Internal Change

pkg/test/dockerutil/dockerutil.go

@@ -142,6 +142,13 @@ func IsRestoreSupported() bool {
 	return major <= 27
 }
 
+// IsAnnotationsSupported returns true if the docker version supports annotations.
+// Docker annotations were introduced in API v1.44 (Docker v25.0).
+func IsAnnotationsSupported() bool {
+	major, _ := getDockerVersion()
+	return major >= 25
+}
+
 // RuntimePath returns the binary path for the current runtime.
 func RuntimePath() (string, error) {
 	rs, err := runtimeMap()

test/e2e/integration_test.go

@@ -110,6 +110,9 @@ func TestLifeCycle(t *testing.T) {
 }
 
 func TestDisallowRootfsTarAnnotation(t *testing.T) {
+	if !dockerutil.IsAnnotationsSupported() {
+		t.Skip("Docker version does not support annotations (< 25.0).")
+	}
 	ctx := context.Background()
 	d := dockerutil.MakeContainer(ctx, t)
 	defer d.CleanUp(ctx)

test/syscalls/linux/landlock.cc

@@ -1042,6 +1042,7 @@ TEST(LandlockTest, AddNetPortRuleWithoutHandledNetFails) {
 // non-tty normally fails with ENOTTY; under a ruleset that handles IOCTL_DEV
 // but does not grant it on the device, the ioctl is rejected earlier with
 // EACCES instead.
+// TODO(aaltinay): delete this line.
 TEST(LandlockTest, IoctlDevDeniedWithoutRule) {
   SKIP_IF(IsRunningOnGvisor());
   SKIP_IF(LandlockAbiVersion() < 5);