Promote aclmain 1d0251d to release/3.0 - #83
Draft
SeanDougherty wants to merge 31 commits into
Draft
SeanDougherty wants to merge 31 commits into
SeanDougherty wants to merge 31 commits into
Conversation
Adds a docs page covering how to enable kdump on ACL, and fixes an inaccurate addon path in the build script comments. - Add `acl/docs/kdump.md` — enable/disable steps, verification, dump collection, and how kdump is wired into the image. - Link the new page from `acl/docs/README.md`. - Fix stale comments in `build_library/rpm/uki_install.sh` that pointed at the non-existent `EFI/Linux/acl.efi.extra.d/`. The ACL UKI is `vmlinuz-<kernel_version>.efi`, so the addon must go in the version-specific `EFI/Linux/vmlinuz-<kver>.efi.extra.d/`. Original-PR: 27971 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-reset (#21) The support-UKI-mode-by-restoring-firstboot-addon patch hardcoded the UKI addon dir as /boot/EFI/Linux/acl.efi.extra.d. ACL UKIs now use UAPI naming (vmlinuz-<version>.efi), so that path never exists - is_uki_mode() always returned false and flatcar-reset silently skipped re-arming the firstboot (Ignition) addon on UKI images. Derive the dir from $(uname -r) so it matches the actual UKI name. All three uses (is_uki_mode, --stop cleanup, restore) reference the variable, so the single change fixes the whole flow. Bump coreos-init.spec Release 3 -> 4. Original-PR: 27985 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Select the QEMU VM boot timeout by architecture instead of a single fixed 180s, fixing flaky arm64 QEMU smoke-test boot failures. Emulated arm64 (TCG) VMs boot far slower than native amd64. Across recent builds the "Qemu VM Boot" smoke test runs ~19-28s on amd64 but clusters near 180-250s on arm64, producing marginal-timeout boot failures at the 180s ceiling. - validate/validate_common.sh: add per-arch defaults VM_BOOT_TIMEOUT_AMD64=100 and VM_BOOT_TIMEOUT_ARM64=300; VM_BOOT_TIMEOUT now defaults to empty and a new resolve_boot_timeout() (called at the top of validate_main) picks the value from BOARD. An explicit VM_BOOT_TIMEOUT env var or --boot-timeout flag still overrides. - build_rpm_image.sh: default left empty; only forwards --boot-timeout to the validate script when explicitly set, keeping validate_common.sh the single source of truth. - Update help/usage docs in the three affected scripts. Original-PR: 27944 Co-authored-by: Jiri Appl <Jiri.Appl@microsoft.com>
…23) Enable acl.kdump and acl.kdump.grub as enforcing kola tests, with bootloader/platform exceptions: acl.kdump requires UKI boot (addon-based crashkernel, so GRUB is excepted), and acl.kdump.grub targets GRUB images only (excepted on UKI and on azure where /oem/grub.cfg does not persist). Also harden the crash kernel config in build_image_util.sh: - dracut_args now exclude "setup-root ignition" so the crash kernel avoids dm-verity /usr mounts that trigger emergency.target on aarch64. - Add KDUMP_COMMANDLINE_APPEND="irqpoll nr_cpus=1 reset_devices" to avoid SMP hang on aarch64 and ensure stable device access post-panic. Original-PR: 27990 Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
… cleaned up (#24) The Azure smoke test provisions a throwaway VM in its own resource group and is meant to delete it when the run ends. That delete was silently a no-op, so RGs leaked. The pipeline passes buildId / adoProject / arch as --tag values, which validate_common.sh parses into RESOURCE_TAGS. It then sources validate_azure.sh, whose top-level `RESOURCE_TAGS=(createdBy=...)` line overwrote that list, so the RG was tagged only createdBy / purpose / creationTime. The per-run cleanup deletes RGs matching buildId && adoProject && arch, matched nothing, and the RG survived. Make the default assignment conditional so it only seeds createdBy when no tags were parsed instead of overwriting. The buildId / adoProject / arch tags now stay on the RG, so the per-run cleanup deletes it immediately. Standalone use (no --tag) still gets the createdBy default. Original-PR: 28041 Co-authored-by: Aadhar Agarwal <aadagarwal@microsoft.com>
Add GitHub templates following the pattern used in microsoft/azurelinux: - PR template with summary, changelog, type of change, test methodology, and merge checklist - Bug report issue template with environment details - Feature request issue template Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
) - Convert bug report and feature request to GitHub issue forms (.yml) with required, structured fields (arch/platform dropdowns, regression, severity) - Fix feature request label: feature-request (nonexistent) -> enhancement - Add config.yml with blank_issues_enabled: false to require picking a template - PR template unchanged Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
#30) Co-authored-by: Mayank Singh <mayansingh@microsoft.com>
