ci: lxc-trixie.yml, trixie in an unprivileged system container #17

Merged

marcos-mendez merged 3 commits from ci/lxc-trixie into main

2026-10-01 02:38:39 -03:00

marcos-mendez commented

2026-10-01 01:33:35 -03:00

(Migrated from github.com)

Adds the reusable workflow lxc-trixie.yml. It runs a repository's commands as root in a Debian trixie system container: an unprivileged LXC container with its own systemd, created from the download template on keel-lxc-1 by the runner user, with no sudo. It replaces every container: debian:trixie job in the organization (keel-core, common, anubis, libnginx-mod-http-coraza, coreruleset, libcoraza). Those PRs call it at @ci/lxc-trixie until this merges, then switch to @main.

Inputs: run or script, systemd, backports, fetch-depth, download/download-dir, artifact-dir/artifact-name, timeout.
Start and attach go through systemd-run --user --scope, as bin/unprivileged-lxc does. The leftover tree is removed with unprivileged-lxc cleanup.
Fork pull requests and pull_request_target never reach the runner. The job is skipped for them.
Retires build-deb.yml, which had no callers and needed sudo apt-get.
New check name for callers: <caller job> / trixie. No required check in the organization uses these jobs.

Test plan

actionlint 1.7.7 clean locally
callers' PRs green on the new job (exercised from anubis first)

Adds the reusable workflow `lxc-trixie.yml`. It runs a repository's commands as root in a Debian trixie system container: an unprivileged LXC container with its own systemd, created from the download template on keel-lxc-1 by the runner user, with no sudo. It replaces every `container: debian:trixie` job in the organization (keel-core, common, anubis, libnginx-mod-http-coraza, coreruleset, libcoraza). Those PRs call it at `@ci/lxc-trixie` until this merges, then switch to `@main`. - Inputs: `run` or `script`, `systemd`, `backports`, `fetch-depth`, `download`/`download-dir`, `artifact-dir`/`artifact-name`, `timeout`. - Start and attach go through `systemd-run --user --scope`, as `bin/unprivileged-lxc` does. The leftover tree is removed with `unprivileged-lxc cleanup`. - Fork pull requests and `pull_request_target` never reach the runner. The job is skipped for them. - Retires `build-deb.yml`, which had no callers and needed `sudo apt-get`. - New check name for callers: `<caller job> / trixie`. No required check in the organization uses these jobs. Test plan - [x] actionlint 1.7.7 clean locally - [ ] callers' PRs green on the new job (exercised from anubis first)