Add vfs/chroot build test to aio container

.cirrus.yml

@@ -6,7 +6,7 @@ env:
     CIRRUS_SHELL: "/bin/bash"
     # No need to go crazy, but grab enough to cover most PRs
     CIRRUS_CLONE_DEPTH: 10
-    IMAGE_SUFFIX: "c20240529t141726z-f40f39d13"
+    IMAGE_SUFFIX: "c20250324t111922z-f41f40d13"
 
 gcp_credentials: ENCRYPTED[88b219cf6b4f2d70c4ff7f8c6c3186396102e14a27b47b985e40a0a0bc5337a270f9eee195b36ff6b3e2f07558998a95]
 
@@ -135,7 +135,7 @@ test_aio_image_build_task:
     image_export_artifacts:
         path: ./${EXPORT_FILENAME}.tar
         type: application/octet-stream
-    test_script: ./aio/test.sh
+    test_script: &aio_test ./aio/test.sh
 
 cron_aio_build_task:
     alias: cron_aio_build
@@ -146,6 +146,7 @@ cron_aio_build_task:
         CONTAINERS_USERNAME: *cntu
         CONTAINERS_PASSWORD: *cntp
     build_script: *aio_script
+    test_script: *aio_test
 
 # This task is critical.  It updates the "last-used by" timestamp stored
 # in metadata for all VM images.  This mechanism functions in tandem with

aio/test.sh

@@ -63,11 +63,26 @@ trap "podman unshare rm -rf '$TMPD'" EXIT
 msg "Loading test image"
 showrun podman load -i $HOME/$FQIN_FILE
 
-# These tests come directly from the aio/README.md examples
+
 mkdir $TMPD/cntr_storage
 mkdir $TMPD/context
+
 echo -e 'FROM registry.fedoraproject.org/fedora-minimal:latest\nENV TESTING=true' > $TMPD/context/Containerfile
+# Contents printed on build, mask test string 'Fo0b@r' for rwmount build test
+cat << EOF > $TMPD/context/Containerfile.rwmount
+FROM registry.fedoraproject.org/fedora-minimal:latest as base
+RUN mkdir -p /var/tmp/test
+ADD ./Containerfile /var/tmp/test/
+
+FROM base as final
+RUN --mount=type=bind,from=base,src=/var/tmp/test,dst=/var/tmp/test,rw \
+    set -x && \
+    echo -e '\x46\x6f\x30\x62\x40\x72' > /var/tmp/test/Containerfile && \
+    cat /var/tmp/test/Containerfile
+EOF
+
 for tool in buildah podman; do
+    # The next two tests come directly from the aio/README.md examples
     msg "Verify $tool can create a simple image as root inside $FQIN"
     showrun podman unshare rm -rf $TMPD/cntr_storage/* $TMPD/cntr_storage/.??*
     showrun podman run -i --rm --net=host --security-opt label=disable --privileged \
@@ -84,4 +99,13 @@ for tool in buildah podman; do
         -v $TMPD/cntr_storage:/home/user/.local/share/containers:Z \
         -v $TMPD/context:/home/user/context:Z \
         $FQIN $tool build -t rootless_testimage /home/user/context
+
+    # Verify problematic rwmount build functions
+    # This type of build is frequently done w/in CI systems
+    msg "Verify $tool can perform a vfs/chroot build inside $FQIN"
+    showrun podman run -i --rm \
+        -v $TMPD/context:/root/context:Z \
+        $FQIN $tool --storage-driver=vfs build --isolation=chroot -t rwmount_testimage -f Containerfile.rwmount /root/context \
+        | tee $TMPD/rwmount.output
+    showrun grep -Fqx 'Fo0b@r' $TMPD/rwmount.output
 done