From 8bce0fa45639af65890ceac24a99f554321693d2 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Mon, 17 Aug 2026 13:15:39 +0000 Subject: [PATCH 1/2] ci: disable AppArmor service to prevent VM interference Disable the AppArmor service and add status check after teardown to ensure profiles are fully removed. This prevents AppArmor from interfering with VMs and passt self-sandboxing in CI. Assisted-by: AI Signed-off-by: Alice Frosi --- .github/workflows/ci.yaml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index f05d601..f53a3ee 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -165,11 +165,15 @@ jobs: - name: Configure kernel run: | - # Unload AppArmor profiles — the host-loaded passt profile - # blocks passt's self-sandboxing inside bink node containers. + # Disable AppArmor service and unload all profiles. + # The host-loaded passt profile blocks passt's self-sandboxing + # inside bink node containers. # Must run AFTER installing podman, whose passt dependency # loads the profile during package installation. + sudo systemctl disable --now apparmor 2>/dev/null || true sudo aa-teardown 2>/dev/null || true + echo "AppArmor status after teardown:" + sudo aa-status 2>/dev/null || echo "(aa-status failed)" # Allow unprivileged user namespace creation (needed by passt # inside containers). sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 From a9fa53a6f54ca9ef5ad4c7350cc98cfb1e3126d2 Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Mon, 17 Aug 2026 15:19:35 +0200 Subject: [PATCH 2/2] hack: improve collection of logs Gather together with container logs also the dmesg and journal logs from the host. Signed-off-by: Alice Frosi --- hack/gather-logs.sh | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/hack/gather-logs.sh b/hack/gather-logs.sh index d6ef7cf..a84102d 100755 --- a/hack/gather-logs.sh +++ b/hack/gather-logs.sh @@ -32,6 +32,10 @@ run() { "$@" > "${output_dir}/${filename}" 2>&1 || true } +# Host diagnostics +run "host-journal.txt" journalctl --no-pager +run "host-dmesg.txt" dmesg + # Cluster-wide commands run "k-get-pods.txt" kubectl get pods -n bootc-operator -o wide run "k-describe-pods.txt" kubectl describe pods -n bootc-operator