" in
+        podman | docker) ;;
+        *)
+            echo "unsupported ACME mount-boundary container runtime: $runtime" >&2
+            exit 1
+            ;;
+    esac
+
+    image=${FLUXHEIM_ACME_MOUNT_TEST_IMAGE:-docker.io/library/debian:13.3-slim@sha256:1d3c811171a08a5adaa4a163fbafd96b61b87aa871bbc7aa15431ac275d3d430}
+    apparmor_option=
+    if [ "$runtime" = docker ]; then
+        # docker-default denies mount(2) independently of CAP_SYS_ADMIN.
+        apparmor_option=--security-opt=apparmor=unconfined
+    fi
+    # apparmor_option is either empty or one fixed argument selected above.
+    # shellcheck disable=SC2086
+    "$runtime" run --rm \
+        --network none \
+        --read-only \
+        --cap-drop ALL \
+        --cap-add SYS_ADMIN \
+        --security-opt no-new-privileges \
+        $apparmor_option \
+        --pids-limit 64 \
+        --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m \
+        --user 0:0 \
+        --workdir /tmp \
+        --entrypoint /fluxheim-acme-test \
+        -v "$test_binary:/fluxheim-acme-test:ro,Z" \
+        "$image" \
+        --exact "$test_name" --ignored --nocapture
+}
+
+mode=${FLUXHEIM_ACME_MOUNT_TEST_MODE:-auto}
+case "$mode" in
+    auto)
+        if command -v unshare >/dev/null 2>&1 \
+            && unshare --user --map-root-user --mount --propagation private --fork true \
+                >/dev/null 2>&1; then
+            run_in_user_namespace
+        else
+            echo "ACME mount-boundary smoke: user namespaces unavailable; using constrained container" >&2
+            run_in_constrained_container
+        fi
+        ;;
+    userns)
+        if ! command -v unshare >/dev/null 2>&1; then
+            echo "ACME mount-boundary smoke requires util-linux unshare in userns mode" >&2
+            exit 1
+        fi
+        run_in_user_namespace
+        ;;
+    container)
+        run_in_constrained_container
+        ;;
+    *)
+        echo "unsupported ACME mount-boundary smoke mode: $mode" >&2
+        exit 1
+        ;;
+esac
 
 echo "ACME mount-boundary smoke passed"

scripts/test_starter.py

@@ -106,7 +106,7 @@ class TestEntry:
         "ACME mount-boundary security smoke",
         "security",
         ("scripts/smoke_acme_mount_boundary.sh",),
-        "Runs the ignored ACME bind-mount regression in isolated user and mount namespaces.",
+        "Runs the ignored ACME bind-mount regression in a user namespace or constrained container.",
     ),
     TestEntry(
         "peer-fill",

scripts/validate-acme-mount-boundary-plan.sh

@@ -20,8 +20,18 @@ require_text() {
 
 require_text "$test_source" '#[ignore = "requires an isolated privileged mount namespace"]'
 require_text "$smoke" 'unshare --user --map-root-user --mount --propagation private --fork'
+require_text "$smoke" '--cap-drop ALL'
+require_text "$smoke" '--cap-add SYS_ADMIN'
+require_text "$smoke" '--security-opt no-new-privileges'
+require_text "$smoke" '--security-opt=apparmor=unconfined'
+require_text "$smoke" '--network none'
+require_text "$smoke" '--read-only'
+require_text "$smoke" '--pids-limit 64'
+require_text "$smoke" '--tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m'
+require_text "$smoke" '--workdir /tmp'
 require_text "$smoke" '--exact "$test_name" --ignored --nocapture'
 require_text "$ci" 'scripts/smoke_acme_mount_boundary.sh'
+require_text "$ci" 'FLUXHEIM_ACME_MOUNT_TEST_MODE=container'
 require_text "$stable_gate" 'scripts/smoke_acme_mount_boundary.sh'
 require_text "$deep_gate" 'FLUXHEIM_GATE_ACME_MOUNT_BOUNDARY'
 require_text "$starter" '"acme-mount-boundary"'