CGgroups v1 cleanup: Round 2 w/ container-libs vendoring #27551

lsm5 · 2025-11-17T20:04:40Z

Checklist

Ensure you have completed the following checklist for your pull request to be reviewed:

Certify you wrote the patch or otherwise have the right to pass it on as an open-source patch by signing all
commits. (git commit -s). (If needed, use git commit -s --amend). The author email must match
the sign-off email address. See CONTRIBUTING.md
for more information.
Referenced issues using Fixes: #00000 in commit message (if applicable)
Tests have been added/updated (or no tests are needed)
Documentation has been updated (or no documentation changes are needed)
All commits pass make validatepr (format/lint checks)
Release note entered in the section below (or None if no user-facing changes)

Does this PR introduce a user-facing change?

None

lsm5 · 2025-11-17T20:08:03Z

Depends on containers/container-libs#464

lsm5 · 2025-11-21T16:04:23Z

machine-linux podman fedora-42-aarch64 rootless host failing with Failed to start: FAILED_PRECONDITION: Insufficient capacity. (Service: Ec2, Status Code: 500, Request ID: 816dcd07-0785-4d68-a143-ddf5eea0d459) (SDK Attempt Count: 4) . Does that usually occur?

mtrmac · 2025-11-22T02:08:36Z

libpod/oci_conmon_linux.go

+			_, err := cgroups.New(cgroupPath, &cgroupResources)
 			if err != nil {
 				logrus.StandardLogger().Logf(logLevel, "Failed to add conmon to cgroupfs sandbox cgroup: %v", err)
-			} else if err := control.AddPid(cmd.Process.Pid); err != nil {


Is removing this correct? (I have no idea.)

@containers/podman-maintainers wdyt? This is only in the case when cgroups manager isn't systemd which (IIRC) is safe to remove. Also, no tests failed with this removal fwiw. So if it is needed at all, do we need a test for this case too?

no, we still support cgroupfs. We need this call to move the process to the target cgroup

ack, got it. I'll revise. Thanks!

This reverts commit cce5ec8. Note: This has already gone through a revert and re-revert cycle in commits 5273685 and 3fe402b, but that's wrong per: containers/podman#27551 (comment) . Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

packit-as-a-service · 2025-11-25T19:05:43Z

[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore.

This reverts commit cce5ec8 and calls .Apply to honor the API. Note: This has already gone through a revert and re-revert cycle in commits 5273685 and 3fe402b, but that's wrong per: containers/podman#27551 (comment) . Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

packit-as-a-service · 2025-12-02T17:42:53Z

Cockpit tests failed for commit cd6d8c1. @martinpitt, @jelly, @mvollmer please check.

Also simplifies cgroups.AvailableControllers Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

lsm5 · 2025-12-02T20:39:20Z

vendored container-libs commit df55d6c661e8 in this PR.

mtrmac

LGTM if tests pass, given that containers/container-libs#464 was approved by experts.

packit-as-a-service · 2025-12-03T13:11:22Z

Cockpit tests failed for commit b78f1cf. @martinpitt, @jelly, @mvollmer please check.

lsm5 · 2025-12-03T13:44:52Z

Cockpit tests are failing on other PRs too, so I think we can ignore them here.

cc @martinpitt

lsm5 · 2025-12-03T13:51:52Z

@containers/podman-maintainers PTAL

Luap99

/lgtm

openshift-ci · 2025-12-03T13:57:13Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lsm5, Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Luap99,lsm5]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

martinpitt · 2025-12-03T13:57:53Z

@lsm5: wrt. the recent failure:

podman run --log-driver=passthrough --name {container_name} -d {IMG_ALPINE} false </dev/null
fchown std stream 1: Permission denied
Error: crun: fchown std stream 1: Permission denied: OCI permission denied

Ah, seems this spontaneously combusted in Rawhide a few days ago. Sorry, in a face-to-face meeting this week with near-zero computer time. Unless this already rings a bell with you, feel free to ignore this week. Next monday I can turn this into a standalone reproducer and file a podman (or crun?) issue. At least F43 is still green, which for the time being should be enough to verify podman PRs?

lsm5 · 2025-12-03T14:09:22Z

At least F43 is still green, which for the time being should be enough to verify podman PRs?

I'm cool with that. If anyone finds the failures to be an issue, we could disable the rawhide cockpit jobs.

This vendors container-libs commit `df55d6c661e85a57c0931574373afe6a0259d873`. Similar Podman PR: containers/podman#27551 . Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

Luap99 · 2025-12-03T14:46:39Z

@lsm5: wrt. the recent failure:

podman run --log-driver=passthrough --name {container_name} -d {IMG_ALPINE} false </dev/null
fchown std stream 1: Permission denied
Error: crun: fchown std stream 1: Permission denied: OCI permission denied

Ah, seems this spontaneously combusted in Rawhide a few days ago. Sorry, in a face-to-face meeting this week with near-zero computer time. Unless this already rings a bell with you, feel free to ignore this week. Next monday I can turn this into a standalone reproducer and file a podman (or crun?) issue. At least F43 is still green, which for the time being should be enough to verify podman PRs?

