kevinveenbirkenbachandClaude Opus 5.5 330b85f9e7 fix(apparmor): lift the unprivileged-unconfined restriction in teardown ...

On runner image 20261101 kernel.apparmor_restrict_unprivileged_unconfined
is on, so the kernel turns runc's change_onexec into the stack
docker-default//&unconfined. docker-default grants no signal to an
unconfined peer, and every in-container kill() is denied; run 41743807934
lost four package builds that way (journal: apparmor="DENIED"
operation="signal" comm="rsync" signal=usr2).

teardown.sh now writes 0 to the sysctl and records the value it found
under /run/infinito; restore.sh writes that value back and drops the
record. A missing sysctl or one already at 0 is left alone, and a second
teardown keeps the first record. CI runs teardown before every deploy,
workspace and dns job; dev hosts through make environment-bootstrap.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-04 17:35:08 +01:00

..

apparmor

fix(apparmor): lift the unprivileged-unconfined restriction in teardown

2026-11-04 17:35:08 +01:00

worktree

…

__init__.py

…