GNU bug report logs - #75203
Fix rootless podman system tests and support I/O delegation

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 75203 in the body.
You can then email your comments to 75203 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: paul <goodoldpaul <at> autistici.org>
To: guix-patches <at> gnu.org
Cc: Ludovic Courtès <ludo <at> gnu.org>
Subject: Fix rootless podman system tests and support I/O delegation
Date: Mon, 30 Dec 2024 16:54:36 +0100

Hi Guix,

since rootless Podman tests are failing on CI ( 
https://ci.guix.gnu.org/build/7694600/details and past jobs), but are 
working on my machine ( :) ), I'm sending a patch adding a delay to 
allow services to start also on slower machines.

I'm using this occasion also to introduce a minor change (implement 
rootless I/O controller delegation) required for correct cgroups v2 
setup, according to [0].

Thank you for all your work,


giacomo


[0]: https://rootlesscontaine.rs/getting-started/common/cgroup2/

Message #8 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: Giacomo Leidi <goodoldpaul <at> autistici.org>
To: 75203 <at> debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul <at> autistici.org>
Subject: [PATCH 2/2] services: rootless-podman: Enable I/O delegation.
Date: Mon, 30 Dec 2024 16:55:22 +0100

Based on
https://rootlesscontaine.rs/getting-started/common/cgroup2/#enabling-cpu-cpuset-and-io-delegation
, this patch enables I/O delegation for cgroups v2 enabled users.

* gnu/services/containers.scm (cgroups-limits-entrypoint): Enable I/O
controller delegation.
* gnu/tests/containers.scm: Test it.

Change-Id: I7caba33695f11830bea477c4ab3afb89cfaa2fa5
---
 gnu/services/containers.scm | 2 +-
 gnu/tests/containers.scm    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/services/containers.scm b/gnu/services/containers.scm
index d8f533f44c..cb4b617e4b 100644
--- a/gnu/services/containers.scm
+++ b/gnu/services/containers.scm
@@ -169,7 +169,7 @@ (define cgroups-limits-entrypoint
                 #~(system*
                    (string-append #+bash-minimal "/bin/bash") "-c"
                    (string-append "echo Setting cgroups v2 limits && "
-                                  "echo +cpu +cpuset +memory +pids"
+                                  "echo +cpu +cpuset +io +memory +pids"
                                   " >> /sys/fs/cgroup/cgroup.subtree_control"))))
 
 (define (rootless-podman-cgroups-limits-service config)
diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
index 047010037e..ec8a9ad440 100644
--- a/gnu/tests/containers.scm
+++ b/gnu/tests/containers.scm
@@ -113,7 +113,7 @@ (define (run-rootless-podman-test oci-tarball)
           (sleep 60)
 
           (test-equal "/sys/fs/cgroup/cgroup.subtree_control content is sound"
-            (list "cpu" "cpuset" "memory" "pids")
+            (list "cpu" "cpuset" "io" "memory" "pids")
             (marionette-eval
              `(begin
                 (use-modules (srfi srfi-1)
-- 
2.47.1

Message #11 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: Giacomo Leidi <goodoldpaul <at> autistici.org>
To: 75203 <at> debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul <at> autistici.org>
Subject: [PATCH 1/2] services: tests: Add delay for rootless Podman system
 test.
Date: Mon, 30 Dec 2024 16:55:21 +0100

* gnu/tests/containers.scm (run-rootless-podman-test): Add 60 seconds
long delay before tests are actually run.

Change-Id: Ifcf70f7258f9e0886bf829884d7daedc9803352b
---
 gnu/tests/containers.scm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
index ba2fb22df6..047010037e 100644
--- a/gnu/tests/containers.scm
+++ b/gnu/tests/containers.scm
@@ -109,6 +109,9 @@ (define (run-rootless-podman-test oci-tarball)
                   (('service response-parts ...) #t)))
              marionette))
 
+          ;; Allow services to start on slower machines
+          (sleep 60)
+
           (test-equal "/sys/fs/cgroup/cgroup.subtree_control content is sound"
             (list "cpu" "cpuset" "memory" "pids")
             (marionette-eval

base-commit: 18463019a24a7c5acc9c2f3ddf3c0ba04a36db96
-- 
2.47.1

Message #14 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: Tomas Volf <~@wolfsden.cz>
To: Giacomo Leidi via Guix-patches via <guix-patches <at> gnu.org>
Cc: Giacomo Leidi <goodoldpaul <at> autistici.org>, 75203 <at> debbugs.gnu.org
Subject: Re: [bug#75203] [PATCH 1/2] services: tests: Add delay for rootless
 Podman system test.
Date: Tue, 31 Dec 2024 13:58:48 +0100

[Message part 1 (text/plain, inline)]

Giacomo Leidi via Guix-patches via <guix-patches <at> gnu.org> writes:

> * gnu/tests/containers.scm (run-rootless-podman-test): Add 60 seconds
> long delay before tests are actually run.
>
> Change-Id: Ifcf70f7258f9e0886bf829884d7daedc9803352b
> ---
>  gnu/tests/containers.scm | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
> index ba2fb22df6..047010037e 100644
> --- a/gnu/tests/containers.scm
> +++ b/gnu/tests/containers.scm
> @@ -109,6 +109,9 @@ (define (run-rootless-podman-test oci-tarball)
>                    (('service response-parts ...) #t)))
>               marionette))
>  
> +          ;; Allow services to start on slower machines
> +          (sleep 60)

Would it be possible to detect whether the services started?  This seems
like needless test run time penalty for fast systems.  Even a busy loop
with (sleep 1) would be much better in my opinion.

