The KVM image-upgrade gate (#2057, PR #2180) proves the upgrade from v1.20.0 on the appliance. v1.20.0 predates both container_engine and the podman/netavark nft Tor-egress ruleset: its stack_up can only install iptables DOCKER-USER rules, a chain netavark never jumps to. So the harness cannot restore that baseline under strict_pithead, which refuses to start containers without the canonical ruleset.
Per the ruling on #2057, the harness restores the baseline with a plain pithead up only when the sourced baseline CLI has no container_engine AND the engine is podman, and records the counted by-design skip row baseline Tor-egress ruleset: v1.20.0 predates the podman ruleset. The candidate's pithead upgrade, and every baseline whose CLI knows the engine, stays strict.
Close this issue when 2.0.0 becomes the gate's baseline: move the image-upgrade gate's baseline from v1.20.0 to 2.0.0, confirm the skip row no longer appears in a tier4-kvm image-upgrade run, and delete the exemption (baseline_up's plain-up branch in tests/integration/lib/) if no pre-podman baseline remains.
The KVM image-upgrade gate (#2057, PR #2180) proves the upgrade from v1.20.0 on the appliance. v1.20.0 predates both
container_engineand the podman/netavark nft Tor-egress ruleset: itsstack_upcan only install iptablesDOCKER-USERrules, a chain netavark never jumps to. So the harness cannot restore that baseline understrict_pithead, which refuses to start containers without the canonical ruleset.Per the ruling on #2057, the harness restores the baseline with a plain
pithead uponly when the sourced baseline CLI has nocontainer_engineAND the engine is podman, and records the counted by-design skip rowbaseline Tor-egress ruleset: v1.20.0 predates the podman ruleset. The candidate'spithead upgrade, and every baseline whose CLI knows the engine, stays strict.Close this issue when 2.0.0 becomes the gate's baseline: move the image-upgrade gate's baseline from v1.20.0 to 2.0.0, confirm the skip row no longer appears in a tier4-kvm image-upgrade run, and delete the exemption (
baseline_up's plain-upbranch intests/integration/lib/) if no pre-podman baseline remains.