From ac1f123b550895803dfe539f3dd6829e0893d817 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20V=C3=B6gele?= <andreas@andreasvoegele.com>
Date: Tue, 13 May 2025 06:51:08 +0200
Subject: [PATCH 1/2] github: Add basic tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Andreas Vögele <andreas@andreasvoegele.com>
---
 .github/workflows/basic-tests.yml | 71 +++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 .github/workflows/basic-tests.yml

diff --git a/.github/workflows/basic-tests.yml b/.github/workflows/basic-tests.yml
new file mode 100644
index 0000000..6d41e6b
--- /dev/null
+++ b/.github/workflows/basic-tests.yml
@@ -0,0 +1,71 @@
+name: Basic Tests
+
+on:
+  push:
+    branches:
+      - '*'
+    tags-ignore:
+      - '*'
+    pull_request:
+
+jobs:
+  basic-tests:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.8", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install setuptools
+        run: python -m pip install setuptools
+
+      - name: Install LXC
+        run: sudo apt-get install -y lxc lxc-dev
+
+      - name: Configure LXC
+        run: |
+          mkdir -p ~/.config/lxc /var/tmp/lxc
+          cat >~/.config/lxc/lxc.conf <<EOF
+          lxc.lxcpath = /var/tmp/lxc
+          EOF
+          cat >~/.config/lxc/default.conf <<EOF
+          lxc.include = /etc/lxc/default.conf
+          lxc.idmap = u 0 165536 65536
+          lxc.idmap = g 0 165536 65536
+          lxc.apparmor.profile = unconfined
+          EOF
+          echo "$(id -un) veth lxcbr0 10" | sudo tee -a /etc/lxc/lxc-usernet
+
+      - name: Build module
+        run: python3 setup.py build
+
+      - name: Install module
+        run: pip install .
+
+      - name: Enable unprivileged user namespaces
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
+      - name: Create container
+        run: >
+          python3 -c 'import lxc;exit(0 if lxc.Container("mycontainer").create("download", 0, {"dist": "alpine", "release": "edge", "arch": "amd64"}) else 1)'
+
+      - name: Start container
+        run: python3 -c 'import lxc;exit(0 if lxc.Container("mycontainer").start() else 1)'
+
+      - name: Run command inside container
+        run: python3 -c 'import lxc;exit(lxc.Container("mycontainer").attach_wait(lxc.attach_run_command, ["uname", "-a"]))'
+
+      - name: Stop container
+        if: success() || failure()
+        run: python3 -c 'import lxc;exit(0 if lxc.Container("mycontainer").stop() else 1)'
+
+      - name: Destroy container
+        if: success() || failure()
+        run: python3 -c 'import lxc;exit(0 if lxc.Container("mycontainer").destroy() else 1)'

From 5c603a76658d7d278086682ad4481d4c792224f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20V=C3=B6gele?= <andreas@andreasvoegele.com>
Date: Tue, 13 May 2025 12:07:36 +0200
Subject: [PATCH 2/2] Replace the deprecated PyOS_AfterFork() function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Container_attach_and_possibly_wait() fails in Python 3.13 with
"PyMutex_Unlock: unlocking mutex that is not locked" if PyOS_AfterFork()
is used.

Signed-off-by: Andreas Vögele <andreas@andreasvoegele.com>
---
 lxc.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/lxc.c b/lxc.c
index b515acd..3039cfc 100644
--- a/lxc.c
+++ b/lxc.c
@@ -198,7 +198,11 @@ static int lxc_attach_python_exec(void* _payload)
      * container. As lxc_attach() calls fork() PyOS_AfterFork should be called
      * in the new process if the Python interpreter will continue to be used.
      */
+#if PY_VERSION_HEX >= 0x030700F0
+    PyOS_AfterFork_Child();
+#else
     PyOS_AfterFork();
+#endif
 
     struct lxc_attach_python_payload *payload =
         (struct lxc_attach_python_payload *)_payload;
@@ -748,8 +752,14 @@ Container_attach_and_possibly_wait(Container *self, PyObject *args,
     if (!options)
         return NULL;
 
+#if PY_VERSION_HEX >= 0x030700F0
+    PyOS_BeforeFork();
+#endif
     ret = self->container->attach(self->container, lxc_attach_python_exec,
                                   &payload, options, &pid);
+#if PY_VERSION_HEX >= 0x030700F0
+    PyOS_AfterFork_Parent();
+#endif
     if (ret < 0)
         goto out;