> +
>            (test-equal "/sys/fs/cgroup/cgroup.subtree_control content is sound"
>              (list "cpu" "cpuset" "memory" "pids")
>              (marionette-eval
>
> base-commit: 18463019a24a7c5acc9c2f3ddf3c0ba04a36db96

-- 
There are only two hard things in Computer Science:
cache invalidation, naming things and off-by-one errors.

[signature.asc (application/pgp-signature, inline)]

Message #20 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: paul <goodoldpaul <at> autistici.org>
To: Giacomo Leidi via Guix-patches via <guix-patches <at> gnu.org>,
 75203 <at> debbugs.gnu.org
Subject: Re: [bug#75203] [PATCH 1/2] services: tests: Add delay for rootless
 Podman system test.
Date: Mon, 6 Jan 2025 22:05:44 +0100

Hi Tomas,

good point, thank you for bringing that up! I didn't do it in the first 
place as I was not able to easily test the completion status of one shot 
Shepherd services. I hope revision 2 fixes tests also on CI.


cheers,

giacomo

Message #26 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: Giacomo Leidi <goodoldpaul <at> autistici.org>
To: 75203 <at> debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul <at> autistici.org>
Subject: [PATCH v2 1/2] services: tests: Add delay for rootless Podman system
 test.
Date: Mon,  6 Jan 2025 22:05:51 +0100

* gnu/tests/containers.scm (run-rootless-podman-test): Add 60 seconds
long delay before tests are actually run.

Change-Id: Ifcf70f7258f9e0886bf829884d7daedc9803352b
---
 gnu/tests/containers.scm | 113 +++++++++++++++++++++------------------
 1 file changed, 60 insertions(+), 53 deletions(-)

diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
index ba2fb22df6..69cd311c82 100644
--- a/gnu/tests/containers.scm
+++ b/gnu/tests/containers.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2024 Giacomo Leidi <goodoldpaul <at> autistici.org>
+;;; Copyright © 2024, 2025 Giacomo Leidi <goodoldpaul <at> autistici.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -97,17 +97,65 @@ (define (run-rootless-podman-test oci-tarball)
 
           (test-runner-current (system-test-runner #$output))
           (test-begin "rootless-podman")
-
-          (test-assert "service started"
-            (marionette-eval
-             '(begin
-                (use-modules (gnu services herd))
-                (match (start-service 'cgroups2-fs-owner)
-                  (#f #f)
-                  ;; herd returns (running #f), likely because of one shot,
-                  ;; so consider any non-error a success.
-                  (('service response-parts ...) #t)))
-             marionette))
+          (marionette-eval
+           '(begin
+              (use-modules (gnu services herd))
+              (wait-for-service 'file-system-/sys/fs/cgroup))
+           marionette)
+
+          (test-assert "services started successfully and /sys/fs/cgroup has correct permissions"
+            (begin
+              (define (run-test)
+                (marionette-eval
+                 `(begin
+                    (use-modules (ice-9 popen)
+                                 (ice-9 match)
+                                 (ice-9 rdelim))
+
+                    (define (read-lines file-or-port)
+                      (define (loop-lines port)
+                        (let loop ((lines '()))
+                          (match (read-line port)
+                            ((? eof-object?)
+                             (reverse lines))
+                            (line
+                             (loop (cons line lines))))))
+
+                      (if (port? file-or-port)
+                          (loop-lines file-or-port)
+                          (call-with-input-file file-or-port
+                            loop-lines)))
+
+                    (define slurp
+                      (lambda args
+                        (let* ((port (apply open-pipe* OPEN_READ args))
+                               (output (read-lines port))
+                               (status (close-pipe port)))
+                          output)))
+                    (let* ((bash
+                            ,(string-append #$bash "/bin/bash"))
+                           (response1
+                            (slurp bash "-c"
+                                   (string-append "ls -la /sys/fs/cgroup | "
+                                                  "grep -E ' \\./?$' | awk '{ print $4 }'")))
+                           (response2 (slurp bash "-c"
+                                             (string-append "ls -l /sys/fs/cgroup/cgroup"
+                                                            ".{procs,subtree_control,threads} | "
+                                                            "awk '{ print $4 }' | sort -u"))))
+                      (list (string-join response1 "\n") (string-join response2 "\n"))))
+                 marionette))
+              ;; Allow services to come up on slower machines
+              (let loop ((attempts 0))
+                (if (= attempts 60)
+                    (error "Services didn't come up after more than 60 seconds")
+                    (if (equal? '("cgroup" "cgroup")
+                                (run-test))
+                        #t
+                        (begin
+                          (sleep 1)
+                          (format #t "Services didn't come up yet, retrying with attempt ~a~%"
+                                  (+ 1 attempts))
+                          (loop (+ 1 attempts))))))))
 
