New Project: systemd

[keszybz]

Please describe the project
systemd is a suite of basic building blocks for a Linux system. It provides a system and service manager that runs as PID 1 and starts the rest of the system.

URL for the project
systemd.io

Describe current CI/CD setup
We use a mix: github actions, builds in downstream distro infrastructure (copr for Fedora, ubuntu autopkgtest for the debian family, OBS for opensuse). See systemd/systemd#37499 as an example issue with a bunch of CI runs.

We have our own associated project mkosi.systemd.io to build images from distro packages. This allows us build on many different distributions and architectures.

Describe the primary use case for the Github Action Runner

We want to test our code on as many architectures as possible. We already run s390x and ppc63le code via Ubuntu autopkgtests and Fedora copr, but additional environemnts are welcome, because they uncover different failure modes.

Being able to run VMs with our own is very beneficial for testing.

Paste a link to the existing actions workflow file(s) or directory

https://github.com/systemd/systemd/tree/main/.github/workflows

How often do you plan on executing the runner?

On every pull request update and on every merge to the main branch.

What is the primary programming language for the project?

C.

Please select desired hardware

• Power 9 (ppc64le)
• IBM Z / LinuxONE (s390x)

Account names of the GitHub repo admins that will need access to setting up the runner

keszybz, bluca, mrc0mmand, DaanDeMeyer

[mtarsel]

Thank you for your interest in our GitHub Actions runner, and welcome! We’re currently in the early on-boarding phase for projects. As we ramp up this service, we are working our way through evaluating frequency of runs you’ve proposed, workflow files, and supported actions to confirm your project will have a positive experience. We’ll be in touch as soon as we’re ready to take the next steps - thanks for your patience.

[mtarsel]

Being able to run VMs with our own is very beneficial for testing.

These would be ephemeral containers running in ibm cloud if that works for you? We do not provide any projects access to our infrastructure.

[bluca]

Yes, that should be ok, as long as we can run nested containers or VMs ourselves in the runner

[mtarsel]

I don't think you will be able to run a VM inside our container but you should be able to run a container inside of it. Can you confirm my assumption is correct @anup-kodlekere ? Our containers are already inside of a VM in ibmcloud so it would look like our VM --> the ubuntu-24.04-ppc64le runner container --> your container from workload

[bluca]

Yeah that would work fine for our test suite, thanks

[mtarsel]

You are now welcome to use the Power architecture images for your project.

Please install the GitHub App from the following link and select your repository:
🔗 Power Z GHA Runner App

Note: Once the GitHub App is installed on your account, only the selected repositories will be approved.

For more details on the onboarding process, please refer to our documentation:
📄 Onboarding Guide

Please let me know in this issue once you have installed the github app on your repo. For security reasons, I will double check it is the correct repo and then approve the repo to use our images. You will not be able to use our images until I approve the repo.

After the repo has been approved, you will be able to use the ubuntu-24.04-ppc64le image in the workflow file and all good to go :) The onboarding doc linked above will be helpful.

If there is any questions or concerns, we can discuss those here.

[bluca]

Note: Once the GitHub App is installed on your account, only the selected repositories will be approved.

Done, installed for systemd/systemd and systemd/mkosi

[mtarsel]

ok those 2 repos are approved! Thank you! If you have any more questions please comment here :) I'll keep this issue open for a week or so to make sure you are all set before I close it

[bluca]

That's great, thank you very much, I'll give it a spin right now

[bluca]

I don't think you will be able to run a VM inside our container but you should be able to run a container inside of it. Can you confirm my assumption is correct @anup-kodlekere ? Our containers are already inside of a VM in ibmcloud so it would look like our VM --> the ubuntu-24.04-ppc64le runner container --> your container from workload

Hi, I'm having difficulties running nested containers - can't mount filesystems or images. Is there a detailed description somewhere of what is available in the image and what permissions runners have? Thanks!

[anup-kodlekere]

Hey @bluca thanks for reaching out! Could you share some more details about what exactly is failing? Perhaps a job / workflow link will help.

[bluca]

@anup-kodlekere when running nspawn, it fails with permission denied when it tries to set up a new mount namespace with procfs:

‣ + systemd-nspawn --quiet --link-journal=no --resolv-conf=auto --boot --machine main --set-credential=firstboot.locale:C.UTF-8 --set-credential=firstboot.timezone:Etc/UTC '--set-credential=ssh.authorized_keys.root:ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC69ph1aVvpaAsVKYJs2dlnkv9BC7XZS/0Uls9S02J/qhdeUbn9nA7lSInDapZVG/oPu5bzz8JDptKmuQxoQ60Se/1Flsk9EJ8ncmp3H0RgexyC8BdZdtJr8/Vf9ykfsv9h9M/d6dBZ6s2AoVRqIy0aC1ycJyicPZKFpaQwDB24nrRyO2pWbwdO/Mly9qV29LCCMIDAZ6gOmQVwx1Dg3zLS8ZMZjGrX8OpVUidn/Q2SzpjAPWua2mZxtGQSyNhFL2UP39entwDukxW7Rfgj8ygfyqhtdV42lVUl9j49KNMXphgUpNqshjcQ5lNA4MHrVQD9nrm61JtnbzKcGGdYeWg5' --register no --directory /var/cache/mkosi/194c50ed45cf4e79/image-8f4140bc33514e87 --setenv enforcing=0 --setenv loglevel=6 --setenv module_blacklist=vmw_vmci --setenv ip=enc0:any --setenv ip=enp0s1:any --setenv ip=enp0s2:any --setenv ip=host0:any --setenv ip=none --setenv loglevel=4 --setenv SYSTEMD_SULOGIN_FORCE=1 --setenv console=hvc0 --setenv TERM=dumb systemd.mask=systemd-resolved.service systemd.log_ratelimit_kmsg=0 systemd.crash_shell printk.devkmsg=on systemd.early_core_pattern=/core systemd.default_device_timeout_sec=180 systemd.log_level=debug udev.log_level=info systemd.show_status=false systemd.journald.forward_to_console systemd.journald.max_level_console=info systemd.firstboot=no systemd.unit=mkosi-check-and-shutdown.service rw systemd.wants=network.target systemd.tty.term.hvc0=dumb systemd.tty.columns.hvc0=80 systemd.tty.rows.hvc0=24 systemd.tty.term.console=dumb systemd.tty.columns.console=80 systemd.tty.rows.console=24
Failed to mount proc (type proc) on /proc (MS_NOSUID|MS_NODEV|MS_NOEXEC ""): Operation not permitted

https://github.com/systemd/mkosi/actions/runs/16071373054/job/45356747408?pr=3791

systemd/mkosi#3791

I have tried disabling apparmor given it's Ubuntu, but it's not enabled. Are nested containers restricted from running?