Skip to content

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458

Merged
lsm5 merged 4 commits intocontainers:v4.2.0-rhelfrom
cevich:backport_runc_fix
Apr 13, 2026
Merged

[v4.2.0-rhel] Backport: do not pass volume options as bind mounts options to runtime#28458
lsm5 merged 4 commits intocontainers:v4.2.0-rhelfrom
cevich:backport_runc_fix

Conversation

@cevich
Copy link
Copy Markdown
Member

@cevich cevich commented Apr 7, 2026

Followup to #27933 - Neglected to backport for fixes: https://issues.redhat.com/browse/RHEL-132863 https://issues.redhat.com/browse/RHEL-132860

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

  • Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
    commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
    the sign-off email address. See CONTRIBUTING.md
    for more information.
  • Referenced issues using Fixes: #00000 in commit message (if applicable)
  • Tests have been added/updated (or no tests are needed)
  • Documentation has been updated (or no documentation changes are needed)
  • All commits pass make validatepr (format/lint checks)
  • Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

None

Luap99 added 2 commits April 7, 2026 14:37
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the volume-opt options are specifc to the volume we create
and should not be passed to the mount in the oci spec.

Fixes: containers#26938

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 7fda4df)
Signed-off-by: Chris Evich <cevich@redhat.com>
Starting with runc 1.3.0 it errors when we pass unknown mount options to
the runtime, the copy/nocopy options are specific to podman when we
mount the volume and are not valid mount options for the runtime.

Fixes: containers#26938
Fixes: https://issues.redhat.com/browse/RHEL-132532,
https://issues.redhat.com/browse/RHEL-132531

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: tomsweeneyredhat <tsweeney@redhat.com>
(cherry picked from commit 1e4a59d)
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich marked this pull request as draft April 7, 2026 18:42
@cevich
Copy link
Copy Markdown
Member Author

cevich commented Apr 7, 2026

Running system tests...tests finished. No surprises, exactly the same results as #27933

@cevich
Copy link
Copy Markdown
Member Author

cevich commented Apr 8, 2026

@TomSweeneyRedHat @lsm5 PTAL when you have a chance.

@lsm5
Copy link
Copy Markdown
Member

lsm5 commented Apr 8, 2026

Running tests on internal ranch. Will update here.

Copy link
Copy Markdown
Member

@lsm5 lsm5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to backport PodmanExitCleanly if we need to actually run integration tests.

@lsm5
Copy link
Copy Markdown
Member

lsm5 commented Apr 8, 2026

system and other tests are good though.

@TomSweeneyRedHat
Copy link
Copy Markdown
Member

@cevich what @lsm5 said. He caught the test issue on my PR, and I believe you need to pick a9ac512 to fix it.

As this truly closes the runc CVEs, I'd add a note to that PR pointing here if you have not already, and then list the Jira cards that will be fixed in the Description.

Combined test for (exitcode == 0) && (nothing on stderr).
Returns more useful diagnostic messages than the default:

  old: Expected N to equal 0

  new: Command failed with exit status N
  new: Unexpected warnings seen on stderr: "...."

Adding fro the ExitCleanOnly function that is present
in some tests that were cherry picked for this PR.

Signed-off-by: Ed Santiago <santiago@redhat.com>
(cherry picked from commit 6cbd17c)
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
(cherry picked from commit a9ac512)
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich cevich requested a review from lsm5 April 10, 2026 14:25
@lsm5
Copy link
Copy Markdown
Member

lsm5 commented Apr 10, 2026

@cevich need this one actually: 0c18beaea7 . Also, remove GinkgoHelper() from it as it's only ginkgo v2 https://github.com/containers/podman/pull/28450/changes#r3065869701

This significantly simplifies the ceromony of running a Podman command
in integration tests, from

> session := p.Podman([]string{"stop", id})
> session.WaitWithDefaultTimeout()
> Expect(session).Should(ExitCleanly())

to
> p.PodmanExitCleanly("stop", id)

There are >4650 instances of ExitCleanly() in the tests,
and many could be migrated; this does not do that.

Signed-off-by: Miloslav Trmač <mitr@redhat.com>
(cherry picked from commit 0c18bea)
Conflicts resolved with the assistance of AI: Cursor <auto>
Signed-off-by: Chris Evich <cevich@redhat.com>
@cevich
Copy link
Copy Markdown
Member Author

cevich commented Apr 13, 2026

Backported, conflicts resolved by AI in favor of ginkgo v1. Both tests and project compiles fine. I did not run any tests though.

Copy link
Copy Markdown
Member

@lsm5 lsm5 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Integration tests compiled successfully.

LGTM

@lsm5 lsm5 merged commit 786fcba into containers:v4.2.0-rhel Apr 13, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants