[MAIN-HEALTH-CI-003] Restore Container Security after Podman/crun runtime incompatibility

[ootakazuhiko]

Parent program: #3655
Blocks implementation start: #3658
Related: #3664
Codex lane: ci/container-security-runtime-recovery-20260730

Background

After PR #3670 merged, Security Analysis run 30523479457 failed in the Container Security job while building the existing podman/Dockerfile on current main (c5da6115638fdbfeebbc458b39fa6916db66afb0).

Source evidence:

• job ID: 90809008864
• runner: ubuntu-24.04 image 20260726.254.1
• Podman: 4.9.3
• failure occurs when the build tries to start the container for Dockerfile step 10;
• error:

error running container: from /usr/bin/crun creating container ...: unknown version specified

• the failing step is the first build-stage RUN command;
• podman/Dockerfile, container workflow, and lockfile were unchanged by PR [ACP-HARDEN-120] Add GitHub authority snapshot and stale-context detection #3670;
• the same Dockerfile had succeeded on an earlier hosted runner image.

This is consistent with a hosted-runtime compatibility regression, but the exact Podman/Buildah/conmon/crun/runc/OCI-spec boundary must be proven before selecting a fix. A rerun alone is not remediation.

Objective

Restore deterministic Container Security execution on GitHub-hosted Ubuntu so that the workflow can:

1. build the repository container image;
2. export the image archive;
3. run Trivy against the archive;
4. produce/upload the SARIF result;
5. fail for real container/image vulnerabilities, not for an incompatible hosted OCI runtime.

Do this without silently skipping the job, weakening the scan, or relying on an unreviewed external package repository.

Preflight

Before creating a branch:

• confirm source run/job and current origin/main;
• confirm Issue [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658 has no branch/PR and remains unstarted;
• inspect .github/workflows/security.yml, .github/actions/detect-container-manifest/action.yml, podman/Dockerfile, podman/Dockerfile.test, container docs/tests, and [ACP-HARDEN-260] GitHub Actions supply-chain policyをfull-SHA基準で強化する #3664 boundaries;
• inspect the successful prior Container Security run and compare runner image/tool versions;
• create a separate clean worktree from current main;
• report Context Pack / Boundary Map conflict before changes.

Recommended branch:

ci/container-security-runtime-recovery-20260730

Required investigation

Capture bounded diagnostic evidence before the build:

• runner image name/version;
• kernel and architecture;
• podman version;
• podman info --debug with secrets/private paths excluded;
• buildah version;
• conmon --version;
• crun --version and path;
• runc --version and path;
• effective OCI runtime selected by Podman;
• relevant /etc/containers/containers.conf runtime configuration;
• podman run --rm minimal smoke result;
• minimal Containerfile build result;
• repository podman/Dockerfile build result.

Compare the failing runner image 20260726.254.1 with a previously successful run. Determine whether the root cause is:

• old/incompatible crun versus the generated OCI runtime-spec version;
• Podman/Buildah/conmon package skew;
• runner image mutation;
• mutable base image behavior;
• repository Dockerfile behavior;
• another proved cause.

Do not claim the cause from the error string alone.

Remediation options and policy

Evaluate in this order:

1. use a compatible runtime already supplied by the GitHub-hosted image, such as an explicitly selected runc, with a verified preflight;
2. install a compatible Podman/runtime tuple only from trusted Ubuntu repositories, with exact package/version evidence;
3. use a reviewed supported build path that preserves the same image and scan semantics;
4. pin mutable container inputs by digest where they affect reproducibility, with a documented update process.

Do not:

• add continue-on-error;
• skip Container Security on push;
• treat missing SARIF as success;
• use || true around build/scan;
• add an untrusted Debian/Ubuntu development repository;
• download unsigned runtime binaries;
• switch to Docker only to hide a Podman failure without documenting semantic differences;
• pin a transient hosted runner image URL as a permanent unsupported dependency;
• change application code or dependencies unrelated to container compatibility;
• broaden [ACP-HARDEN-260] GitHub Actions supply-chain policyをfull-SHA基準で強化する #3664 Actions-supply-chain scope unnecessarily.

If no trustworthy stable runtime path is available, stop with a HUMAN DECISION REQUIRED packet comparing runc selection, compatible package installation, alternative builder, and self-hosted runner options.

Implementation requirements

• one Issue / one branch / one Draft PR;
• add a deterministic container-runtime preflight with bounded, non-secret diagnostics;
• fail closed with stable classifications for missing runtime, incompatible runtime, build failure, archive failure, scan failure, and missing SARIF;
• preserve persist-credentials: false, minimum permissions, and current security-event upload boundary;
• preserve rootless/non-root runtime expectations in the image;
• keep Trivy scan semantics equivalent or stronger;
• add workflow/fixture tests for runtime selection and no-silent-skip behavior;
• retain GitHub authority snapshot capture after Draft PR creation.

Acceptance criteria

• Container Security succeeds on the exact PR head on GitHub-hosted Ubuntu;
• diagnostic evidence identifies the selected runtime and versions;
• minimal runtime smoke, minimal build, repository image build, image export, Trivy scan, and SARIF upload all succeed;
• scan failure or missing SARIF remains non-success under the defined policy;
• the fix is deterministic across at least two independent workflow_dispatch executions on the same exact head;
• repository container tests and production image smoke checks pass;
• no unrelated source/dependency change;
• pnpm -s run build, api:check, check:schemas, check:doc-consistency, and verify:lite pass where applicable;
• actionlint and workflow security assertions pass;
• Full CI succeeds on the exact head, except the separately tracked dependency-security failure from [MAIN-HEALTH-SEC-002] Eliminate current high dependency vulnerabilities and restore enforced security gates #3671 must be classified rather than misreported as this issue's regression;
• final GitHub authority snapshot capture x2 has the same semantic digest and unresolved review threads 0;
• worktree clean.

PR requirements

Draft PR title:

[MAIN-HEALTH-CI-003] Restore Container Security runtime compatibility

PR body must include:

• Implements this Issue and blocks/resumes [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658;
• source run/job URL and exact error;
• previous-success/current-failure toolchain comparison;
• proved root cause;
• selected runtime/build strategy;
• trust and package-source boundary;
• mutable image/digest decision;
• exact-head Container Security run URLs for two independent runs;
• build/export/scan/SARIF evidence;
• compatibility and rollback;
• relationship to [MAIN-HEALTH-SEC-002] Eliminate current high dependency vulnerabilities and restore enforced security gates #3671 and [ACP-HARDEN-260] GitHub Actions supply-chain policyをfull-SHA基準で強化する #3664;
• authority snapshot digest;
• Context Pack conflict status;
• remaining limitations/human decisions.

Stop condition

• existing/new Draft PR;
• base main;
• child-only diff;
• CLEAN / MERGEABLE;
• exact-head Container Security succeeds twice;
• no silent skip or warning-only conversion;
• review threads 0 unresolved;
• final authority capture x2 / no-state-change;
• worktree clean;
• PR not merged, not Ready;
• Issue not closed;
• [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658 and later ACP-HARDEN Issues not started.