From 31a90b4cb58a0fab5c5b97ef603aec5ce5c2236c Mon Sep 17 00:00:00 2001 From: Niels de Vos Date: Wed, 31 Jul 2024 18:51:29 +0200 Subject: [PATCH] ci: disable seccomp when running podman with GitHub Actions Fedora 40 builds seems to require disabling seccomp. When enabled, installing Golang inside the container fails. See-also: containers/podman#21012 Signed-off-by: Niels de Vos (cherry picked from commit db6f54f75d87261d66cada71e6a2a0f8665cec18) --- Makefile | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 64dfb581f51..5c6cbb26045 100644 --- a/Makefile +++ b/Makefile @@ -32,6 +32,11 @@ ifeq ($(HAVE_CPUSET),1) CPUSET ?= --cpuset-cpus=0-${CPUS} endif +ifneq ($(GITHUB_ACTION),) + # see https://github.com/containers/podman/issues/21012 + SECURITY_OPT ?= --security-opt seccomp=unconfined +endif + CSI_IMAGE_NAME=$(if $(ENV_CSI_IMAGE_NAME),$(ENV_CSI_IMAGE_NAME),quay.io/cephcsi/cephcsi) CSI_IMAGE_VERSION=$(shell . $(CURDIR)/build.env ; echo $${CSI_IMAGE_VERSION}) CSI_IMAGE=$(CSI_IMAGE_NAME):$(CSI_IMAGE_VERSION) @@ -222,7 +227,7 @@ ifeq ($(USE_PULLED_IMAGE),no) .test-container-id: .container-cmd build.env scripts/Dockerfile.test [ ! -f .test-container-id ] || $(CONTAINER_CMD) rmi $(CSI_IMAGE_NAME):test $(RM) .test-container-id - $(CONTAINER_CMD) build $(CPUSET) --build-arg GOARCH=$(GOARCH) -t $(CSI_IMAGE_NAME):test -f ./scripts/Dockerfile.test . + $(CONTAINER_CMD) build $(CPUSET) $(SECURITY_OPT) --build-arg GOARCH=$(GOARCH) -t $(CSI_IMAGE_NAME):test -f ./scripts/Dockerfile.test . $(CONTAINER_CMD) inspect -f '{{.Id}}' $(CSI_IMAGE_NAME):test > .test-container-id else # create the .test-container-id file based on the pulled image