Add a workaround for using mount without privileges, re-enable rootless tests in CI

.github/workflows/ci.yml

@@ -165,20 +165,6 @@ jobs:
         distro: [fedora-current, fedora-prior, debian-sid]
         storage: [vfs, overlay]
         priv: [root, rootless]
-        exclude:
-          - storage: vfs
-            priv: rootless
-          - distro: debian-sid
-            priv: rootless
-          # Skip rootless+overlay: upstream Cirrus's PASSTHROUGH_ENV_RE drops
-          # STORAGE_DRIVER through SSH re-exec to rootlessuser, so their
-          # "Integration rootless ... w/ overlay" task silently tests vfs.
-          # When we propagate STORAGE_DRIVER properly, we expose a real
-          # rootless+overlay cleanup bug in buildah's storage code
-          # ("replacing mount point .../merged: directory not empty").
-          # Skip these cells until that's fixed upstream.
-          - storage: overlay
-            priv: rootless
         include:
           - storage: overlay
             priv: root

Makefile

@@ -60,7 +60,7 @@ export GOLANGCI_LINT_VERSION := 2.12.2
 #           use source debugging tools like delve.
 all: binaries docs
 
-binaries: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial bin/dumpspec bin/passwd bin/crash bin/wait bin/grpcnoop
+binaries: bin/buildah bin/imgtype bin/copy bin/inet bin/tutorial bin/dumpspec bin/passwd bin/crash bin/wait bin/grpcnoop bin/pipeloop
 
 bin/buildah: $(SOURCES) internal/mkcw/embed/entrypoint_amd64.gz
 	$(GO_BUILD) $(BUILDAH_LDFLAGS) $(GO_GCFLAGS) "$(GOGCFLAGS)" -o $@ $(BUILDFLAGS) ./cmd/buildah
@@ -134,6 +134,9 @@ bin/passwd: tests/passwd/passwd.go
 bin/grpcnoop: tests/rpc/noop/noop.go
 	$(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ $(BUILDFLAGS) ./tests/rpc/noop/noop.go
 
+bin/pipeloop: tests/pipeloop/pipeloop.go
+	$(GO_BUILD) $(BUILDAH_LDFLAGS) -o $@ $(BUILDFLAGS) ./tests/pipeloop/pipeloop.go
+
 .PHONY: clean
 clean:
 	$(RM) -r bin tests/testreport/testreport tests/conformance/testdata/mount-targets/true internal/mkcw/embed/entrypoint_arm64 internal/mkcw/embed/entrypoint_ppc64le internal/mkcw/embed/entrypoint_s390x internal/mkcw/embed/entrypoint_arm64.gz internal/mkcw/embed/entrypoint_ppc64le.gz internal/mkcw/embed/entrypoint_s390x.gz internal/mkcw/embed/asm/*.o

cmd/buildah/addcopy.go

@@ -215,8 +215,17 @@ func addAndCopyCmd(c *cobra.Command, args []string, verb string, iopts addCopyRe
 			}()
 		}
 		if err != nil {
-			return fmt.Errorf("reading build container %q: %w", iopts.from, err)
+			return fmt.Errorf("reading --from container %q: %w", iopts.from, err)
 		}
+
+		fromcdir, err := store.ContainerDirectory(from.ContainerID)
+		if err != nil {
+			return fmt.Errorf("finding container state directory for %q: %w", iopts.from, err)
+		}
+		if err := flagServingSFTP(fromcdir); err != nil {
+			return fmt.Errorf(`unable to use "buildah add" or "buildah copy" while container appears to be mounted: %v`, err)
+		}
+
 		fromMountPoint, err := from.Mount(from.MountLabel)
 		if err != nil {
 			return fmt.Errorf("mounting %q container %q: %w", iopts.from, from.Container, err)
@@ -246,6 +255,14 @@ func addAndCopyCmd(c *cobra.Command, args []string, verb string, iopts addCopyRe
 		return fmt.Errorf("reading build container %q: %w", name, err)
 	}
 
+	cdir, err := store.ContainerDirectory(builder.ContainerID)
+	if err != nil {
+		return fmt.Errorf("finding container state directory for %q: %w", name, err)
+	}
+	if err := flagServingSFTP(cdir); err != nil {
+		return fmt.Errorf(`unable to use "buildah add" or "buildah copy" while container appears to be busy: %v`, err)
+	}
+
 	builder.ContentDigester.Restart()
 
 	var timestamp *time.Time

cmd/buildah/main.go

@@ -14,6 +14,7 @@ import (
 	rspecs "github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 	"go.podman.io/buildah"
 	"go.podman.io/buildah/define"
 	"go.podman.io/buildah/pkg/cli"
@@ -140,6 +141,16 @@ func mainInit() {
 	rootCmd.AddGroup(commandGroups...)
 }
 
+func getInheritedFlags(c *cobra.Command) []string {
+	var flags []string
+	c.InheritedFlags().VisitAll(func(f *pflag.Flag) {
+		if f.Changed {
+			flags = append(flags, fmt.Sprintf("--%s=%s", f.Name, f.Value.String()))
+		}
+	})
+	return flags
+}
+
 func initConfig() {
 	// TODO Cobra allows us to do extra stuff here at init
 	// time if we ever want to take advantage.
@@ -162,7 +173,7 @@ func before(cmd *cobra.Command) error {
 	}
 
 	switch cmd.Use {
-	case "", "help", "version", "mount":
+	case "", "help", "version", "mount", mountSshfs, umountSshfs:
 		return nil
 	}
 	debugCapabilities()
@@ -272,6 +283,7 @@ func main() {
 	rmInit()
 	rpcInit()
 	runInit()
+	sftpInit()
 	sourceInit()
 	tagInit()
 	umountInit()

cmd/buildah/mount.go

@@ -89,6 +89,24 @@ func mountCmd(c *cobra.Command, args []string, opts mountOptions) error {
 				lastError = fmt.Errorf("reading build container %q: %w", name, err)
 				continue
 			}
+			container, err := store.Container(builder.ContainerID)
+			if err == nil {
+				dd, err := store.ContainerDirectory(container.ID)
+				if err != nil {
+					if lastError != nil {
+						fmt.Fprintln(os.Stderr, lastError)
+					}
+					lastError = fmt.Errorf("determining data directory for %q container %q: %w", name, builder.Container, err)
+					continue
+				}
+				if err := flagServingSFTP(dd); err != nil {
+					if lastError != nil {
+						fmt.Fprintln(os.Stderr, lastError)
+					}
+					lastError = fmt.Errorf("mounting %q container %q: %w", name, builder.Container, err)
+					continue
+				}
+			}
 			mountPoint, err := builder.Mount(builder.MountLabel)
 			if err != nil {
 				if lastError != nil {

cmd/buildah/run.go

@@ -133,6 +133,14 @@ func runCmd(c *cobra.Command, args []string, iopts runInputOptions) error {
 		return fmt.Errorf("reading build container %q: %w", name, err)
 	}
 
+	cdir, err := store.ContainerDirectory(builder.ContainerID)
+	if err != nil {
+		return fmt.Errorf("finding build container state directory for %q: %w", name, err)
+	}
+	if err := flagServingSFTP(cdir); err != nil {
+		return fmt.Errorf(`unable to use "buildah run" while container appears to be busy: %v`, err)
+	}
+
 	isolation, err := parse.IsolationOption(c.Flag("isolation").Value.String())
 	if err != nil {
 		return err