docs(podman): document and track the e2e-podman rootful coverage gap

Address the rootless/rootful-scope acceptance criterion in #3712:
document why the e2e-podman archive runs rootless-only in branch CI
(unlike driver-podman, which runs both), and file a tracking issue for
the one confirmed gap.

- podman_host_gateway was checked directly rather than assumed: the
  outer container's host-gateway alias uses Podman's own native
  "host-gateway" value (resolved identically in both modes), and the
  supervisor-side resolution defaults to a hardcoded 127.0.0.1 on
  Linux regardless of rootful/rootless. No real coverage gap there.
- podman_resource_limits is the one confirmed exception: it reads real
  cgroup v2 state, and rootless cgroup delegation is the harder,
  already-covered case. Rootful is unverified. Tracked in #4163, which
  also notes the e2e-podman tmachine playbook hardcodes rootless-only
  values and would need the same tmachine_container_runtime role
  pattern #3663 already proved out for the driver-podman suite.
- CI.md and tests/artifacts.nix both say plainly that closing #4163
  means running the whole archive rootful, not just the one target
  that needs it -- nextest archive filters select whole binaries, so
  there's no cheaper way to isolate just podman_resource_limits.

Signed-off-by: politerealism <burdcat17@gmail.com>

Author: politerealism

CI.md

@@ -88,6 +88,14 @@ naming any selected manual-only benchmarks separately, so a narrow run cannot
 be mistaken for full Podman coverage. See `nix run .#podman-e2e-coverage-summary`
 in TESTING.md.
 
+The `driver-podman` testsuite runs both rootful and rootless Fedora Podman;
+`e2e-podman` runs rootless only. This is deliberate, not an oversight: see the
+comment on `podmanE2eArchive` in `tests/artifacts.nix` for which targets would
+and would not benefit from a rootful leg. Only `podman_resource_limits` does,
+but nextest archive filters select whole binaries, so closing that gap (tracked
+in #4163) means running this entire archive rootful too, not just that one
+target.
+
 Three opt-in labels enable the long-running E2E suites:
 
 - `test:e2e` runs the Docker, rootless Podman, Kubernetes, and VM E2E suites

tests/artifacts.nix

@@ -252,6 +252,32 @@ let
     target = muslToolchain.target;
     output = "artifacts/test-archives/${muslToolchain.target}/openshell-podman-tests.tar";
   };
+  # Runs rootless-only in branch CI today (see .github/workflows/branch-e2e.yml's
+  # driver-specific-integration matrix), unlike podmanDriverArchive above, which
+  # runs both rootful and rootless. This is a deliberate scoping decision, not an
+  # oversight (#3712): most of this archive's selected targets (sandbox/workspace
+  # lifecycle, labels, templates, port forwarding, uploads, settings) exercise
+  # driver-agnostic gateway/policy logic with no privilege-model sensitivity, so a
+  # rootful leg would duplicate coverage without catching anything new.
+  #
+  # podman_host_gateway was checked specifically (host.openshell.internal
+  # resolution plausibly depends on the rootless pasta/slirp4netns vs. rootful
+  # netavark/CNI network backend) and confirmed NOT privilege-sensitive: the
+  # outer container's /etc/hosts entry uses Podman's own native "host-gateway"
+  # alias value (container.rs), which Podman resolves identically in both
+  # modes, and the supervisor-side resolution defaults to a hardcoded
+  # 127.0.0.1 on Linux regardless of rootful/rootless
+  # (PodmanComputeConfig::resolved_host_gateway_ip in config.rs). No rootful
+  # coverage gap here.
+  #
+  # The one confirmed exception is podman_resource_limits, which reads real
+  # cgroup v2 state from inside the sandbox: rootless cgroup delegation
+  # depends on systemd-user `Delegate=` and can silently no-op if
+  # misconfigured, making rootless the harder, higher-risk case -- already
+  # covered here. Rootful is the lower-risk, currently-unverified path for
+  # that one target. Tracked in #4163; since nextest archive filters select
+  # whole binaries, closing that gap means running this entire archive
+  # rootful too, not just the one target that needs it.
   podmanE2eArchive = mkTestArchive {
     name = "podman-e2e";
     workspacePath = "e2e/rust";