feat: added ipc_mode task config option

[ritesh-harihar]

Issue

Summary

The Podman driver previously gave tasks no control over their IPC namespace — every container got Podman's default (a private namespace with its own /dev/shm). This makes it impossible for tasks in the same allocation to share IPC primitives / /dev/shm,

What's Chnaged

This PR exposes a new optional ipc_mode task config option that maps directly to Podman's --ipc, bringing the driver to parity with the Docker driver's ipc_mode. It also adds a fail-fast conflict check between ipc_mode and shm_size.

• StartTask translates ipc_mode into createOpts.ContainerStorageConfig.IpcNS (driver.go), mirroring the existing
  network_mode handling (including the container:, ns:, and task: prefix forms via BuildContainerNameForTask).
• Conflict check: shm_size is now rejected with any ipc_mode that does not own the container's /dev/shm (i.e. anything other than private/shareable), matching the Podman API contract.

Example

config {
  ipc_mode = "task:mps-daemon"
} 

Supported values

ipc_mode	Behavior
(unset)	Podman default — private namespace (unchanged)
host	use the host's IPC namespace (insecure)
private	private IPC namespace
shareable	private namespace other containers may join
none	private namespace with no /dev/shm mounted
container:<id>	join another container's IPC namespace
ns:<path>	join the IPC namespace at a path
task:<name>	join another task's IPC namespace in the same alloc (MPS pattern)

Before/After

Scenario	Before	After
ipc_mode in task config	unknown key → task fails to start (Invalid label: No argument or block type is named "ipc_mode")	accepted and applied
Default behavior (no ipc_mode)	private namespace	unchanged — private namespace
Two tasks sharing /dev/shm	not possible	ipc_mode = "task:" → shared
--ipc=host etc.	not configurable	podman inspect ... HostConfig.IpcMode = host
shm_size + ipc_mode=host	n/a	fails fast: shm_size cannot be used with ipc_mode="host"; it requires a private or shareable IPC namespace

Testing

Details

• Job files

1. ipc_share_task.nomad.hcl

job "ipc-share-task" {
  datacenters = ["dc1"]
  type        = "batch"

  group "mps-like" {
    # writer plays the role of the MPS control daemon
    task "writer" {
      driver = "podman"

      lifecycle {
        hook    = "prestart"
        sidecar = true
      }

      config {
        image   = "docker://busybox"
        command = "sh"
        args    = ["-c", "echo SHARED_OK > /dev/shm/marker && sleep 600"]
      }
    }

    # reader plays the role of an MPS client joining the daemon's IPC namespace
    task "reader" {
      driver = "podman"

      config {
        image   = "docker://busybox"
        command = "sh"
        args    = ["-c", "sleep 3; cat /dev/shm/marker 2>/dev/null || echo NOT_SHARED"]

        # the new option under test: join the writer task's IPC namespace
        ipc_mode = "task:writer"
      }
    }
  }
} 

2. ipc_host.nomad.hcl

job "ipc-host" {
  datacenters = ["dc1"]
  type        = "batch"

  group "ipc" {
    task "show-ipc" {
      driver = "podman"

      config {
        image   = "docker://busybox"
        command = "sh"
        args    = ["-c", "echo 'ipc ns:'; ls -l /proc/self/ns/ipc; echo done"]

        # the new option under test
        ipc_mode = "host"
      }
    }
  }
}

3. ipc_conflict.nomad.hcl

job "ipc-conflict" {
  datacenters = ["dc1"]
  type        = "batch"

  group "ipc" {
    reschedule {
      attempts  = 0
      unlimited = false
    }

    task "bad" {
      driver = "podman"

      config {
        image   = "docker://busybox"
        command = "sh"
        args    = ["-c", "echo should-not-start"]

        # invalid combination under test
        ipc_mode = "host"
        shm_size = "64m"
      }
    }
  }
}

• Before flow:

2026-06-15T15:40:28.211+0530 [ERROR] client.alloc_runner.task_runner: running driver failed: alloc_id=d02db3b2-c06a-622f-5cbd-e88aa8903bab task=show-ipc
  error=
  | 2 errors occurred:
  | \t* failed to parse config: 
  | \t* Invalid label: No argument or block type is named "ipc_mode". 

riteshharihar@podman-dev:/Users/riteshharihar/Desktop/Src/nomad-driver-podman$ ALLOC=$(nomad job allocs -json ipc-share-default | jq -r '.[0].ID')
sleep 6
nomad alloc logs -task reader "$ALLOC"
2026-06-15T15:47:30.379517994+05:30 stdout  F NOT_SHARED

• Current Flow:

1. for ipc_share_task.nomad.hcl

riteshharihar@podman-dev:/Users/riteshharihar/Desktop/Src/nomad-driver-podman$ nomad job run examples/jobs/ipc/ipc_share_task.nomad.hcl
ALLOC=$(nomad job allocs -json ipc-share-task | jq -r '.[0].ID')
sleep 6
nomad alloc logs -task reader "$ALLOC"
==> 2026-06-15T15:58:01+05:30: Monitoring evaluation "6614d175"
    2026-06-15T15:58:01+05:30: Evaluation triggered by job "ipc-share-task"
    2026-06-15T15:58:02+05:30: Allocation "32baf8c1" created: node "b3fb2afe", group "mps-like"
    2026-06-15T15:58:02+05:30: Evaluation status changed: "pending" -> "complete"
==> 2026-06-15T15:58:02+05:30: Evaluation "6614d175" finished with status "complete"
2026-06-15T15:58:04.841193225+05:30 stdout F SHARED_OK

2. ipc_host.nomad.hcl

riteshharihar@podman-dev:/Users/riteshharihar/Desktop/Src/nomad-driver-podman$ nomad job run examples/jobs/ipc/ipc_host.nomad.hcl
CID=$(podman ps -a --filter "name=show-ipc" --format '{{.ID}}' | head -1)
podman inspect "$CID" -f '{{.HostConfig.IpcMode}}'
==> 2026-06-15T15:56:19+05:30: Monitoring evaluation "7363bcf6"
    2026-06-15T15:56:19+05:30: Evaluation triggered by job "ipc-host"
    2026-06-15T15:56:20+05:30: Allocation "9ac47692" created: node "b3fb2afe", group "ipc"
    2026-06-15T15:56:20+05:30: Evaluation status changed: "pending" -> "complete"
==> 2026-06-15T15:56:20+05:30: Evaluation "7363bcf6" finished with status "complete"
host

3. ipc_conflict.nomad.hcl

2026-06-15T15:59:29.222+0530 [ERROR] client.alloc_runner.task_runner: running driver failed: alloc_id=98d02c88-5b5a-30c6-ec4b-d2e8fb27ab53 task=bad error="rpc error: code = Unknown desc = shm_size cannot be used with ipc_mode=\"host\"; it requires a private or shareable IPC namespace"

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

[chrisroberts]

Looks good. Left some styling nits in the tests. Replacing the defers with t.Cleanup throughout the tests will make things a little cleaner.

[tehut]

Thanks for getting this knocked out so fast, @ritesh-harihar !