Test RHEL UBI10, which runs systemd, on gVisor

redhat/ubi10-init covers a second systemd lineage: RHEL 10, systemd
v257, which mandates cgroup v2. The test boots it and checks for failed
units and a working transient unit.

images/systemd/ built systemd from source for a past investigation and
is referenced by nothing.

PiperOrigin-RevId: 970125419

Makefile

@@ -261,7 +261,7 @@ integration-tests: do-tests kvm-tests containerd-tests-min
 integration-tests: sandbox-posture-tests
 .PHONY: integration-tests
 
-integration-test-images: load-image-test load-basic load-systemd-integ load-systemd-services
+integration-test-images: load-image-test load-basic load-systemd-integ load-systemd-services load-ubi10-init
 .PHONY: integration-test-images
 
 network-tests: ## Run all networking integration tests.

images/systemd/Dockerfile

@@ -1,38 +0,0 @@
-FROM ubuntu:latest
-ENV DEBIAN_FRONTEND=noninteractive
-RUN apt-get update -y && apt-get upgrade -y
-RUN apt-get update && apt-get install -y \
-    git \
-    meson \
-    ninja-build \
-    gcc \
-    g++ \
-    pkg-config \
-    python3-pip \
-    python3-jinja2 \
-    python3-lxml \
-    libcap-dev \
-    libmount-dev \
-    libseccomp-dev \
-    libdw-dev \
-    libudev-dev \
-    libkmod-dev \
-    libblkid-dev \
-    gperf \
-    bash-completion \
-    && rm -rf /var/lib/apt/lists/*
-
-# 2. Clone the systemd repository
-WORKDIR /systemd
-RUN git clone --depth 1 https://github.com/systemd/systemd.git .
-
-# 3. Setup the build directory
-# We disable some heavy optional features to speed up the test cycle
-RUN meson setup build/ \
-    -Dman=false \
-    -Dhtml=false \
-    -Dtests=true \
-    -Dinstall-tests=true
-
-# 4. Build systemd
-RUN ninja -C build/

images/systemd/README.md

@@ -1,52 +0,0 @@
-# Systemd Test Image
-
-This directory contains a Dockerfile for building a `systemd` test image. This
-image is primarily used for testing gVisor's compatibility with `systemd` and
-its various components.
-
-## Prerequisites
-
-Before running the tests, ensure you have gVisor built and configured as a
-Docker runtime.
-
-```bash
-# Build gVisor and install the dev runtime (runsc-d)
-make dev
-```
-
-## Building the Image
-
-To build the `systemd` test image, run:
-
-```bash
-docker build //images/systemd -t systemd-test-image
-```
-
-Alternatively, you can use the `make` workflow from the top-level directory:
-
-```bash
-make load-systemd
-```
-
-## Running the Tests
-
-To run the `systemd` tests within the container using gVisor, execute:
-
-```bash
-docker run --runtime=sandbox-cgroup-d --privileged \
-  -v /tmp/systemd:/systemd/build/meson-logs -it systemd-tests \
-  meson test -C build/ --print-errorlogs
-```
-
-> [!IMPORTANT] The `--privileged` flag is required because `systemd` tests often
-> need to perform operations that are restricted in a standard container
-> environment, such as mounting filesystems or interacting with device nodes.
-
-## Implementation Details
-
-The [Dockerfile](./Dockerfile) performs the following steps: 1. Starts from a
-recent Ubuntu base image. 2. Installs necessary build dependencies (`meson`,
-`ninja`, `gcc`, etc.). 3. Clones the `systemd` repository from GitHub. 4.
-Configures the build using `meson`, disabling heavy optional features (like man
-pages and HTML documentation) to speed up the build and test cycle. 5. Compiles
-`systemd` using `ninja`.

images/ubi10-init/Dockerfile

@@ -0,0 +1 @@
+FROM redhat/ubi10-init@sha256:9aedd4bb69c2ba7a3fc0a1c78aa096bb6a21950cc326102a7c791118b5181191

test/e2e/systemd_test.go

@@ -168,6 +168,24 @@ func TestSystemdBoot(t *testing.T) {
 	}
 }
 
+// TestSystemdUBI10Init boots Red Hat's UBI 10 init image: a second systemd
+// lineage (RHEL 10, systemd v257, which mandates cgroup v2).
+func TestSystemdUBI10Init(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	d := spawnSystemdContainer(ctx, t, "ubi10-init")
+	defer d.CleanUp(ctx)
+
+	if out := strings.TrimSpace(execOrFatal(ctx, t, d, "systemctl", "--failed", "--no-legend", "--plain")); out != "" {
+		t.Errorf("failed units after boot (want none):\n%s", out)
+	}
+	wantEcho := "gv-ubi10-ok"
+	out, err := transientRun(ctx, d, nil, "/bin/echo", wantEcho)
+	if err != nil || !strings.Contains(out, wantEcho) {
+		t.Errorf("transient unit failed: %v (output does not contain %q): %s", err, wantEcho, out)
+	}
+}
+
 // TestSystemdSimpleDaemon verifies that a custom systemd service can be enabled, started,
 // stopped, and restarted by systemd after an out-of-band kill.
 func TestSystemdSimpleDaemon(t *testing.T) {