[sstriker]

On GitHub's Linux runner, the confined launch tests did not run. They passed only because they returned early. This PR makes them run, and makes them fail on CI when they cannot run.

The problem

Ubuntu's AppArmor lets an unprivileged process create a user namespace, but not map its uid in it. So on ubuntu-latest, namespaces_available() in crates/memory/tests/launch.rs returned false. Four confined launch tests printed "skipping" and passed. libtest reports such a test as ok, so no CI run showed it. No CI job ran our Linux backend.

The change

• Commit 1 (4e28991): a confined launch test or a live mount test now fails when the CI variable is set and it cannot run. Elsewhere it prints that it skipped, as before. The ledger tests already do the same for PostgreSQL.
• Commit 2 (d1faf0e): the check (linux) and coverage jobs set kernel.apparmor_restrict_unprivileged_userns=0 before the tests, as the harness spikes workflow does.
• Commit 3: comment corrections.

Evidence

• CI on commit 1 (run 40103433889): both Linux jobs failed. The cause was four confined launch tests, each with "unprivileged namespaces are not available, and on CI the confined tests must run":

  • confined_launch_has_no_network_and_no_host_home
  • a_file_read_inside_the_sandbox_is_a_get_the_memory_serves
  • a_session_s_projection_holds_its_own_render_and_nothing_another_left
  • a_launch_that_fails_after_rendering_leaves_no_render_behind

  So these tests were skipped on every earlier CI run.

• CI on commit 2 (run 40104400462): all checks passed. The confined tests ran, and so did the projection test, as a live mount, in both jobs.

• Coverage rose from 91.63% to 91.86% of the same 41481 lines.

• make check locally: 620 tests, 620 passed.

The live mount tests (crates/mount/tests/live.rs) already ran on CI: FUSE is available there, and the sysctl does not affect it. Their change is only a guard for later.

Adversarial pass

A fresh agent attacked d1faf0e. It found nothing broken. It made each new assertion fail by removing what the test needs: unshare exited 1, and fusermount was not on PATH. Its other findings:

• The comment in ci.yml was not accurate. Fixed in commit 3.
• Merge order. The new confined tests on fix: fail the launch when the egress socket cannot be bound #16 and fix: report a death by signal as 128 plus its number, and name it #17 have not run on CI yet: they skipped. Merge this PR first. Then fix: fail the launch when the egress socket cannot be bound #16 and fix: report a death by signal as 128 plus its number, and name it #17 must merge main and run CI again before they merge.
• The new sandbox tests on fix: refuse vsock and io_uring in the Linux sandbox #14 and fix: make read-only grants read-only below their submounts #15 use another skip (dm_sandbox::linux::availability()) with no CI check. Those branches get the same check in a commit of their own.
• Any value of CI, CI=false included, counts as CI. The ledger tests do the same. I kept it.
• The probe runs unshare, not amem. So a laptop with the amem AppArmor profile and the restriction on skips the tests, although amem would confine. This was already so before this PR, and a separate issue can track it.

Posted by Claude on behalf of @sstriker

[Copilot]

🟢 Approval recommended

The change is a small, well-reasoned test-and-CI adjustment that mirrors the established ledger CI-gating pattern, is backed by CI run evidence, and introduces no objective issues.

No open issues 🎉

What changed in this PR

This PR makes the Linux confined-launch and live-mount tests actually run on GitHub's CI instead of silently skipping. On ubuntu-latest, AppArmor blocks unprivileged uid mapping in a user namespace, so namespaces_available() returned false and four confined tests returned early and were reported as ok, meaning the Linux sandbox backend was never exercised in CI. The change turns a skip into a hard failure when the CI variable is set, and lowers the AppArmor sysctl in CI so the tests can run. This mirrors the existing pattern used by the ledger's PostgreSQL tests (crates/ledger/src/testing.rs), keeping test behavior consistent across the workspace.

Changes:

• Test helpers now assert (fail) when the capability is missing and CI is set, while still skipping with a message locally: fuse_available() in live.rs, namespaces_available() and the projection live-mount check in launch.rs.
• CI check (linux) and coverage jobs run sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 before the tests.
• Comment corrections in the touched files.

File	Description
crates/​mount/​tests/​live.rs	Adds fuse_available() which skips locally but fails on CI when FUSE is missing; both live tests now call it.
crates/​memory/​tests/​launch.rs	namespaces_available() asserts on CI when namespaces are unavailable; the projection test fails on CI if it falls back to a render instead of a live mount.
.github/​workflows/​ci.yml	Lowers the AppArmor unprivileged-userns restriction in the check and coverage jobs so confined tests run.

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

The change is a small, well-evidenced test and CI-config adjustment that follows the existing ledger skip-or-fail-on-CI convention, touches no production code, and contains no identified defects.

No open issues 🎉

_{Review effort: Balanced}