#37) mantle PR microsoft/azure-container-linux-mantle#32 adds ExcludeDistros: [acl] to acl.kdump and acl.kdump.grub (AB#22249), so kola no longer selects them on ACL. kola_enforcing.yaml still listed acl.kdump as enforced with only a bootloader: [grub] exception, so on the QEMU/amd64 UKI leg with the 'default' kola filter evaluate_test_results.sh reported it as an enforced test NOT SELECTED and failed the stage. Comment out both entries (with the original exception rules preserved) so they can be restored once the mantle-side ExcludeDistros is dropped. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The pr: trigger only matched aclmain, so PRs targeting release branches (e.g. release/3.0) got no validation build. Add a release/* wildcard to the branch include list. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: b2e9b3a2-6af7-4aec-b523-faac80674783
* rpm: skip build-time-only mercurial, subversion and go-md2man These three are mapped to RPM names in the package catalog but are installed in no image and no sysext - mercurial and subversion are version control clients only ever used at build time, and go-md2man generates man pages during package builds. Confirmed against the packages.txt artefacts of a production build (amd64 and arm64, base image plus every sysext): none of the three appears in any of them. Map them to SKIP so the catalog reflects reality. No functional change to any shipped artefact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611 * rpm: drop ncompress and gflags from the image Both are installed in the production base image today, and neither is used. ncompress provides the legacy .Z compress/uncompress pair. It is a direct RDEPEND of Flatcar's coreos-base/coreos manifest, which is how it reaches the image, but nothing in ACL invokes it. The only reverse dependency in Azure Linux is perl-Archive-Extract-Z-uncompress in the extended repository, which we do not ship. gflags reaches the image only through coreos-base/update_engine, which is already SKIPped in this catalog because ACL does not ship update_engine. Its only Azure Linux reverse dependencies are rocksdb and glog, neither of which is installed. This removes two packages from the base image. Nothing else in the catalog or in acl/ references either name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
The package catalog maps app-admin/ignition and sys-apps/ignition to the RPM name "ignition", but Azure Linux 3 ships no package by that name - only ignition-flatcar. Nothing provides, obsoletes or requires the name "ignition" in any of the base, ms-oss, extended, cloud-native or ms-non-oss repositories. The build still works today only because dnf5 resolves the unmatched spec to the single available ignition-* package. That is incidental behaviour, not something the catalog should depend on: it hides the mistake, and it stops being correct on any release where a package literally named "ignition" exists. Name the RPM explicitly. Verified against a production build: build_image passes the literal string "ignition" to dnf5, and ignition-flatcar-2.22.0-5 is listed under the transaction's top-level "Installing:" section, so the substitution is performed by dnf5 rather than by a dependency or a Provides. No functional change - the same package is installed either way. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: fab45d77-734c-40d0-88ab-1a4d1ac60611
Azure Linux ships xz-compressed RPM payloads, but rpm only advertises the rpmlib(PayloadIsXz) capability when built with the lzma USE flag, which is off by default upstream. Without it, installing those packages fails with a missing-dependency error. Set the flags in the SDK target profile rather than in Dockerfile.sdk-update so they apply both when a fresh SDK image is bootstrapped and when an existing one is updated. Also enable bzip2 for rpmlib(PayloadIsBzip2), and pin caps, which is needed to apply file capabilities from Azure Linux packages. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8d938d41-62cb-43ad-9422-864d07815eb2
* fix: use Azure Linux containerd config for RPM images
Use the containerd2 RPM configuration as the containerd configuration
source in RPM builds, so containerd no longer ignores the intended config.
- Preserve the Flatcar configuration asset for Portage builds.
- Relocate the Azure Linux config from /etc/containerd/config.toml to
/usr/share/containerd/config.toml (only /usr survives sysext capture).
- Enable SELinux in the relocated CRI configuration.
- Keep RPM-specific behavior in a dedicated mangle helper.
Original-PR: 28557
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e
* fix: keep the Azure Linux containerd unit in RPM mode
RPM-mode sysexts were copying the Flatcar containerd files over the ones
installed by the Azure Linux RPM, which replaced the RPM unit and dropped
its OOMScoreAdjust=-999. The previous commit then replaced the Flatcar
config too, so neither the unit-level nor the config-level (oom_score)
OOM protection survived.
