ci: port setup_rootless from Cirrus, revert oracle-vm to cncf

Signed-off-by: Tim Zhou <tizhou@redhat.com>

Author: timcoding1988

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
     name: smoke
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-4-16-x86
       test: smoke
       distro: fedora-current
       timeout: 20
@@ -28,7 +28,7 @@ jobs:
     name: vendor
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-4-16-x86
       test: vendor
       distro: fedora-current
       timeout: 20
@@ -59,7 +59,7 @@ jobs:
         storage: [vfs, overlay]
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-4-16-x86
       test: unit
       storage: ${{ matrix.storage }}
       priv: root
@@ -75,7 +75,7 @@ jobs:
         storage: [vfs, overlay]
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-8-32-x86
       test: conformance
       storage: ${{ matrix.storage }}
       priv: root
@@ -102,7 +102,7 @@ jobs:
             distro: fedora-rawhide
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-8-32-x86
       test: integration
       storage: ${{ matrix.storage }}
       priv: ${{ matrix.priv }}
@@ -114,7 +114,7 @@ jobs:
     name: in_podman
     uses: ./.github/workflows/lima.yml
     with:
-      runner: oracle-vm-16cpu-64gb-x86-64
+      runner: cncf-ubuntu-8-32-x86
       test: in_podman
       storage: vfs
       priv: root

contrib/ci/runner.sh

@@ -39,6 +39,36 @@ for which in uid gid; do
     fi
 done
 
+ROOTLESS_USER="rootlessuser"
+
+# Mirror upstream Cirrus's setup_rootless(): create a dedicated user with subuid
+# mapping and 3 supplemental groups, then re-exec the rootless test as that user
+# (Cirrus uses ssh; we use sudo -u which is simpler and equivalent for our needs).
+function setup_rootless_user() {
+    if id -u "$ROOTLESS_USER" &>/dev/null; then
+        sudo chown -R "$ROOTLESS_USER:$ROOTLESS_USER" "$GOSRC" || true
+        return 0
+    fi
+    local uid=$((RANDOM + 1000))
+    local gid=$uid
+    local sg1=$((gid + 1))
+    local sg2=$((sg1 + 1))
+    local sg3=$((sg2 + 1))
+    sudo groupadd -g "$gid" "$ROOTLESS_USER"
+    sudo groupadd -g "$sg1" "${ROOTLESS_USER}sg1"
+    sudo groupadd -g "$sg2" "${ROOTLESS_USER}sg2"
+    sudo groupadd -g "$sg3" "${ROOTLESS_USER}sg3"
+    sudo useradd -g "$gid" \
+        -G "${ROOTLESS_USER}sg1,${ROOTLESS_USER}sg2,${ROOTLESS_USER}sg3" \
+        -u "$uid" --no-user-group --create-home "$ROOTLESS_USER"
+    if ! grep -qE "^$ROOTLESS_USER:" /etc/subuid; then
+        echo "$ROOTLESS_USER:200000:65536" | sudo tee -a /etc/subuid
+        echo "$ROOTLESS_USER:200000:65536" | sudo tee -a /etc/subgid
+    fi
+    echo "$ROOTLESS_USER ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/rootlessuser
+    sudo chown -R "$ROOTLESS_USER:$ROOTLESS_USER" "$GOSRC"
+}
+
 if [[ "$TEST" == "conformance" ]]; then
     case "$OS_RELEASE_ID" in
         fedora)
@@ -99,7 +129,14 @@ function run_conformance() {
 
 function run_integration() {
     make all
-    $SUDO make test-integration
+    if [[ "$PRIV" == "rootless" ]]; then
+        setup_rootless_user
+        sudo -u "$ROOTLESS_USER" --preserve-env="$PRESERVE_ENVS" \
+            env "GOSRC=$GOSRC" "PATH=$PATH" \
+            make test-integration
+    else
+        $SUDO make test-integration
+    fi
 }
 
 function run_in_podman() {