From 53cedc0a6c6fab38ba90837140bf553afec625d4 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Wed, 8 Jul 2026 21:43:49 +0900 Subject: [PATCH 1/2] test: skip TestIssue3016 for Docker with the containerd image store Docker with the containerd image store (the default since Docker v29 on fresh installs, e.g., on the ubuntu-26.04 GitHub Actions runners) refuses to resolve a reference that is both a tag and an image ID prefix ("ambiguous reference"), while nerdctl and Docker with the classic graph drivers resolve the tag first. Introduce a nerdtest.DockerContainerdSnapshotter requirement that detects the containerd image store from the "driver-type" entry of `docker info`'s DriverStatus, and skip TestIssue3016 with require.Not(nerdtest.DockerContainerdSnapshotter). Assisted-by: Claude Fable 5 Signed-off-by: Akihiro Suda --- cmd/nerdctl/image/image_remove_test.go | 5 +++++ pkg/testutil/nerdtest/requirements.go | 24 ++++++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/cmd/nerdctl/image/image_remove_test.go b/cmd/nerdctl/image/image_remove_test.go index 6e3f4ad3e36..d0b5f25ea0c 100644 --- a/cmd/nerdctl/image/image_remove_test.go +++ b/cmd/nerdctl/image/image_remove_test.go @@ -311,6 +311,11 @@ func TestRemove(t *testing.T) { func TestIssue3016(t *testing.T) { testCase := nerdtest.Setup() + // Docker with the containerd image store refuses to resolve a reference that is + // both a tag and an image ID prefix ("ambiguous reference"), while nerdctl (and + // Docker with the classic graph drivers) resolves the tag first. + testCase.Require = require.Not(nerdtest.DockerContainerdSnapshotter) + const ( tagIDKey = "tagID" ) diff --git a/pkg/testutil/nerdtest/requirements.go b/pkg/testutil/nerdtest/requirements.go index 2be8b6f9b4c..b7542e4c381 100644 --- a/pkg/testutil/nerdtest/requirements.go +++ b/pkg/testutil/nerdtest/requirements.go @@ -120,6 +120,30 @@ var Docker = &test.Requirement{ }, } +// DockerContainerdSnapshotter marks a test as suitable solely for Docker with the containerd +// image store enabled (the default since Docker v29 on fresh installs). +// Generally used as require.Not(nerdtest.DockerContainerdSnapshotter). +var DockerContainerdSnapshotter = &test.Requirement{ + Check: func(data test.Data, helpers test.Helpers) (ret bool, mess string) { + if isTargetNerdish() { + return false, "current target is not docker" + } + stdout := helpers.Capture("info", "--format", "{{ json . }}") + // DriverStatus is not part of dockercompat.Info (nerdctl does not implement it) + var dinf struct { + DriverStatus [][2]string + } + err := json.Unmarshal([]byte(stdout), &dinf) + assert.NilError(helpers.T(), err, "failed to parse docker info") + for _, kv := range dinf.DriverStatus { + if kv[0] == "driver-type" && kv[1] == "io.containerd.snapshotter.v1" { + return true, "docker is using the containerd snapshotter" + } + } + return false, "docker is not using the containerd snapshotter" + }, +} + // NerdctlNeedsFixing marks a test as unsuitable to be run for Nerdctl, because of a specific known issue which // url must be passed as an argument var NerdctlNeedsFixing = func(issueLink string) *test.Requirement { From 12867764aa23d521b6bf6345b825d542cd937803 Mon Sep 17 00:00:00 2001 From: Akihiro Suda Date: Tue, 30 Jun 2026 01:37:27 +0900 Subject: [PATCH 2/2] CI: update Ubuntu (26.04) Signed-off-by: Akihiro Suda --- .../ghcr-image-build-and-publish.yml | 2 +- .github/workflows/release.yml | 2 +- .github/workflows/workflow-flaky.yml | 6 ++-- .github/workflows/workflow-lint.yml | 18 +++++------ .github/workflows/workflow-test.yml | 30 +++++++++---------- .github/workflows/workflow-tigron.yml | 6 ++-- Dockerfile | 4 +-- .../linux/test-integration-env.sh | 12 ++++++++ 8 files changed, 46 insertions(+), 34 deletions(-) diff --git a/.github/workflows/ghcr-image-build-and-publish.yml b/.github/workflows/ghcr-image-build-and-publish.yml index 5b6e6ec2211..936cdccebde 100644 --- a/.github/workflows/ghcr-image-build-and-publish.yml +++ b/.github/workflows/ghcr-image-build-and-publish.yml @@ -24,7 +24,7 @@ env: jobs: build: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 permissions: contents: read packages: write diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 02113c68336..0f69e8230ee 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ env: jobs: release: - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 timeout-minutes: 40 # The maximum access is "read" for PRs from public forked repos # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token diff --git a/.github/workflows/workflow-flaky.yml b/.github/workflows/workflow-flaky.yml index 2bbf64fe5b1..5b18b9ab9c1 100644 --- a/.github/workflows/workflow-flaky.yml +++ b/.github/workflows/workflow-flaky.yml @@ -29,7 +29,7 @@ jobs: target: ["rootful", "rootless"] with: timeout: 60 - runner: ubuntu-24.04 + runner: ubuntu-26.04 guest: ${{ matrix.guest }} target: ${{ matrix.target }} go-version: 1.26 @@ -40,11 +40,11 @@ jobs: uses: ./.github/workflows/job-test-in-lima-freebsd.yml with: timeout: 15 - runner: ubuntu-24.04 + runner: ubuntu-26.04 kube: name: "kubernetes" - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 timeout-minutes: 15 env: ROOTFUL: true diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml index 7933223fcc4..4e0c35b8732 100644 --- a/.github/workflows/workflow-lint.yml +++ b/.github/workflows/workflow-lint.yml @@ -22,25 +22,25 @@ jobs: fail-fast: false matrix: include: - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 goos: linux - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 goos: freebsd - runner: macos-15 goos: darwin # FIXME: this is currently failing in a nonsensical way, so, running on linux instead... # - runner: windows-2022 - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 goos: windows # Additionally lint for canary # FIXME: failing since the release of go1.27rc1 - # - runner: ubuntu-24.04 + # - runner: ubuntu-26.04 # goos: linux # canary: true with: timeout: 10 go-version: "1.26" - runner: ubuntu-24.04 + runner: ubuntu-26.04 # Note: in GitHub yaml world, if `matrix.canary` is undefined, and is passed to `inputs.canary`, the job # will not run. However, if you test it, it will coerce to `false`, hence: canary: ${{ matrix.canary && true || false }} @@ -53,7 +53,7 @@ jobs: with: timeout: 5 go-version: "1.26" - runner: ubuntu-24.04 + runner: ubuntu-26.04 # Lint for shell and yaml files lint-other: @@ -61,7 +61,7 @@ jobs: uses: ./.github/workflows/job-lint-other.yml with: timeout: 5 - runner: ubuntu-24.04 + runner: ubuntu-26.04 # Verify we can actually build on all supported platforms, and a bunch of architectures build-for-go: @@ -79,12 +79,12 @@ jobs: with: timeout: 10 go-version: ${{ matrix.go-version }} - runner: ubuntu-24.04 + runner: ubuntu-26.04 canary: ${{ matrix.canary && true || false }} zizmor: name: "zizmor" - runs-on: ubuntu-24.04 + runs-on: ubuntu-26.04 steps: - name: "Init: checkout" uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 diff --git a/.github/workflows/workflow-test.yml b/.github/workflows/workflow-test.yml index 22f45575dc8..5a6e6b05874 100644 --- a/.github/workflows/workflow-test.yml +++ b/.github/workflows/workflow-test.yml @@ -23,11 +23,11 @@ jobs: # Run on all supported platforms but freebsd # Additionally run on canary for linux include: - - runner: "ubuntu-24.04" + - runner: "ubuntu-26.04" - runner: "macos-15" - runner: "windows-2025" # FIXME: failing since the release of go1.27rc1 - # - runner: "ubuntu-24.04" + # - runner: "ubuntu-26.04" # canary: true with: runner: ${{ matrix.runner }} @@ -48,10 +48,10 @@ jobs: matrix: include: # Build for arm & amd, current containerd - - runner: ubuntu-24.04 - - runner: ubuntu-24.04-arm + - runner: ubuntu-26.04 + - runner: ubuntu-26.04-arm # Additionally build for old containerd on amd - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 