Stop copying any Flatcar files in RPM mode and keep the unit and config
shipped by the RPM. The ACL-specific behaviour the Flatcar unit provided
is layered back on as a containerd.service.d/10-acl.conf drop-in:
- point ExecStart at the config relocated under /usr/share, since a
sysext cannot provide /etc/containerd/config.toml, and keep the
CONTAINERD_CONFIG indirection so tests can swap in the cgroupfs
variant via their own drop-in
- Type=notify and RestartSec=5
- the /run/docker/libcontainerd socket symlink docker.service expects
- the resource limits from the upstream unit
The RPM does not run its %post at sysext build time, so the
multi-user.target.wants enablement symlink is created explicitly, and
config-cgroupfs.toml is generated from the relocated config to match
PORTAGE mode.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 19b38196-b3d5-473a-9aea-e1d53bdb495e
Copilot-Session: 67c6760b-2405-49a6-af7c-d9a536a77ac3
) * acl/docs: add guide for preloading container images into ACL images Documents how to bake OCI container images into the containerd content store of an ACL image with the Azure Linux Image Customizer, so they are present on first boot without a registry pull. The primary flow runs the image's own containerd inside the postCustomization chroot to pull and pin the images directly, requiring no host-side containerd, no version matching, and no intermediate tarball. An offline variant that hydrates a data root out of band is documented for air-gapped builds. The guide lists the x64 and Arm64 ACL Marketplace SKUs and links to the Image Customizer documentation for exporting an image version as a VHD. The output is emitted as vhd-fixed so it can be uploaded into a managed disk and published as an Azure Compute Gallery image version, which the guide also covers. It also records the workarounds needed for ACL: a separate build directory to avoid an overlayfs ELOOP, a pinned Image Customizer tag, SSL_CERT_FILE pointing at the trust bundle in /usr, and numeric chown. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: address review feedback on containerd preload guide - Replace fixed sleeps with check-loops when starting and stopping containerd, and fail fast if it exits during startup. - Explain why the chown/chmod on the containerd data root are deliberately non-recursive. - Clarify that ACL's factory passwd lives under /usr/share/distro/etc and is not materialized at /etc until first boot. - Reframe the verification section around cost, and state the concessions the local boot check makes. - Publish to a gallery via a page blob and --os-vhd-uri rather than an intermediate managed disk. - Inline the offline variant's host-side hydration steps and use an inline content: script instead of referring to an unnamed file. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct first-boot claim in containerd preload guide The local boot check does not exercise ACL's provisioning path. The UKI's baked-in command line carries neither ignition.firstboot nor flatcar.oem.id=azure -- both come from UKI addons on the ESP that booting with -kernel/-initrd bypasses -- so the boot takes the subsequent-boot path and no provisioning agent runs. Drop the unsupported claim that surviving images prove /var is not reset during provisioning, and note that forcing the two arguments does not help either: waagent starts but cannot mount the OVF DVD or reach the wireserver, so provisioning still never completes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct local boot check caveat with verified addon behaviour The previous note named the wrong kernel argument. ACL uses Flatcar's flatcar.first_boot=detected, not ignition.firstboot, so the earlier experiment never actually triggered Ignition. Verified against the ESP of a customized image: firstboot.addon.efi and oem.addon.efi are installed in EFI/Linux/<uki>.efi.extra.d/ and inject flatcar.first_boot=detected and flatcar.oem.id=azure respectively. They are intact after customization; -kernel/-initrd simply bypasses systemd-stub, which is what merges them. Driving the real first-boot path locally does not work: Ignition resolves the azure platform and blocks on IMDS, and ignition-fetch.service has no timeout, so the boot hangs in the initrd and never reaches multi-user.target. Document that bypassing the addons is what makes the local check usable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: correct the stale-image cause for rootfs detection failure The MCR :latest tag does point at a current release (1.5.0-2). The failure was a locally cached image -- docker run does not re-pull a tag that is already present. Recommend docker pull, or pinning, rather than blaming the registry. Also note that a fix for the ELOOP mount overlap is in flight upstream. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * acl/docs: use the latest Image Customizer tag instead of pinning The latest tag on MCR points at a current release, so pinning is unnecessary. Add an explicit docker pull, since docker run reuses a cached tag, and note that 1.5.0 is the minimum for ACL support if a pin is wanted for reproducibility. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): read preload image list from a separate file Move the container image references out of preload.sh and into staging/images.txt, one reference per line with support for blank lines and # comments. The Image Customizer bind-mounts the config file's parent directory at /_imageconfigs inside the chroot while scripts run, so the list is read from there directly -- no additionalFiles entry or in-image cleanup is needed. Applied to both the online script and the offline appendix variant. Verified with an Image Customizer run against the ACL production image: both listed images land in the output image's containerd metadata store. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): clarify debug log shows cached images Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> * docs(acl): address review feedback on containerd preload guide - Note that the containerd store is keyed by image reference, so the sandbox (pause) image must match what the runtime requests; ACL ships no sandbox_image setting, so document how to check the effective value. - Use consistent staging/out/ host paths for the artifact throughout. - Create mount points with mkdir -p before mounting. - Run the offline hydration block under a single sudo shell so that $! is containerd's own PID; backgrounding sudo made the shutdown wait hang because sudo kill does not terminate the wrapper. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 * docs(acl): note containerd's default pause image reference Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> * docs(acl): correct sandbox image lookup for containerd 2.x containerd 2.x removed the sandbox_image key under io.containerd.grpc.v1.cri, so the documented grep returned nothing on ACL. The setting is now pinned_images.sandbox under io.containerd.cri.v1.images. ACL does not pin it, so the effective value is containerd's compiled-in default registry.k8s.io/pause:3.10.1 rather than an MCR reference. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5 --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: jiria <18746096+jiria@users.noreply.github.com> Copilot-Session: 8602e313-44cf-4c87-a245-27e7b542e2b5
