Run hosted Podman Feature tests rootfully

Retain the Docker-in-Docker Feature workload while avoiding the hosted runner's rootless Podman 5.8 APT sandbox regression.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: chrmarti

src/test/cli.podman.test.ts

@@ -5,7 +5,7 @@
 
 import * as assert from 'assert';
 import * as path from 'path';
-import { mkdir, writeFile } from 'fs/promises';
+import { chmod, writeFile } from 'fs/promises';
 import { shellExec } from './testUtils';
 
 const pkg = require('../../package.json');
@@ -15,79 +15,39 @@ describe('Dev Containers CLI using Podman', function () {
 
 	const tmp = path.relative(process.cwd(), path.join(__dirname, 'tmp'));
 	const cli = `npx --prefix ${tmp} devcontainer`;
-	const podmanBuildOptions = {
-		env: {
-			...process.env,
-			BUILDAH_ISOLATION: 'chroot',
-		},
-	};
+	const podman = process.env.GITHUB_ACTIONS === 'true' ? path.join(process.cwd(), tmp, 'podman-rootful') : 'podman';
 
 	before('Install', async () => {
 		await shellExec(`rm -rf ${tmp}/node_modules`);
 		await shellExec(`mkdir -p ${tmp}`);
 		if (process.env.GITHUB_ACTIONS === 'true') {
-			await shellExec('podman system reset --force');
-			const storageConfig = path.join(process.env.HOME!, '.config', 'containers', 'storage.conf');
-			await mkdir(path.dirname(storageConfig), { recursive: true });
-			await writeFile(storageConfig, [
-				'[storage]',
-				'driver = "overlay"',
-				'[storage.options.overlay]',
-				'ignore_chown_errors = "false"',
-				'',
-			].join('\n'));
-			const containersConfig = path.join(process.env.HOME!, '.config', 'containers', 'containers.conf');
-			await writeFile(containersConfig, [
-				'[engine]',
-				'runtime = "/usr/local/bin/runc"',
-				'',
-			].join('\n'));
-			const { stdout } = await shellExec('podman info --format \'{{json .Store}}\'');
-			console.log(`Podman store after override: ${stdout.trim()}`);
-			const runtime = await shellExec('podman info --format \'{{.Host.OCIRuntime.Path}}\'');
-			console.log(`Podman OCI runtime after override: ${runtime.stdout.trim()}`);
-
-			const image = 'mcr.microsoft.com/devcontainers/typescript-node:1-18-bookworm';
-			await shellExec(`podman pull ${image}`);
-			const tmpInfo = await shellExec(`podman run --rm --user root --entrypoint /usr/bin/stat ${image} -c '%a %u %g' /tmp`);
-			console.log(`Base image /tmp: ${tmpInfo.stdout.trim()}`);
-			await shellExec(`podman run --rm --user _apt --entrypoint /bin/sh ${image} -c 'touch /tmp/devcontainers-apt-write-test && rm /tmp/devcontainers-apt-write-test'`);
-			console.log('Base image _apt write check: succeeded');
-
-			const probeDockerfile = path.join(process.cwd(), tmp, 'PodmanProbe.Dockerfile');
-			await writeFile(probeDockerfile, [
-				`FROM ${image}`,
-				'RUN --mount=type=bind,source=.,target=/tmp/build-context \\',
-				'    stat -c "Build RUN /tmp: %a %u %g" /tmp \\',
-				' && su -s /bin/sh _apt -c "touch /tmp/devcontainers-apt-write-test && rm /tmp/devcontainers-apt-write-test" \\',
-				' && echo "Build RUN _apt write check: succeeded"',
-				'',
-			].join('\n'));
-			const buildProbe = await shellExec(`podman buildx build --no-cache -f ${probeDockerfile} ${path.dirname(probeDockerfile)}`, podmanBuildOptions);
-			console.log(buildProbe.stdout);
-			console.error(buildProbe.stderr);
+			// The hosted runner's rootless Podman 5.8 build fails when APT drops
+			// privileges to _apt, so retain the full Feature coverage rootfully.
+			const podmanExecutable = (await shellExec('command -v podman')).stdout.trim();
+			await writeFile(podman, `#!/bin/sh\nexec sudo -- ${podmanExecutable} "$@"\n`);
+			await chmod(podman, 0o755);
 		}
 		await shellExec(`npm --prefix ${tmp} install devcontainers-cli-${pkg.version}.tgz`);
 	});
 
 	describe('Command up using Podman', () => {
 
 		it('should execute successfully with valid config with features', async () => {
-			const res = await shellExec(`${cli} up --docker-path podman --workspace-folder ${__dirname}/configs/image-with-features`, podmanBuildOptions);
+			const res = await shellExec(`${cli} up --docker-path ${podman} --workspace-folder ${__dirname}/configs/image-with-features`);
 			const response = JSON.parse(res.stdout);
 			assert.equal(response.outcome, 'success');
 			const containerId: string = response.containerId;
 			assert.ok(containerId, 'Container id not found.');
-			await shellExec(`podman rm -f ${containerId}`);
+			await shellExec(`${podman} rm -f ${containerId}`);
 		});
 
 		it('should execute successfully with valid config with features', async () => {
-			const res = await shellExec(`${cli} up --docker-path podman --workspace-folder ${__dirname}/configs/dockerfile-with-features`, podmanBuildOptions);
+			const res = await shellExec(`${cli} up --docker-path ${podman} --workspace-folder ${__dirname}/configs/dockerfile-with-features`);
 			const response = JSON.parse(res.stdout);
 			assert.equal(response.outcome, 'success');
 			const containerId: string = response.containerId;
 			assert.ok(containerId, 'Container id not found.');
-			await shellExec(`podman rm -f ${containerId}`);
+			await shellExec(`${podman} rm -f ${containerId}`);
 		});
 	});
-});
+});