ci: sysctl kernel.apparmor_restrict_unprivileged_userns=0

sorki · sorki · commit 0ee68722593a · 2025-09-03T15:27:53.000+02:00
diff --git a/.github/workflows/ci.dhall b/.github/workflows/ci.dhall
@@ -10,7 +10,14 @@ in    haskellCi.generalCi
               with extraSteps.pre
                    =
                     defSteps.extraSteps.pre
-                  # [ haskellCi.installCachixStep "hnix-store" ]
+                  # [ haskellCi.installCachixStep "hnix-store"
+                    , haskellCi.BuildStep.NameIf
+                        { name = "Allow unprivileged userns"
+                        , run =
+                            "sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0"
+                        , `if` = "matrix.os == 'ubuntu-latest'"
+                        }
+                    ]
             )
         )
         haskellCi.DhallMatrix::{
diff --git a/.github/workflows/ci.dhall.frozen b/.github/workflows/ci.dhall.frozen
@@ -11,7 +11,14 @@ in    haskellCi.generalCi
               with extraSteps.pre
                    =
                     defSteps.extraSteps.pre
-                  # [ haskellCi.installCachixStep "hnix-store" ]
+                  # [ haskellCi.installCachixStep "hnix-store"
+                    , haskellCi.BuildStep.NameIf
+                        { name = "Allow unprivileged userns"
+                        , run =
+                            "sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0"
+                        , `if` = "matrix.os == 'ubuntu-latest'"
+                        }
+                    ]
             )
         )
         haskellCi.DhallMatrix::{
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
@@ -11,6 +11,9 @@ jobs:
       with:
         name: "hnix-store"
         signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
+    - if: "matrix.os == 'ubuntu-latest'"
+      name: Allow unprivileged userns
+      run: sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0
     - uses: "actions/checkout@v4"
       with:
         submodules: recursive

Original file line number	Diff line number	Diff line change
`@@ -10,7 +10,14 @@ in haskellCi.generalCi`
`10`	`10`	`with extraSteps.pre`
`11`	`11`	`=`
`12`	`12`	`defSteps.extraSteps.pre`
`13`		`- # [ haskellCi.installCachixStep "hnix-store" ]`
	`13`	`+ # [ haskellCi.installCachixStep "hnix-store"`
	`14`	`+ , haskellCi.BuildStep.NameIf`
	`15`	`+ { name = "Allow unprivileged userns"`
	`16`	`+ , run =`
	`17`	`+ "sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0"`
	`18`	+ , `if` = "matrix.os == 'ubuntu-latest'"
	`19`	`+ }`
	`20`	`+ ]`
`14`	`21`	`)`
`15`	`22`	`)`
`16`	`23`	`haskellCi.DhallMatrix::{`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,14 @@ in haskellCi.generalCi`
`11`	`11`	`with extraSteps.pre`
`12`	`12`	`=`
`13`	`13`	`defSteps.extraSteps.pre`
`14`		`- # [ haskellCi.installCachixStep "hnix-store" ]`
	`14`	`+ # [ haskellCi.installCachixStep "hnix-store"`
	`15`	`+ , haskellCi.BuildStep.NameIf`
	`16`	`+ { name = "Allow unprivileged userns"`
	`17`	`+ , run =`
	`18`	`+ "sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0"`
	`19`	+ , `if` = "matrix.os == 'ubuntu-latest'"
	`20`	`+ }`
	`21`	`+ ]`
`15`	`22`	`)`
`16`	`23`	`)`
`17`	`24`	`haskellCi.DhallMatrix::{`