From 75d68ff1eab5744e21edd7b3571e0f600ac38f8c Mon Sep 17 00:00:00 2001 From: Pablo Acevedo Montserrat Date: Fri, 7 Aug 2026 14:10:56 +0200 Subject: [PATCH] Fix rootless podman in rebase-cryptoscan-src image Make /etc/passwd and /etc/group group-writable so the crypto scan script can create a passwd entry for the arbitrary CI UID. Set BUILDAH_ISOLATION=chroot to avoid user-namespace issues inside CI pods. Without these, newuidmap fails with "Invalid argument" because the entrypoint cannot register the running user in /etc/subuid. Co-Authored-By: Claude Opus 4.6 --- .../openshift/microshift/openshift-microshift-main.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ci-operator/config/openshift/microshift/openshift-microshift-main.yaml b/ci-operator/config/openshift/microshift/openshift-microshift-main.yaml index 9ff2e73979833..e888d6e762460 100644 --- a/ci-operator/config/openshift/microshift/openshift-microshift-main.yaml +++ b/ci-operator/config/openshift/microshift/openshift-microshift-main.yaml @@ -29,7 +29,9 @@ images: setcap cap_setuid+ep /usr/bin/newuidmap && \ setcap cap_setgid+ep /usr/bin/newgidmap && \ touch /etc/subgid /etc/subuid && \ - chmod g=u /etc/subuid /etc/subgid + chmod g=u /etc/subuid /etc/subgid && \ + chmod g=u /etc/passwd /etc/group + ENV BUILDAH_ISOLATION=chroot USER 1000 inputs: src: