CI capabilities test: inconsistent CapBnd

[edsantiago]

First things first: this makes no sense to me. I don't see how this could be a flake; it should either consistently fail or consistently pass on the same machine. Instead, we get one-offs, and the ginkgo retry (so far) always passes.

Symptom:

$ podman-remote run --rm --user bin alpine grep CapBnd /proc/self/status
CapBnd:	00000000800405fb
...
Expected
               <string>: CapBnd: 00000000800405fb
           to contain substring
               <string>: 00000000a80425fb

Source:

podman/test/e2e/run_test.go

Lines 334 to 338 in 68ca906

	os.Setenv("CONTAINERS_CONF", "/dev/null")
	session := podmanTest.Podman([]string{"run", "--rm", "--user", "bin", ALPINE, "grep", "CapBnd", "/proc/self/status"})
	session.WaitWithDefaultTimeout()
	Expect(session.ExitCode()).To(Equal(0))
	Expect(session.OutputToString()).To(ContainSubstring("00000000a80425fb"))

Environment: so far, only f32 and f33. Always remote.

Decoding: the cap difference is -- surprise! -- CAP_NET_RAW, CAP_MKNOD,CAP_AUDIT_WRITE

cirrus-flake-xref results:

Podman run [It] podman run user capabilities test

• gce_instance:fedora : int remote fedora-33 root host
  • PR Bump containers/buildah to v1.19.4 #9272
    • 02-08 17:07
  • PR fix logic when not creating a workdir #9231
    • 02-05 04:44
  • PR podman build --pull: use correct policy #9127
    • 01-27 11:55
  • PR Cirrus: Collect ginkgo node logs artifacts #9113
    • 02-03 11:48
  • PR More /var/run -> /run #8953
    • 01-12 15:43
• gce_instance:prior-fedora : int remote fedora-32 root host
  • PR Allow path completion for podman create/run --rootfs #9269
    • 02-08 15:08
  • PR fix logic when not creating a workdir #9231
    • 02-05 05:02
  • PR Update nix pin with make nixpkgs #9154
    • 02-03 07:45
    • 02-02 23:06
  • PR More /var/run -> /run #8953
    • 01-12 15:45

Could podman be reading containers.conf even though $CONTAINERS_CONF is explicitly overridden?

[rhatdan]

The service needs to be reset after setting CONTAINERS_CONF to /dev/null.