From d4fc1d38c8e978f420e7a26f5224840131ec0cf7 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Tue, 31 Mar 2026 00:56:26 +0200 Subject: [PATCH] scripts: dev_cli: Allow io_uring syscalls in unit tests The unit test container runs with Docker default seccomp profile which blocks io_uring_setup, io_uring_enter and io_uring_register. This causes all qcow_async unit tests to fail with EPERM when creating an io_uring instance. Add --security-opt seccomp=unconfined to the unit test docker run invocation. The container already has --device access and cap_net_admin, so this does not materially change the security posture. Signed-off-by: Anatol Belski --- scripts/dev_cli.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/dev_cli.sh b/scripts/dev_cli.sh index 0c0a2d5e4..6e9d58eb7 100755 --- a/scripts/dev_cli.sh +++ b/scripts/dev_cli.sh @@ -438,6 +438,7 @@ cmd_tests() { --device $exported_device \ --device /dev/net/tun \ --cap-add net_admin \ + --security-opt seccomp=unconfined \ --volume "$CLH_ROOT_DIR:$CTR_CLH_ROOT_DIR" \ ${exported_volumes:+$exported_volumes} \ --env BUILD_TARGET="$target" \