From 2af8deb3aa29fffb03545ca58ddaee9a8a9e9f2e Mon Sep 17 00:00:00 2001
From: Guus Sliepen <guus@tinc-vpn.org>
Date: Mon, 6 Apr 2026 16:28:21 +0200
Subject: [PATCH] Add workaround for ip netns exec misbehaving in containers

---
 .ci/compat/run.sh          | 5 +++++
 .ci/test/prepare.sh        | 5 +++++
 .github/workflows/test.yml | 3 +++
 3 files changed, 13 insertions(+)

diff --git a/.ci/compat/run.sh b/.ci/compat/run.sh
index 83bfedb8..66308c80 100755
--- a/.ci/compat/run.sh
+++ b/.ci/compat/run.sh
@@ -139,6 +139,11 @@ tinc11() {
   /opt/tinc11/sbin/tinc -c $etc/tinc11 "$@"
 }
 
+if [ -n "$CI" ]; then
+  # Workaround for ip netns exec messing with /sys mount in containers
+  mount -t sysfs --make-private sysfs $(mktemp -d)
+fi
+
 header 'Creating branches'
 
 for node in $nodes; do
diff --git a/.ci/test/prepare.sh b/.ci/test/prepare.sh
index da0269fc..6dcbeb54 100755
--- a/.ci/test/prepare.sh
+++ b/.ci/test/prepare.sh
@@ -6,3 +6,8 @@ if [ -n "${HOST:-}" ]; then
   update-binfmts --enable
   rm -f /dev/net/tun
 fi
+
+if [ -n "$CI" ]; then
+  # Workaround for ip netns exec messing with /sys mount in containers
+  mount -t sysfs --make-private sysfs $(mktemp -d)
+fi
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ee25e874..e737aea4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -170,6 +170,9 @@ jobs:
       - name: Install deps
         run: .ci/deps.sh iputils-arping clang libclang-rt-dev
 
+      - name: Prepare the system
+        run: .ci/test/prepare.sh
+
       - name: Sanitize tests with default settings
         run: .ci/sanitizers/run.sh default
         if: always()
-- 
2.47.3