TRT-2865: Add nested-podman integration test image for CI

[mstaeble]

Summary

• Adds Dockerfile.integration that layers podman, fuse-overlayfs, and shadow-utils on top of the build root for running integration tests in CI with nested podman
• Adds scripts/nested-podman-entrypoint.sh that configures rootless podman (storage, registries, subuid/subgid, OpenShift random UID handling) and starts the podman API socket service so testcontainers-go can connect
• No changes to integration test code; testcontainers-go works as-is once DOCKER_HOST points at the podman socket

The corresponding ci-operator config change (in openshift/release) will reference this Dockerfile with from: src and add an integration test job with capabilities: [nested-podman] and nested_podman: true.

Test plan

• Built buildroot image locally (podman build -f Dockerfile.buildroot)
• Built integration image on top (podman build --from sippy-buildroot -f Dockerfile.integration)
• Verified make integration starts successfully inside the container with --privileged
• CI rehearsal in openshift/release PR

🤖 Generated with Claude Code

Summary by CodeRabbit

• Tests
  • Added a containerized integration-test environment with nested rootless container support.
  • Improved integration test startup and configuration, including Podman API readiness and Docker-compatible test settings.
  • Added support for dynamic user and group mappings in hosted CI environments.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: automatic mode

[openshift-ci-robot]

@mstaeble: This pull request references TRT-2865 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds Dockerfile.integration that layers podman, fuse-overlayfs, and shadow-utils on top of the build root for running integration tests in CI with nested podman
• Adds scripts/nested-podman-entrypoint.sh that configures rootless podman (storage, registries, subuid/subgid, OpenShift random UID handling) and starts the podman API socket service so testcontainers-go can connect
• No changes to integration test code; testcontainers-go works as-is once DOCKER_HOST points at the podman socket

The corresponding ci-operator config change (in openshift/release) will reference this Dockerfile with from: src and add an integration test job with capabilities: [nested-podman] and nested_podman: true.

Test plan

• Built buildroot image locally (podman build -f Dockerfile.buildroot)
• Built integration image on top (podman build --from sippy-buildroot -f Dockerfile.integration)
• Verified make integration starts successfully inside the container with --privileged
• CI rehearsal in openshift/release PR

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[coderabbitai]

Walkthrough

Adds an integration-test image with nested rootless Podman. The entrypoint configures user mappings, storage, registries, and the Podman API socket, then runs integration tests through Docker-compatible testcontainers settings.

Changes

Nested Podman integration tests

Layer / File(s)	Summary
Integration image setup Dockerfile.integration	Builds the integration-test image with Podman, nested-container dependencies, Buildah configuration, UID/GID mappings, capabilities, and a catatonit-managed entrypoint.
Rootless Podman environment scripts/nested-podman-entrypoint.sh	Creates user configuration, sets registry and storage options, handles unmapped OpenShift users, and writes subuid/subgid ranges.
Podman API handoff scripts/nested-podman-entrypoint.sh	Starts and validates the persistent Podman API socket, exports DOCKER_HOST, disables Testcontainers Ryuk, and runs the supplied command.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant IntegrationTests
  participant nestedPodmanEntrypoint
  participant PodmanAPI
  IntegrationTests->>nestedPodmanEntrypoint: supply integration test command
  nestedPodmanEntrypoint->>PodmanAPI: start rootless API service
  PodmanAPI-->>nestedPodmanEntrypoint: create Unix socket
  nestedPodmanEntrypoint->>IntegrationTests: export DOCKER_HOST and disable Ryuk
  IntegrationTests->>PodmanAPI: issue container requests

Loading

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Dockerfile.integration has no USER directive, so the image runs as root by default; the PR provides no runtime justification or non-root enforcement.	Set a non-root runtime USER or define an explicit, documented security context that prevents root execution; keep build-time root operations separate.