…g, LUKS initramfs modules (#33) * ado: Readd es-metadata.yml * feat(acl-t): add parallel ACL Template build path * Comments addressed. * Testing verification 0722 * Exempt nfs * 0723 verifications. * Comments addressed. * Correct linux.ntp exemption reason: timesyncd loses via unit Conflicts, not %post The AzL 3.0 chrony.spec %post only runs daemon-reload/systemd_post/start; the actual suppression mechanism is Conflicts=systemd-timesyncd.service in the upstream chronyd.service that AzL packages verbatim. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Document imageVariants matching and selection semantics in the schema header Two non-obvious behaviors now spelled out where contributors copy from: imageVariants values match exactly (unlike the other list keys; 'acl' is a substring of 'acl-t'), and a rule constrained only by imageVariants drops the test from kola selection on that variant rather than just forgiving it at evaluation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Comments addressed. --------- Co-authored-by: Jiri Appl <jiria@microsoft.com> Co-authored-by: Lanze Liu <lanzeliu@microsoft.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Harden ARM64 Azure provisioning validation * Validate repro resource group names * Address Azure provisioning review feedback * Scope Azure VM cleanup to subscription * Skip diagnostics for SKU fallback * fix: validate full Azure gallery image IDs * refactor: narrow Azure provisioning hardening scope
Request TSV output from Azure CLI so serial-console newlines are emitted as real line breaks instead of JSON escape sequences. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(validate): retry transient Azure VM provisioning errors Classify provisioning timeouts, allocation failures, and quota exhaustion as retryable VM creation errors so the SKU/region fallback advances to the next candidate. Keep unrelated Azure failures fatal and add focused classifier coverage. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): isolate Azure VM fallback attempts Provision each retryable candidate in a fresh resource group so failed VM, NIC, disk, deployment, and public-IP resources cannot race the next attempt. Add orchestration coverage for cleanup, exhaustion, region transitions, and sourced-test isolation. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): capture failed Azure VM boot logs Before deleting a retryable failed VM resource group, best-effort enable managed boot diagnostics and print a bounded serial-log tail. Keep diagnostics non-fatal so missing VM resources or unavailable logs cannot block fallback. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): bound Azure provisioning timeouts Track OS provisioning timeouts separately from capacity errors, stop after two distinct Azure SKU families, and preserve accurate mixed-failure reporting. Make failed boot-log capture jq-free and robust to Azure CLI warnings, simplify region setup, and isolate stateful tests. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> * fix(validate): refine Azure VM fallback retries * fix(validate): preserve create-time boot diagnostics * fix(validate): parse diagnostics storage hash * fix(validate): harden Azure fallback cleanup * refactor(validate): simplify Azure fallback flow Consolidate boot diagnostics on the create-time storage path, split fallback state handling into focused helpers, and document the regression test suite. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): scope exhausted fallback cleanup Target asynchronous resource-group deletion to AZ_SUB_ID and clean the final reused resource group when all VM candidates are exhausted. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): preserve cleanup diagnostics Capture and log Azure CLI stderr when resource-group cleanup scheduling fails so authorization and subscription errors remain actionable. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): address fallback review feedback Restore direct VM creation calls and explicit result state, preserve no-cleanup fallback behavior, skip timed-out SKU families immediately, harden boot diagnostics SAS handling, and avoid cleanup of uncreated resource groups. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(validate): scope Azure VM resources Pass AZ_SUB_ID explicitly when creating the VM resource group, public IP, and boot diagnostics storage account so provisioning and cleanup use the same subscription. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…t SBOMs (#51) * fix(rpm): emit NEVRA and drop gpg-pubkey from the image package list * fix(rpm): route build_sysext package lists through rpm_query_packages * fix comment drift * address review comments - rpm_query_manifest: wrap RPM_MANIFEST_QUERY_FORMAT in the same %|ARCH?{...}:{}| guard used by rpm_query_packages, so gpg-pubkey no longer reaches the SPDX SBOM as a package with (none) for VENDOR, EPOCH, ARCH and SOURCERPM. Both producers now apply one rule for what counts as a package. - build_sysext cleanup(): also remove .rpm-base.tmp and .rpm-all.tmp. cleanup runs at L168 before either snapshot is taken, so a stale NVRA-format base left behind by a crashed run can no longer be diffed against a NEVRA-format .rpm-all.tmp and report every epoch-bearing package as sysext-added. - rpm_query_packages: replace the hedge in the comment with rpm's own test. Pubkey headers carry no ARCH tag, and rpm rejects a gpg-pubkey entry that does have one (lib/keystore.cc). Also drop the needless line continuation.