           (test-equal "/sys/fs/cgroup/cgroup.subtree_control content is sound"
             (list "cpu" "cpuset" "memory" "pids")
@@ -144,47 +192,6 @@ (define (run-rootless-podman-test oci-tarball)
                   (sort-list (string-split (first response1) #\space) string<?)))
              marionette))
 
-          (test-equal "/sys/fs/cgroup has correct permissions"
-            '("cgroup" "cgroup")
-            (marionette-eval
-             `(begin
-                (use-modules (ice-9 popen)
-                             (ice-9 match)
-                             (ice-9 rdelim))
-
-                (define (read-lines file-or-port)
-                  (define (loop-lines port)
-                    (let loop ((lines '()))
-                      (match (read-line port)
-                        ((? eof-object?)
-                         (reverse lines))
-                        (line
-                         (loop (cons line lines))))))
-
-                  (if (port? file-or-port)
-                      (loop-lines file-or-port)
-                      (call-with-input-file file-or-port
-                        loop-lines)))
-
-                (define slurp
-                  (lambda args
-                    (let* ((port (apply open-pipe* OPEN_READ args))
-                           (output (read-lines port))
-                           (status (close-pipe port)))
-                      output)))
-                (let* ((bash
-                        ,(string-append #$bash "/bin/bash"))
-                       (response1
-                        (slurp bash "-c"
-                               (string-append "ls -la /sys/fs/cgroup | "
-                                              "grep -E ' \\./?$' | awk '{ print $4 }'")))
-                       (response2 (slurp bash "-c"
-                                         (string-append "ls -l /sys/fs/cgroup/cgroup"
-                                                        ".{procs,subtree_control,threads} | "
-                                                        "awk '{ print $4 }' | sort -u"))))
-                  (list (string-join response1 "\n") (string-join response2 "\n"))))
-             marionette))
-
           (test-equal "Load oci image and run it (unprivileged)"
             '("hello world" "hi!" "JSON!" #o1777)
             (marionette-eval

base-commit: ee3673217b82d50e97434ae85145b8d68f077446
-- 
2.47.1

Message #29 received at 75203 <at> debbugs.gnu.org (full text, mbox):

From: Giacomo Leidi <goodoldpaul <at> autistici.org>
To: 75203 <at> debbugs.gnu.org
Cc: Giacomo Leidi <goodoldpaul <at> autistici.org>
Subject: [PATCH v2 2/2] services: rootless-podman: Enable I/O delegation.
Date: Mon,  6 Jan 2025 22:05:52 +0100

Based on
https://rootlesscontaine.rs/getting-started/common/cgroup2/#enabling-cpu-cpuset-and-io-delegation
, this patch enables I/O delegation for cgroups v2 enabled users.

* gnu/services/containers.scm (cgroups-limits-entrypoint): Enable I/O
controller delegation.
* gnu/tests/containers.scm: Test it.

Change-Id: I7caba33695f11830bea477c4ab3afb89cfaa2fa5
---
 gnu/services/containers.scm | 2 +-
 gnu/tests/containers.scm    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/gnu/services/containers.scm b/gnu/services/containers.scm
index a82fb64db3..19d35ccbcb 100644
--- a/gnu/services/containers.scm
+++ b/gnu/services/containers.scm
@@ -174,7 +174,7 @@ (define cgroups-limits-entrypoint
                 #~(system*
                    (string-append #+bash-minimal "/bin/bash") "-c"
                    (string-append "echo Setting cgroups v2 limits && "
-                                  "echo +cpu +cpuset +memory +pids"
+                                  "echo +cpu +cpuset +io +memory +pids"
                                   " >> /sys/fs/cgroup/cgroup.subtree_control"))))
 
 (define (rootless-podman-cgroups-limits-service config)
diff --git a/gnu/tests/containers.scm b/gnu/tests/containers.scm
index 69cd311c82..0ecc8ddb12 100644
--- a/gnu/tests/containers.scm
+++ b/gnu/tests/containers.scm
@@ -158,7 +158,7 @@ (define (run-rootless-podman-test oci-tarball)
                           (loop (+ 1 attempts))))))))
 
           (test-equal "/sys/fs/cgroup/cgroup.subtree_control content is sound"
-            (list "cpu" "cpuset" "memory" "pids")
+            (list "cpu" "cpuset" "io" "memory" "pids")
             (marionette-eval
              `(begin
                 (use-modules (srfi srfi-1)
-- 
2.47.1

Message #34 received at 75203-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: Giacomo Leidi <goodoldpaul <at> autistici.org>
Cc: 75203-done <at> debbugs.gnu.org
Subject: Re: bug#75203: Fix rootless podman system tests and support I/O
 delegation
Date: Sun, 12 Jan 2025 00:20:44 +0100

Applied, thanks!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.