test(ci): add ci/container/test-container-run.sh and run it per container runtime

[basvandijk]

Stacked on #11460 (mount the checkout at its host path); review that one first.

Change

• fix(ci): --user "$CTR_USER" instead of --user "$CTR_USER:$CTR_USER". /home/ubuntu is mode 750 in the base image and buildifier is in group ubuntu so that it can read the /home/ubuntu/.ic-build-container marker that build-ic.sh tests to detect that it already runs inside the container. The explicit user:group form makes both podman and docker drop supplementary groups (verified with podman 4.9.3 and docker 29.5.2), so on uid-1001 hosts (GitHub runners, namespace.so devboxes) build-ic.sh re-executed container-run.sh inside the container and failed on its nesting guard. The primary group still comes from /etc/passwd.
• test(ci): ci/container/test-container-run.sh. Runs on the host, locally or on CI, with podman (default) or CONTAINER_RUNTIME=docker. It starts containers from the checkout and from a temporary linked worktree next to it and asserts: cwd is the host path, nothing at /ic, BAZELRC unset, checkout owned by the host uid, git works in both checkouts (toplevel, common dir, HEAD, status, gc.worktreePruneExpire=never, the other worktree listed as prunable, workspace_status.sh --stamp), bazel's default output base is md5(host path) and differs per checkout, no rc file is written to the cache dir, the main checkout's bazel server keeps its pid while the worktree container runs bazel (the fix(ci): give each checkout its own bazel output base in container-run.sh #11441 regression), and build-ic.sh --help drops into the ic-build container from a repo-relative and from an absolute host path. All containers use a throwaway cache directory, so real output bases and running servers are never touched; a dirty tree is fine. About 30 s locally with warm images.
• ci: test-container-run runs the script once per runtime (podman, docker) with fail-fast: false. The crun-pinning workaround is gated on matrix.runtime == 'podman' because container-run.sh forwards PODMAN_RUN_USR_ARGS to docker run too. .github/workflows/ci-main.yml joins the job's paths filter so edits to the job run it on the PR. The old TestCase 1/2 legs (start a container, assert nothing) are replaced; no ruleset names them.
• docs: README subsection on the test.

Verified on a devenv: the script passes under podman and docker from the main checkout, and id inside a container now lists the user's supplementary groups.

[Copilot]

🟡 Changes recommended

The concurrency test can falsely pass when Bazel fails in the worktree container.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds integration coverage for container-run.sh across Podman and Docker while preserving supplementary container groups.

Changes:

• Preserves supplementary groups when selecting the container user.
• Adds worktree, Bazel isolation, and build-ic.sh integration tests.
• Runs tests for both container runtimes in CI and documents usage.

File summaries

File	Description
ci/container/test-container-run.sh	Adds integration tests.
ci/container/README.md	Documents the test script.
ci/container/container-run.sh	Preserves supplementary groups.
.github/workflows/ci-main.yml	Adds Podman and Docker test jobs.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.