240db4e2a7
Some checks failed
Server CI / Postgres (shard 0) (push) Has been skipped
Server CI / Postgres (shard 3) (push) Has been skipped
BuildEnv Docker Image / build-image (push) Failing after 4s
BuildEnv Docker Image / build-image-fips (push) Failing after 4s
Migration Review & Release Notes / Generate migration review & release notes (push) Failing after 3s
Server CI / Build Environment (push) Failing after 3s
Server CI / Postgres (shard 1) (push) Has been skipped
Tools CI / check-style (mattermost-govet) (push) Failing after 4s
Server CI / Postgres (shard 2) (push) Has been skipped
Tools CI / check-style (mmgotool) (push) Failing after 3s
Server CI / Elasticsearch v8 Compatibility (push) Has been skipped
Server CI / OpenSearch v2 Compatibility (push) Has been skipped
Server CI / Postgres FIPS (shard 0) (push) Has been skipped
Tools CI / Test (mattermost-govet) (push) Failing after 3s
Server CI / Postgres FIPS (shard 1) (push) Has been skipped
Server CI / Postgres FIPS (shard 2) (push) Has been skipped
Tools CI / Test (mmgotool) (push) Failing after 3s
Server CI / Postgres FIPS (shard 3) (push) Has been skipped
Server CI / Run mmctl tests (push) Has been skipped
Server CI / Run mmctl tests (FIPS) (push) Has been skipped
Server CI / Merge Postgres Test Results (push) Has been skipped
Server CI / Merge Postgres FIPS Test Results (push) Has been skipped
Server CI / Check backport migrations (push) Has been skipped
Server CI / Check generated files (push) Has been skipped
Server CI / check-style (push) Has been skipped
Server CI / Vet API (push) Has been skipped
Server CI / Build mattermost server app (push) Has been skipped
Server CI / Server CI Complete (push) Failing after 2s
Server CI / Server CI Artifacts (push) Has been skipped
Server CI / Sentry Upload (push) Has been skipped
Server CI / Server CI Report (push) Failing after 5m1s
Server CI Nightly Race / Race Detector (push) Has been skipped
CodeQL / Analyze (go) (push) Has been cancelled
CodeQL / Analyze (javascript) (push) Has been cancelled
Webapp CI Cache Warm / Warm Webapp node_modules Cache (push) Has been cancelled
E2E CI Cache Warm / Warm E2E npm Registry Cache (push) Has been cancelled
API / build (push) Has been cancelled
Web App CI / check-types (push) Has been cancelled
Web App CI / check-lint (push) Has been cancelled
Web App CI / check-i18n (push) Has been cancelled
Web App CI / check-external-links (push) Has been cancelled
Web App CI / test (platform) (push) Has been cancelled
Web App CI / test (mattermost-redux) (push) Has been cancelled
Web App CI / test (channels shard 1/4) (push) Has been cancelled
Web App CI / test (channels shard 2/4) (push) Has been cancelled
Web App CI / test (channels shard 3/4) (push) Has been cancelled
Web App CI / test (channels shard 4/4) (push) Has been cancelled
Web App CI / upload-coverage (push) Has been cancelled
Web App CI / build (push) Has been cancelled
YAML Lint / yamllint (push) Has been cancelled
Push mirrored docker images / cd/Push mirrored docker images (push) Has been cancelled
docs-cd / Build and deploy docs (push) Has been cancelled
Docs CI / build (push) Has been cancelled
E2E Cache Warm: Cypress deps / Warm Cypress deps cache (push) Has been cancelled
Scorecards supply-chain security / Scorecard analysis (push) Has been cancelled
Server CI Weekly / Postgres FIPS (push) Has been skipped
Server CI Weekly / Run mmctl tests (FIPS) (push) Has been skipped
Server CI Weekly / Postgres with binary parameters (push) Has been skipped
Server CI Weekly / Build Environment (push) Failing after 1s
Server CI Cache Warm / Warm Go Module and Build Cache (push) Failing after 2s
Server CI Nightly Race / Build Environment (push) Failing after 1s
45 lines
2.1 KiB
YAML
45 lines
2.1 KiB
YAML
name: Runner prep for openldap
|
|
description: |
|
|
Disable the Ubuntu 24.04 AppArmor user-namespace restriction and ensure
|
|
docker-compose >= 2.36.0 before starting any stack that includes openldap.
|
|
|
|
Background: Ubuntu 24.04 sets kernel.apparmor_restrict_unprivileged_userns=1
|
|
by default. The osixia/openldap:1.4.0 init scripts rely on unprivileged
|
|
user namespaces; blocking them causes an immediate exit(1) with no useful
|
|
stderr ("dependency failed to start: container mmserver-openldap-1 exited (1)").
|
|
The container's own security_opt: apparmor:unconfined is insufficient — it
|
|
only unconfines the slapd process, not the entrypoint. The fix must be at
|
|
the host-kernel level.
|
|
|
|
docker-compose 2.35.1 (shipped on some ubuntu-24.04 runner images) also has
|
|
a known `up` regression that surfaces as spurious dependency-failed errors
|
|
under load. We upgrade to >= 2.36.0 when needed.
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Disable AppArmor user-namespace restriction and ensure docker-compose >= 2.36.0
|
|
shell: bash
|
|
run: |
|
|
echo "Before: docker compose version"
|
|
docker compose version || true
|
|
|
|
# Disable the AppArmor user-namespace restriction. Idempotent;
|
|
# safe if the key doesn't exist (older kernel).
|
|
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
|
|
|
|
# If docker-compose is older than 2.36.0, install a newer one to
|
|
# the user's cli-plugins dir (takes precedence over the system copy).
|
|
CURRENT=$(docker compose version --short 2>/dev/null || echo "0.0.0")
|
|
NEED="2.36.0"
|
|
if [ "$(printf '%s\n' "$NEED" "$CURRENT" | sort -V | head -n1)" != "$NEED" ]; then
|
|
echo "Upgrading docker-compose from ${CURRENT} to 2.39.1"
|
|
mkdir -p "$HOME/.docker/cli-plugins"
|
|
curl -SL -o "$HOME/.docker/cli-plugins/docker-compose" \
|
|
"https://github.com/docker/compose/releases/download/v2.39.1/docker-compose-linux-x86_64"
|
|
chmod +x "$HOME/.docker/cli-plugins/docker-compose"
|
|
fi
|
|
|
|
echo "After: docker compose version"
|
|
docker compose version
|