GlcoinCore/elements
1
0
Fork 0
mirror of https://github.com/ElementsProject/elements.git synced 2026-08-20 13:37:28 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

ci: unconfine seccomp for i686 no IPC

Browse source 
Docker 29.4.2 blocks `socketcall(2)` in the default seccomp profile:
https://docs.docker.com/engine/release-notes/29/#2942
https://github.com/moby/profiles/releases/tag/seccomp%2Fv0.2.2
https://github.com/moby/moby/pull/52501

That affects the `i686, no IPC` job because it runs 32-bit Linux test binaries inside Docker.

Add Docker's documented `--security-opt seccomp=unconfined` workaround to this job's `CI_CONTAINER_CAP` - the hook `ci/test/02_run_container.py` already appends to `docker run`.

This restores socket availability for the 32-bit test binaries throughout the job:
https://docs.docker.com/engine/security/seccomp/#run-without-the-default-seccomp-profile

Github-Pull: #35202
Rebased-From: 11c9ef92a8daf030f75f88f324396b2248c65a64
This commit is contained in:
Lőrinc 2026-05-03 15:36:47 +02:00 • committed by fanquake
parent 546598b736
commit 18739ec488
No known key found for this signature in database
GPG key ID: 2EEB9F5CC09526C1
1 changed files with 1 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
ci/test/00_setup_env_i686_multiprocess.sh
View file

@ -10,6 +10,7 @@ export HOST=i686-pc-linux-gnu
export CONTAINER_NAME=ci_i686_multiprocess
export CI_IMAGE_NAME_TAG="mirror.gcr.io/ubuntu:24.04"
export CI_IMAGE_PLATFORM="linux/amd64"
export CI_CONTAINER_CAP="--security-opt seccomp=unconfined"
export PACKAGES="llvm clang g++-multilib"
export DEP_OPTS="DEBUG=1 MULTIPROCESS=1"
export GOAL="install"