Repository navigation
bootc-ubuntu-setup: Keep bwrap children in the parent profile - #55
Merged
cgwalters merged 2 commits intoSep 11, 2026
Merged
Conversation
cgwalters-bot
force-pushed
the
fix-bwrap-apparmor-transition
branch
from
September 11, 2026 13:45
5a7a218 to
799a28c
Compare
cgwalters
reviewed
Sep 11, 2026
Ubuntu's unpriv_bwrap transition strips capabilities from package scriptlets running inside otherwise unconfined Podman containers. Install a priority override through the packaged profile's supported local include so nested builds retain the bwrap parent's permissions without disabling AppArmor or changing user-namespace sysctls. The GitHub-hosted runner is disposable, so replace the local bwrap policy directly rather than preserving host configuration. The exception affects all bwrap children on this CI runner, not just a single container. Generated-by: AI Signed-off-by: Colin Walters <walters@verbum.org>
Long shell programs are harder to structure, test, and maintain. Direct agents to use Node.js once scripting grows beyond a small inline snippet. Assisted-by: AI Signed-off-by: Colin Walters <walters@verbum.org>
cgwalters-bot
force-pushed
the
fix-bwrap-apparmor-transition
branch
from
September 11, 2026 14:04
799a28c to
c97023c
Compare
cgwalters
approved these changes
Sep 11, 2026
There was a problem hiding this comment.
🔵 Needs a closer look
The host-wide AppArmor relaxation is security-sensitive and warrants final human review.
Pull request overview
Updates Ubuntu runner setup to preserve bwrap child capabilities under AppArmor, fixing nested bootc builds on Ubuntu 26.04.
Changes:
- Adds and reloads a local AppArmor override.
- Adds an Ubuntu 26.04 integration test.
- Documents the repository’s scripting convention.
File summaries
| File | Description |
|---|---|
bootc-ubuntu-setup/action.yml |
Installs the bwrap AppArmor override. |
.github/workflows/test-actions-pr.yml |
Tests bwrap confinement and ownership operations. |
AGENTS.md |
Adds Node.js and shell scripting guidance. |
Review details
- Files reviewed: 3/3 changed files
- Comments generated: 0
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
daniel-g-carrasco
added a commit
to daniel-g-carrasco/margine-image
that referenced
this pull request
Sep 20, 2026
…ere (#422) On ubuntu-26.04 bootc-image-builder died in org.osbuild.container-deploy with 'mount: /run/osbuild/containers/storage: permission denied', after ten 'fchownat() ... Operation not permitted' lines that the same job on ubuntu-24.04 never prints. Cause: 26.04 ships the bwrap-userns-restrict AppArmor profile, which attaches to /usr/bin/bwrap by path, also inside a privileged podman container, and moves bwrap's children into unpriv_bwrap, a profile without capabilities. osbuild runs every stage under bwrap, so root lost CAP_CHOWN and the right to mount. The override is the one the bootc project installs on its own runners (bootc-dev/actions#55): through the packaged profile's local include, children stay in 'bwrap (enforce)'. AppArmor stays on and the packaged profiles stay loaded; the step is a no-op where the profile is absent. Added to the disk job and to the ISO job (Flatpak's own bwrap use sits in the same trap), and every job of the workflow moves to ubuntu-26.04.
daniel-g-carrasco
added a commit
to daniel-g-carrasco/margine-image
that referenced
this pull request
Sep 21, 2026
The runner bump moved smoke-boot to ubuntu-26.04 and every run since has failed in 'Maximize build space': remove-unwanted-software v9 apt-removes packages the 26.04 image no longer ships (exit 100). With smoke-boot red nothing gets promoted: :stable stays on the build of 2026-09-20 17:27 while :candidate moved on. Same two changes build-disk needed for 26.04: the cleanup action at v10 (deletes toolchain directories instead of apt-removing), and the AppArmor override that keeps bwrap children in the parent profile, or bootc-image-builder loses CAP_CHOWN and the right to mount under osbuild (bootc-dev/actions#55). build-test-stock-kernel.yml gets the v10 bump too, for the same reason.
jmarrero-bot
added a commit
to jmarrero-forge/rpm-ostree
that referenced
this pull request
Nov 6, 2026
On ubuntu-26.04, AppArmor's bwrap-userns-restrict profile attaches to /usr/bin/bwrap even inside our privileged buildroot container, and runs scriptlets without any capabilities, so the compose tests were pinned to ubuntu-24.04. bootc-host-setup fixes that on the host (it keeps bwrap's children in the parent profile, from bootc-dev/actions#55), but a container job starts its container before any step can run. So make them host jobs on ubuntu-26.04 that run the host setup and then start the same privileged fcos-buildroot container themselves. This is also what moving these jobs to a RHEL runner later would need, as those images have no Docker for container jobs. Generated-by: AI
jmarrero-bot
added a commit
to jmarrero-forge/rpm-ostree
that referenced
this pull request
Nov 7, 2026
On ubuntu-26.04, AppArmor's bwrap-userns-restrict profile attaches to /usr/bin/bwrap even inside our privileged buildroot container, and runs scriptlets without any capabilities, so the compose tests were pinned to ubuntu-24.04. bootc-host-setup fixes that on the host (it keeps bwrap's children in the parent profile, from bootc-dev/actions#55), but a container job starts its container before any step can run. So make them host jobs on ubuntu-26.04 that run the host setup and then start the same privileged fcos-buildroot container themselves. This is also what moving these jobs to a RHEL runner later would need, as those images have no Docker for container jobs. Generated-by: AI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ubuntu's
bwrap-userns-restrictpolicy transitions bwrap children intounpriv_bwrap, stripping capabilities from package scriptlets inside otherwiseunconfined Podman containers. This broke nested bootc builds on Ubuntu 26.04.
Install a small priority override through the packaged profile's supported
local include. It changes the child execution rule from
pixtoix, keepingchildren in
bwrap (enforce)while retaining their needed file permissions.AppArmor remains enabled, both packaged profiles remain loaded, and the
user-namespace sysctls are unchanged.
The GitHub-hosted runner is disposable, so the action replaces the local bwrap
policy directly and reloads the packaged profile. The exception affects all
bwrap children on that runner, not just one container.
Validation
profile.
bwrap (enforce)and can perform the ownership operation that previouslyfailed.
The repository agent guidance now also prefers Node.js over shell for
nontrivial scripts; this AppArmor setup remains a small inline shell snippet.
Generated-by: AI
Implementation and tests were AI-generated and independently AI-reviewed. The
commit carries the human-requested DCO signoff.