tests/int: introduce the concept of unsafe tests

[kolyshkin]

Some of runc integration tests may do something that I would not like when running those on my development laptop. Examples include

• changing the root mount propagation (see fix(libcontainer): preserve rootfs slave propagation for rslave containers #5200);
• replacing /root/runc (see list: fix IsSet check for global root flag #5207);
• changing the file in /etc (see checkpoint.bats).

Yet it is totally fine to do all that in a throwaway CI environment, or inside a Docker container.

Introduce a mechanism to skip specific "unsafe" tests unless an environment variable, RUNC_ALLOW_UNSAFE_TESTS, is set. Use it from a specific checkpoint/restore test which modifies /etc/criu/default.conf.

[kolyshkin]

Note that the following is not considered "unsafe":

• adding mounts on the host;
• adding network interfaces, block loop devices, cgroups etc.;
• sharing host mount namespace with a test container.

One other "unsafe" case not covered here is rootless idmap tests setup/cleanup in tests/rootless.sh, which renames /usr/bin/new{u,g}idmap binaries and modifies /etc/sub{u,g}id. Maybe we should skip it, too, unless RUNC_ALLOW_UNSAFE_TESTS is set.

[rata]

It seems bats has built-in support for tags/labels, but if you run bats ... <file> it won't work. You can force it to be opt-in. So this SGTM

[kolyshkin]

It seems bats has built-in support for tags/labels, but if you run bats ... <file> it won't work. You can force it to be opt-in. So this SGTM

Right, I forgot about bats tags. The big issue is, you can't force it to be opt-in (you probably meant the same thing) if you're using bats directly (I often do that on my machine).

Another thing with bats tags is the test is silently excluded rather than skipped, while here the test is shown as skipped with a reason why ("requires unsafe"). To me being visible is slightly better.

Since implementation is rather trivial I'd rather stick to it.

[kolyshkin]

@opencontainers/runc-maintainers I need more eyes on this to help move #5200 and #5207 forward

[thaJeztah]

SGTM

haven't tested as I'm not on a Linux machine, so assuming this does the skips as expected 😅

[RedMakeUp]

Does this variable RUNC_ALLOW_UNSAFE_TESTS reach the tests in Cirrus CI correctly?. It seams all integration tests are executed via ssh -tt localhost "make ...", which starts a new login shell.

I checked the cirrus ci logs of this PR and found ok 46 checkpoint and restore with container specific CRIU config # skip test requires unsafe. If the variable works, the comment # skip test requires unsafe won't appear here, right?

[lifubang]

Thanks, good catch. Would you mind opening a PR to fix this?