add support for running bats in a container

Add a new "bats" container which is configured to run the bats tests.
The container supports running the standard bats test suite
(container-in-container) as well as the "--nocontainer" tests.

Add two new Makefile targets for running the bats container via podman.

Signed-off-by: Mike Bonnet <mikeb@redhat.com>

Makefile

@@ -10,6 +10,7 @@ PATH := $(PATH):$(HOME)/.local/bin
 IMAGE ?= ramalama
 PYTHON_FILES := $(shell find . -path "./.venv" -prune -o -name "*.py" -print) $(shell find . -name ".venv" -prune -o -type f -perm +111 -exec grep -l "^\#!/usr/bin/env python3" {} \; 2>/dev/null || true)
 PYTEST_COMMON_CMD ?= PYTHONPATH=. pytest test/unit/ -vv
+BATS_IMAGE ?= localhost/bats:latest
 
 default: help
 
@@ -161,6 +162,30 @@ bats-nocontainer:
 bats-docker:
 	_RAMALAMA_TEST_OPTS=--engine=docker RAMALAMA=$(CURDIR)/bin/ramalama bats -T test/system/
 
+.PHONY: bats-image
+bats-image:
+	podman inspect $(BATS_IMAGE) &> /dev/null || \
+		podman build -t $(BATS_IMAGE) -f container-images/bats/Containerfile .
+
+.PHONY: bats-in-container
+bats-in-container: bats-image
+	podman run -it --rm \
+		--userns=keep-id:size=200000 \
+		--security-opt unmask=/proc/* \
+		--security-opt label=disable \
+		--security-opt=mask=/sys/bus/pci/drivers/i915 \
+		--device /dev/net/tun \
+		-v $(CURDIR):/src \
+		$(BATS_IMAGE) make bats
+
+.PHONY: bats-nocontainer-in-container
+bats-nocontainer-in-container: bats-image
+	podman run -it --rm \
+		--userns=keep-id:size=200000 \
+		--security-opt=mask=/sys/bus/pci/drivers/i915 \
+		-v $(CURDIR):/src \
+		$(BATS_IMAGE) make bats-nocontainer
+
 .PHONY: ci
 ci:
 	test/ci.sh