Add an opt-in container_logreader_t domain for log collectors that need read-only access to host and audit logs without using spc_t. Keep container_t as the default and deny log mutation permissions. Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#53) * fix(sdk): return a single version tag when a commit has multiple tags `get_git_version()` used the raw output of `git tag --points-at HEAD`, which prints one line per tag. Two ACL releases were cut from the same `aclmain` commit (3.0.20260706-3.0-1153684 and 3.0.20260809-3.0-1179296), so the OS version became a two-line string. That multi-line value flowed into `create_versionfile` and into the container name derived by `run_sdk_container`, producing: Error response from daemon: Invalid container name (flatcar-sdk-all-4459.0.0_os-3.0.20260706-3.0-1153684 3.0.20260809-3.0-1179296), only [a-zA-Z0-9][a-zA-Z0-9_.-] are allowed which failed "Build ACL Base Image" on every RPM image leg (amd64 and aarch64, Azure and QEMU). Pick the highest version tag deterministically with `sort -V | tail -n 1`, and clamp `git describe` to one line. Also clamp `vernum_from_version` and `build_id_from_version`, whose `sed -n ...p` emits one line per match, so no caller-supplied version can reintroduce a multi-line container name. Single-tag behaviour is unchanged. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(sdk): select the version tag without a pipeline Review feedback: `git describe --tags | head -n 1` made the fallback branch always exit 0, so a `git describe` failure (rc 128) would no longer abort callers such as `run_sdk_container`, which runs under `set -e` and does a plain `os_version=$(get_git_version)` assignment. Use `git for-each-ref --count=1 --sort=-v:refname` to pick the highest tag directly, and leave `git describe --tags` unpiped so its exit status still propagates. `git describe` only ever prints one line, so the `head -n 1` clamp was unnecessary. Verified `for-each-ref` returns the same tag as `sort -V | tail -n 1` for the real failing tag pair (3.0.20260706-3.0-1153684 and 3.0.20260809-3.0-1179296), that single-tag and untagged-HEAD behaviour is unchanged, and that a git failure now yields rc 128 again. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add read-only systemd journal mmap support, retain canonical container-selinux audit-log semantics, document safe mounts and MCS behavior, and clarify enforcing-by-default configuration. Tracks automated validation in AB#23492.
Add a customer-facing reference for ACL container workload domains, privilege boundaries, CRI and MCS requirements, journal DAC, audit behavior, and troubleshooting guidance. Includes the reviewed follow-ups previously tracked in #63.\n\nAB#23415
Signed-off-by: Sean Dougherty <sdougherty@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Dan Fiedler <danfiedler@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
16 tasks
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promote
aclmainthrough commit1d0251dtorelease/3.0.This brings the accumulated image-build, validation, packaging, SELinux, and documentation changes from
aclmaininto the release branch. The PR is draft while a targeted replay of two extension-advisory differences completes.Change Log
Type of Change
Does this affect the image build?
Test Methodology
Validation compared this candidate with a contemporaneous
release/3.0build from commitc915c68. Full test selection includes enforcing, non-enforcing, and context-exempt tests.Image and Kola validation
Across 529 common Kola identities, 497 passed on both, 28 failed on both, four passed only on the candidate, and none failed only on the candidate.
Kubernetes validation
Advisory validation
The PR remains draft until the targeted advisory replay completes and the two differing extension checks are classified.
Merge Checklist