containerd-version: v1.7.33 with: runner: ${{ matrix.runner }} @@ -68,14 +68,14 @@ jobs: include: ###### Rootless # amd64 - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 target: rootless # arm64 - - runner: ubuntu-24.04-arm + - runner: ubuntu-26.04-arm target: rootless skip-flaky: true # port-slirp4netns - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 target: rootless-port-slirp4netns skip-flaky: true # old containerd + old ubuntu + old rootlesskit @@ -84,15 +84,15 @@ jobs: containerd-version: v1.7.33 rootlesskit-version: v1.1.1 # gomodjail - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 target: rootless binary: "nerdctl.gomodjail" ###### Rootful # amd64 - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 target: rootful # arm64 - - runner: ubuntu-24.04-arm + - runner: ubuntu-26.04-arm target: rootful skip-flaky: true # old containerd + old ubuntu @@ -100,13 +100,13 @@ jobs: target: rootful containerd-version: v1.7.33 # ipv6 - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 target: rootful ipv6: true skip-flaky: true # all canary # FIXME: failing since the release of go1.27rc1 - # - runner: ubuntu-24.04 + # - runner: ubuntu-26.04 # target: rootful # canary: true @@ -135,7 +135,7 @@ jobs: # - runner: windows-2025 # canary: true # Test docker on linux - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 binary: docker with: timeout: 45 @@ -148,7 +148,7 @@ jobs: no-hyperv: ${{ matrix.canary && true || false }} go-version: 1.26 windows-cni-version: v0.3.1 - docker-version: 5:29.6.1-1~ubuntu.24.04~noble + docker-version: 5:29.6.1-1~ubuntu.26.04~resolute # Windows CI still requires containerd v2.2. # [v2.3.0 regression] The virtual machine or container JSON document is invalid. (Hyper-V container) # https://github.com/containerd/containerd/issues/13254 diff --git a/.github/workflows/workflow-tigron.yml b/.github/workflows/workflow-tigron.yml index 576fe49c2c0..f5b09edbd3a 100644 --- a/.github/workflows/workflow-tigron.yml +++ b/.github/workflows/workflow-tigron.yml @@ -26,13 +26,13 @@ jobs: strategy: matrix: include: - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 - runner: macos-15 - runner: windows-2022 - - runner: ubuntu-24.04 + - runner: ubuntu-26.04 goos: freebsd # FIXME: failing since the release of go1.27rc1 - # - runner: ubuntu-24.04 + # - runner: ubuntu-26.04 # canary: go-canary steps: - name: "Checkout project" diff --git a/Dockerfile b/Dockerfile index 9e9c49c0f03..00ba8160a35 100644 --- a/Dockerfile +++ b/Dockerfile @@ -44,8 +44,8 @@ ARG GOMODJAIL_VERSION=v0.3.2@c145bb1e36fe0939c5fa0467f2477878dea8e3d9 # Test deps # Currently, the Docker Official Images and the test deps are not pinned by the hash ARG GO_VERSION=1.26 -ARG UBUNTU_VERSION=24.04 -ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1 +ARG UBUNTU_VERSION=26.04 +ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.2 ARG NYDUS_VERSION=v2.4.3 ARG SOCI_SNAPSHOTTER_VERSION=0.14.1 ARG KUBO_VERSION=v0.42.0 diff --git a/hack/provisioning/linux/test-integration-env.sh b/hack/provisioning/linux/test-integration-env.sh index 530ffd5e827..586b3836a59 100755 --- a/hack/provisioning/linux/test-integration-env.sh +++ b/hack/provisioning/linux/test-integration-env.sh @@ -155,6 +155,18 @@ host::configuration(){ if [ -e /sys/kernel/security/apparmor/profiles ]; then /usr/local/bin/nerdctl apparmor load fi + + # AppArmor configuration seems needed since Ubuntu 26.04 + if [ -e /etc/apparmor.d/fusermount3 ] && command -v apparmor_parser >/dev/null; then + mkdir -p /etc/apparmor.d/local + cat > /etc/apparmor.d/local/fusermount3 <<-'EOF' + # Allow the soci-snapshotter to mount FUSE filesystems under its root + # (installed by nerdctl's hack/provisioning/linux/test-integration-env.sh) + mount fstype=@{fuse_types} -> /var/lib/soci-snapshotter-grpc/**/, + umount /var/lib/soci-snapshotter-grpc/**/, + EOF + apparmor_parser -r /etc/apparmor.d/fusermount3 + fi } host::services(){