@giuseppe FYI

martinpitt · 2025-12-03T16:13:42Z

Observations (mostly my own notes, sorry). Reproducer:

$ ssh myrawhidemachine podman run --log-driver=passthrough --rm --name test1 docker.io/alpine false

Warning: Permanently added '[127.0.0.2]:2201' (ED25519) to the list of known hosts.
fchown std stream `0`: Permission denied
Error: crun: fchown std stream `0`: Permission denied: OCI permission denied

It has to go via ssh as the passthrough driver doesn't work in a pty.

current fedora-rawhide proper: pass
current fefora-rawhide plus podman-next copr: pass (unexpected)
current fedora-rawhide image with podman-next and dnf-update: fails
only upgrading selinux-policy 42.17-1.fc44 → 42.18-1.fc44 (surprising)
fails with openssh 10.0p1-8.fc44 → 10.0p1-9.fc44 ⚡ . Confirmed with stock rawhide without any copr, and only updating that package.

So.. it's not SELinux, and it's not DNS.. That must be a first!

martinpitt · 2025-12-03T16:16:55Z

So.. it's not SELinux

Sorry, this was wrong after all. It is SELinux. The -9 change is massive is massive and says "Remove redundant SELinux patches", and setenforce 0 makes the test pass.

Not enough bandwidth on the f2f to file an openssh bugzilla, can someone beat me to it?

martinpitt · 2025-12-03T21:15:15Z

@jelly sent cockpit-project/bots#8507 to mark this as a known failure, to put an end to the massive noise in podman PRs. I'll send the Fedora bug report on Friday when I travel back from the f2f meeting.

martinpitt · 2025-12-05T08:47:38Z

For the record: openssh regression is reported here: https://bugzilla.redhat.com/show_bug.cgi?id=2418587

openshift-ci bot added release-note-none do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Nov 17, 2025

lsm5 added the No New Tests Allow PR to proceed without adding regression tests label Nov 17, 2025

lsm5 force-pushed the cgv1-removal-vendor branch from 64c886a to 2b337bb Compare November 21, 2025 15:50

github-actions bot added the kind/api-change Change to remote API; merits scrutiny label Nov 21, 2025

lsm5 changed the title ~~Remove AddPid and simplify cgroups.AvailableControllers~~ CGgroups v1 cleanup: Round 2 w/ container-libs vendoring Nov 21, 2025

lsm5 force-pushed the cgv1-removal-vendor branch from 2b337bb to 7da1bc6 Compare November 21, 2025 17:25

lsm5 mentioned this pull request Nov 21, 2025

Cgroups V1 removal containers/container-libs#464

Merged

mtrmac reviewed Nov 22, 2025

View reviewed changes

lsm5 force-pushed the cgv1-removal-vendor branch 2 times, most recently from df346e1 to c1a613b Compare November 24, 2025 20:05

lsm5 force-pushed the cgv1-removal-vendor branch 2 times, most recently from b25b3f7 to 059964e Compare November 25, 2025 19:04

lsm5 force-pushed the cgv1-removal-vendor branch from 059964e to cd6d8c1 Compare December 2, 2025 15:42

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 2, 2025

lsm5 force-pushed the cgv1-removal-vendor branch from cd6d8c1 to e525664 Compare December 2, 2025 15:53

openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Dec 2, 2025

vendor: update container-libs to df55d6c661e8 for cgv1 removal

b78f1cf

Also simplifies cgroups.AvailableControllers Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>

lsm5 force-pushed the cgv1-removal-vendor branch from e525664 to b78f1cf Compare December 2, 2025 20:38

mtrmac reviewed Dec 2, 2025

View reviewed changes

lsm5 marked this pull request as ready for review December 3, 2025 13:50

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 3, 2025

Luap99 approved these changes Dec 3, 2025

View reviewed changes

openshift-ci bot assigned Luap99 Dec 3, 2025

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 3, 2025

openshift-merge-bot bot merged commit 963aabb into containers:main Dec 3, 2025
87 of 88 checks passed

lsm5 deleted the cgv1-removal-vendor branch December 3, 2025 14:07

lsm5 mentioned this pull request Dec 3, 2025

vendor: Update container-libs with cgv1 removed containers/buildah#6564

Merged

martinpitt mentioned this pull request Dec 3, 2025

SELinux SSH regression on Fedora-44 cockpit-project/bots#8506

Open

CGgroups v1 cleanup: Round 2 w/ container-libs vendoring #27551

CGgroups v1 cleanup: Round 2 w/ container-libs vendoring #27551

Uh oh!

Conversation

lsm5 commented Nov 17, 2025

Checklist

Does this PR introduce a user-facing change?

Uh oh!

lsm5 commented Nov 17, 2025

Uh oh!

lsm5 commented Nov 21, 2025

Uh oh!

mtrmac Nov 22, 2025

Choose a reason for hiding this comment

Uh oh!

lsm5 Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

giuseppe Nov 24, 2025

Choose a reason for hiding this comment

Uh oh!

lsm5 Nov 25, 2025

Choose a reason for hiding this comment

Uh oh!

packit-as-a-service bot commented Nov 25, 2025

Uh oh!

packit-as-a-service bot commented Dec 2, 2025

Uh oh!

lsm5 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mtrmac left a comment

Choose a reason for hiding this comment

Uh oh!

packit-as-a-service bot commented Dec 3, 2025

Uh oh!

lsm5 commented Dec 3, 2025

Uh oh!

lsm5 commented Dec 3, 2025

Uh oh!

Luap99 left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Dec 3, 2025

Uh oh!

martinpitt commented Dec 3, 2025

Uh oh!

Uh oh!

lsm5 commented Dec 3, 2025

Uh oh!

Luap99 commented Dec 3, 2025

Uh oh!

martinpitt commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

martinpitt commented Dec 3, 2025

Uh oh!

martinpitt commented Dec 3, 2025

Uh oh!

martinpitt commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

lsm5 commented Dec 2, 2025 •

edited

Loading

martinpitt commented Dec 3, 2025 •

edited

Loading