✅ Passed checks (20 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Go Error Handling	✅ Passed	The patch adds only Dockerfile.integration and a Bash entrypoint; it changes no Go files and introduces no Go error-handling code.
Sql Injection Prevention	✅ Passed	The PR adds only a Dockerfile and Podman entrypoint; neither contains SQL queries or database calls, and interpolated values are used for configuration paths or quoted process arguments.
Excessive Css In React Should Use Styles	✅ Passed	The PR changes only Dockerfile.integration and a Bash entrypoint; it adds no React/JSX components or inline CSS requiring useStyles.
Test Coverage For New Features	✅ Passed	The PR adds CI/test infrastructure only; existing integration tests start testcontainers, and the PR reports make integration succeeded inside the new image.
Single Responsibility And Clear Naming	✅ Passed	The change adds no packages, structs, or methods. The clearly named entrypoint has one cohesive purpose: configure nested rootless Podman and launch the test command; its variables are specific.
Feature Documentation	✅ Passed	The PR adds CI integration-test infrastructure only; docs/features contains only the unrelated job-analysis symptoms feature, with no documented data model, data flow, API, or core concept changes.
Stable And Deterministic Test Names	✅ Passed	The patch changes only Dockerfile.integration and a shell entrypoint; it adds no Ginkgo tests or test titles, so no dynamic names are introduced.
Test Structure And Quality	✅ Passed	The commit adds only Dockerfile.integration and scripts/nested-podman-entrypoint.sh; it changes no Ginkgo or Go test files, so these test-quality requirements are not applicable.
Microshift Test Compatibility	✅ Passed	The patch adds only Dockerfile.integration and a shell entrypoint; it adds no Ginkgo e2e tests or OpenShift API references to assess.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds only Dockerfile.integration and scripts/nested-podman-entrypoint.sh; it adds no Ginkgo e2e tests or changed Go files requiring SNO compatibility review.
Topology-Aware Scheduling Compatibility	✅ Passed	HEAD adds only Dockerfile.integration and a Podman entrypoint; neither contains deployment manifests, controllers, or topology-related scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes only Dockerfile and shell entrypoint files; no OTE binary or suite code changes, and added shell output targets files or stderr.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds only Dockerfile and shell infrastructure; it adds no Ginkgo e2e tests or test code. The IPv6/disconnected test check is not applicable.
No-Weak-Crypto	✅ Passed	The PR adds only a Dockerfile and Podman entrypoint; scans of all added lines found no MD5, SHA-1, DES, RC4, 3DES, Blowfish, ECB, crypto implementation, or secret comparison.
No-Sensitive-Data-In-Logs	✅ Passed	The new code writes user and subid data to files, not logs; its only explicit log is a socket path error, with no secret-bearing values or shell tracing emitted.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the added nested-Podman integration test image for CI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mstaeble

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [mstaeble]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@Dockerfile.integration`:
- Around line 4-8: Refactor Dockerfile.integration into separate builder and
runtime stages: keep source, build tools, and `make integration` execution in
the builder stage, then copy only the resulting test artifact and required
Podman runtime dependencies into the final stage. Ensure the final image is
runtime-only and does not inherit the build root contents or tools.
- Around line 1-3: The nested-Podman test interface is missing documentation for
local image builds, privileged runtime requirements, DOCKER_HOST, and
TESTCONTAINERS_RYUK_DISABLED. Update Dockerfile.integration lines 1-3 with local
build and run instructions, and update scripts/nested-podman-entrypoint.sh lines
82-83 to document the exported testcontainers settings and required CI
capabilities.
- Around line 21-22: Add a Dockerfile HEALTHCHECK after the Podman
ENTRYPOINT/CMD that probes the Podman socket or API using the available
container tooling, and configure it to run after the nested Podman entrypoint
has started the service so CI reports service failures directly.
- Around line 21-22: Update Dockerfile.integrations’ runtime configuration to
declare a non-root USER after all required file permissions are set, so the
existing ENTRYPOINT and CMD run as that user by default. Use the appropriate
non-root user already created or configured in the image, without relying on
OpenShift overrides.

In `@scripts/nested-podman-entrypoint.sh`:
- Around line 10-18: Update the registries.conf heredoc in the entrypoint to
prevent ambiguous short image names: replace permissive short-name handling with
enforcing mode and define explicit aliases for any required unqualified images,
or remove the multi-registry search configuration by converting image references
to fully qualified names.
- Around line 51-60: Update the SUBID_START_DEFAULT/SUBID_COUNT_DEFAULT
validation in the nested Podman entrypoint to reject unsupported mappings
instead of falling back to 100000:65536 when id -u leaves no valid range; exit
with a clear error before writing /etc/subuid and /etc/subgid, or otherwise
ensure CI selects a UID that provides a valid 0-65535 subordinate-ID range.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: bcebf892-5931-45f7-a578-3b97db424b86

📥 Commits

Reviewing files that changed from the base of the PR and between 7dec24f and d3b1b06.

📒 Files selected for processing (2)

• Dockerfile.integration
• scripts/nested-podman-entrypoint.sh

[mstaeble]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[openshift-merge-bot]

Scheduling required tests:
/test e2e

[openshift-ci]

@mstaeble: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.