ci: skip buildah unshare when the cache cleanup runs as root

ci/cleanup-build-cache.sh

@@ -2,9 +2,14 @@
 # Caller holds its store lock. Keep recent image layers and the host NuGet cache.
 set -euo pipefail
 : "${CONTAINERS_STORAGE_CONF:?an explicit, locked CI Buildah store is required}"
+# 以 root 运行（CI 主机）时存储是 root 的，直接用；只有无特权用户才需要 buildah unshare 进用户命名空间。
+# 这台主机上 buildah unshare 会报 memfd_create: Invalid argument，root 下也用不着它。
+in_userns() {
+  if [[ "$(id -u)" == 0 ]]; then "$@"; else buildah unshare "$@"; fi
+}
 # No build is active while the caller holds the exclusive store lock. Remove
 # working containers left by canceled builds before considering old image layers.
-buildah unshare buildah rm --all >/dev/null 2>&1 || true
+in_userns buildah rm --all >/dev/null 2>&1 || true
 buildah rmi localhost/moshiro-agent-binaries:linux-musl-x64 >/dev/null 2>&1 || true
 # Remove only expired intermediate layers and versioned application images.
 mapfile -t expired < <(buildah images --all --no-trunc --format '{{.ID}} {{.Created}} {{.Name}}:{{.Tag}}' | python3 -c '
@@ -24,7 +29,7 @@ for image in "${expired[@]}"; do
 done
 echo "expired build layers considered: ${#expired[@]} (retention: 7 days; NuGet cache retained)"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-# 旧的 Buildah 存储目录需要在 buildah unshare 里删（属主是映射后的 uid）；这台主机上 unshare 失败时（memfd_create 之类）只警告，下次再试，不影响调用方。
-if ! buildah unshare python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home; then
-  echo 'warning: retired Buildah stores were not cleaned (buildah unshare failed); the next run retries' >&2
+# 旧的 Buildah 存储目录的属主可能是映射后的 uid，无特权用户要在用户命名空间里删；清理失败只警告，下次再试，不影响调用方。
+if ! in_userns python3 "$root/ci/cleanup-retired-stores.py" /home/justme/woodpecker/buildah-home; then
+  echo 'warning: retired Buildah stores were not cleaned (cleanup failed); the next run retries' >&2
 fi

scripts/test-linux-agent-build.py

@@ -174,7 +174,8 @@ esac
             for line in calls:
                 self.assertIn('||', line, f'{script}: {line.strip()}')
         cleanup = (ROOT / 'ci/cleanup-build-cache.sh').read_text()
-        self.assertIn('if ! buildah unshare python3', cleanup)
+        self.assertIn('if ! in_userns python3', cleanup)
+        self.assertIn('[[ "$(id -u)" == 0 ]]', cleanup)  # root 不进 buildah unshare，这台主机上它会报 memfd_create
 
     def test_linux_packages_preserve_installers_and_shared_library_payloads(self):
         with tempfile.TemporaryDirectory() as directory: