Use gha oracle runners for build and test job (#2277)

Summary: Use gha oracle runners for build and test job

This PR supersedes #2261.

Relevant Issues: N/A

Type of change: /kind cleanup

Test Plan: Adhoc build from latest commit passes ([build
link](https://github.com/pixie-io/pixie/actions/runs/19958776211))

---------

Signed-off-by: Koray Oksay <[email protected]>
Signed-off-by: Dom Del Nano <[email protected]>
Co-authored-by: Koray Oksay <[email protected]>

Author: ddelnano

.github/workflows/build_and_test.yaml

@@ -36,7 +36,7 @@ jobs:
       image-base-name: "dev_image_with_extras"
       ref: ${{ needs.env-protect-setup.outputs.ref }}
   clang-tidy:
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     needs: [authorize, env-protect-setup, get-dev-image]
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -64,7 +64,7 @@ jobs:
   code-coverage:
     if: github.event_name == 'push'
     needs: [authorize, env-protect-setup, get-dev-image]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     steps:
@@ -88,7 +88,7 @@ jobs:
         ./ci/collect_coverage.sh -u -b main -c "$(git rev-parse HEAD)" -r pixie-io/pixie
   generate-matrix:
     needs: [authorize, env-protect-setup, get-dev-image]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     outputs:
@@ -120,7 +120,7 @@ jobs:
           bazel_tests_*
   build-and-test:
     needs: [authorize, env-protect-setup, get-dev-image, generate-matrix]
-    runs-on: oracle-16cpu-64gb-x86-64
+    runs-on: oracle-vm-16cpu-64gb-x86-64
     permissions:
       contents: read
       actions: read
@@ -160,6 +160,10 @@ jobs:
       run: |
         # Github actions container runner creates a docker network without IPv6 support. We enable it manually.
         sysctl -w net.ipv6.conf.lo.disable_ipv6=0
+
+        # Our qemu builds require unprivileged user namespaces to run.
+        sysctl -w kernel.unprivileged_userns_clone=1
+        sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
         ./scripts/bazel_ignore_codes.sh test ${{ matrix.args }} --target_pattern_file=target_files/${{ matrix.tests }} \
           2> >(tee bazel_stderr)
     - name: Parse junit reports

bazel/toolchain_transitions.bzl

@@ -29,6 +29,7 @@ cc_clang_binary = meta.wrap_with_transition(
     native.cc_binary,
     {
         "@//bazel/cc_toolchains:compiler": meta.replace_with("clang"),
+        "@//bazel/cc_toolchains:libc_version": meta.replace_with("glibc2_36"),
     },
     executable = True,
 )

ci/github/bazelrc

@@ -5,9 +5,6 @@ common --color=yes
 # a given run.
 common --keep_going
 
-# Always use remote exec
-build --config=remote
-
 build --build_metadata=HOST=github-actions
 build --build_metadata=USER=github-actions
 build --build_metadata=REPO_URL=https://github.com/pixie-io/pixie

src/utils/testingutils/docker/elastic.go

@@ -70,20 +70,23 @@ func SetupElastic() (*elastic.Client, func(), error) {
 				Type:   "tmpfs",
 				TempfsOptions: &docker.TempfsOptions{
 					SizeBytes: 100 * 1024 * 1024,
+					Mode:      0o777,
 				},
 			},
 			{
 				Target: "/opt/elasticsearch/volatile/logs",
 				Type:   "tmpfs",
 				TempfsOptions: &docker.TempfsOptions{
 					SizeBytes: 100 * 1024 * 1024,
+					Mode:      0o777,
 				},
 			},
 			{
 				Target: "/tmp",
 				Type:   "tmpfs",
 				TempfsOptions: &docker.TempfsOptions{
 					SizeBytes: 100 * 1024 * 1024,
+					Mode:      0o777,
 				},
 			},
 		}