Keep hosted Podman Feature tests rootless

[Christof Marti (chrmarti)]

Summary

Keep the existing Podman Feature integration tests rootless on GitHub-hosted runners while working around an upstream layered-build regression.

Session Context

Key decisions from the development session:

• Independent test fix: This PR targets main and changes only the Podman integration test.
• Preserve coverage: The original image- and Dockerfile-based tests continue installing the Docker-in-Docker and hello Features with the runner's current Podman 5.8.4.
• Confirmed upstream regression: Podman 5.8.4 / Buildah 1.43.2 changes /tmp from 1777 to 0755 when committing a layered RUN --mount; the next Feature's APT sandbox then cannot create /tmp/apt.conf.*. This is tracked by Permissions of /tmp are set to 755 after a bind mount is placed under /tmp under specific conditions podman-container-tools/buildah#6503 and fixed by the still-unmerged Preserve dir mode and ownership in RUN --mount podman-container-tools/buildah#6981.
• Rootless coverage retained: The earlier rootful wrapper passed CI but removed meaningful rootless coverage, so it was replaced.
• Narrow workaround: GitHub Actions sets BUILDAH_LAYERS=false only for the CLI invocation. Local test behavior is unchanged. This avoids the upstream faulty layer-diff path without changing Feature workloads or production code.
• Rejected alternatives: ignore_chown_errors=false, native overlay, and pre-creating mount parents do not prevent the corruption. VFS works but made one Feature build take 4m33s, exceeding the test timeout. Relocating mount targets or adding marker files changes generated image behavior and risks unrelated metadata effects.

Changes

• Set BUILDAH_LAYERS=false for CLI invocations on GitHub Actions.
• Remove the temporary sudo podman wrapper.
• Leave local Podman behavior and the original Feature workloads unchanged.

Validation

• Reproduced the CI failure locally with Docker-hosted rootless Podman 5.8.4 / Buildah 1.43.2.
• Confirmed /tmp changes from 1777 to 0755 immediately after the layered RUN --mount Feature step.
• Confirmed Podman 4.9.3 preserves 1777 and succeeds.
• Confirmed BUILDAH_LAYERS=false preserves 1777 and the full Feature build succeeds in 30 seconds.
• Targeted ESLint and git diff --check pass.

[Copilot]

Pull request overview

This PR restores rootless Podman feature-test reliability on GitHub-hosted runners by overriding a runner-image Podman storage option (overlay.ignore_chown_errors) that breaks APT’s _apt user during feature builds.

Changes:

• Reset the rootless Podman system state on GitHub Actions to start from a clean store.
• Write a minimal user-level storage.conf to set the overlay driver and disable ignore_chown_errors.
• Assert the effective Podman storage option via podman info before running the packaged CLI tests.

Show a summary per file

File	Description
src/test/cli.podman.test.ts	Adds GitHub Actions–specific rootless Podman storage reset + minimal storage.conf override, with a verification assertion before running the Podman feature tests.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Lite