From 2128edbdd3b6a14f545be6628064a818a05eb88e Mon Sep 17 00:00:00 2001 From: Alexey Milovidov Date: Fri, 15 May 2026 23:35:55 +0000 Subject: [PATCH 1/8] Merge pull request #105088 from ClickHouse/fix-clickbench-filesystem-cache-path Fix ClickBench job: allow `/dev/shm/clickhouse/` as filesystem cache path (cherry picked from commit 48ea778c32e5c8e74aa0d6310e828a588857702e) (cherry picked from commit 7d710d7a8375a03c00b120471053294360587c19) Signed-off-by: CarlosFelipeOR --- ci/jobs/clickbench.py | 7 +++++++ ci/jobs/scripts/clickbench/filesystem_caches_path.xml | 10 ++++++++++ 2 files changed, 17 insertions(+) create mode 100644 ci/jobs/scripts/clickbench/filesystem_caches_path.xml diff --git a/ci/jobs/clickbench.py b/ci/jobs/clickbench.py index f4d056e2fac57..fc98939db03b6 100644 --- a/ci/jobs/clickbench.py +++ b/ci/jobs/clickbench.py @@ -18,6 +18,13 @@ def main(): def install(): res = ch.install_clickbench_config() + # The ClickBench `create.sql` attaches `hits` on a cached disk + # rooted at `/dev/shm/clickhouse/`; ship the matching server-side + # allowed-directory override alongside it. + res = res and Shell.check( + f"cp ./ci/jobs/scripts/clickbench/filesystem_caches_path.xml {temp_dir}/config.d/", + verbose=True, + ) if info.is_local_run: return res return res # and ch.create_log_export_config() diff --git a/ci/jobs/scripts/clickbench/filesystem_caches_path.xml b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml new file mode 100644 index 0000000000000..dfc111da66cc8 --- /dev/null +++ b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml @@ -0,0 +1,10 @@ + + + /dev/shm/clickhouse/ + /dev/shm/clickhouse/ + From dd2fe03a2125fb801a3017db52ea312d694d8bf1 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Sun, 20 Sep 2026 16:20:51 -0300 Subject: [PATCH 2/8] Skip test_format_schema_source on ARM The module gained with_kafka=True from the #117737 backport, but 26.3 lacks the arm64 Kafka image override, so zookeeper:3.4.9 never starts under emulation. Every other Kafka test in the suite already skips on ARM. Signed-off-by: CarlosFelipeOR (cherry picked from commit 5dd45e25e8b79d89298f3a5ff70b33c4df238028) Signed-off-by: CarlosFelipeOR --- tests/integration/test_format_schema_source/test.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/tests/integration/test_format_schema_source/test.py b/tests/integration/test_format_schema_source/test.py index 3441a048d0a4b..635ac4c2b48e9 100644 --- a/tests/integration/test_format_schema_source/test.py +++ b/tests/integration/test_format_schema_source/test.py @@ -5,7 +5,11 @@ import helpers.kafka.common as k from helpers.client import QueryRuntimeException -from helpers.cluster import ClickHouseCluster +from helpers.cluster import ClickHouseCluster, is_arm + +# Skip on ARM due to Confluent/Kafka +if is_arm(): + pytestmark = pytest.mark.skip cluster = ClickHouseCluster(__file__) instance = cluster.add_instance( From 3f6d6d9580b7cd9cc5e9f337c13d219879ad2782 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Mon, 21 Sep 2026 14:46:53 -0300 Subject: [PATCH 3/8] Keep filesystem_caches_path out of the ClickBench override Co-Authored-By: Claude Opus 5 (1M context) (cherry picked from commit 4c2d531cdef6ed2ac86b355a10b6b3b0b4036b21) Signed-off-by: CarlosFelipeOR --- ci/jobs/scripts/clickbench/filesystem_caches_path.xml | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/ci/jobs/scripts/clickbench/filesystem_caches_path.xml b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml index dfc111da66cc8..0ea04fc1f4fa3 100644 --- a/ci/jobs/scripts/clickbench/filesystem_caches_path.xml +++ b/ci/jobs/scripts/clickbench/filesystem_caches_path.xml @@ -1,10 +1,13 @@ - /dev/shm/clickhouse/ /dev/shm/clickhouse/ From 1ebf3b171ac2165719ac57f195a15d21ceee46bf Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Thu, 16 Jul 2026 11:46:06 -0300 Subject: [PATCH 4/8] Fix Grype Scan: bump grype to v0.115.0 (v0.92.2 can't load current DB) Signed-off-by: CarlosFelipeOR (cherry picked from commit 3c8e750bb6e7a6a6e6bfaea68fe1ebd251acb078) (cherry picked from commit 4016b1999d3059175879ced0647001c662e90f54) Signed-off-by: CarlosFelipeOR --- .github/grype/run_grype_scan.sh | 2 +- .github/workflows/grype_scan.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/grype/run_grype_scan.sh b/.github/grype/run_grype_scan.sh index af428e37d669f..9cf99e9f9f9cb 100755 --- a/.github/grype/run_grype_scan.sh +++ b/.github/grype/run_grype_scan.sh @@ -3,7 +3,7 @@ set -e IMAGE=$1 -GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"} +GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"} docker pull $IMAGE docker pull anchore/grype:${GRYPE_VERSION} diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml index b6ac8e923bcdb..a3a4b644a3848 100644 --- a/.github/workflows/grype_scan.yml +++ b/.github/workflows/grype_scan.yml @@ -30,7 +30,7 @@ env: AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }} AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - GRYPE_VERSION: "v0.92.2-arm64v8" + GRYPE_VERSION: "v0.115.0-arm64v8" jobs: grype_scan: From ae3cd4cc28724d9e655014eeeaf9e9dd80adafac Mon Sep 17 00:00:00 2001 From: Mikhail Koviazin Date: Sat, 17 Oct 2026 21:10:09 +0200 Subject: [PATCH 5/8] Skip transaction privilege test with encrypted storage Mark `05082_kill_and_system_on_cluster_access_types` with `no-encrypted-storage`: this configuration disables transactions, so `system.transactions` is absent and the successful `KILL TRANSACTION` checks fail with `UNKNOWN_TABLE`. CI report: https://altinity-build-artifacts.s3.amazonaws.com/json.html?PR=2589&sha=25cd28d33e10b51887ff15b464c2adab26e3fe80&name_0=PR&name_1=Stateless+tests+%28amd_debug%2C+distributed+plan%2C+s3+storage%2C+parallel%29&name_2=Tests (cherry picked from commit 4980aee206c8efbe63b0077467ed1429046fbd15) Signed-off-by: CarlosFelipeOR --- .../0_stateless/05082_kill_and_system_on_cluster_access_types.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh b/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh index 9f246c25da6d2..9147c664dc395 100755 --- a/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh +++ b/tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh @@ -1,4 +1,5 @@ #!/usr/bin/env bash +# Tags: no-encrypted-storage CUR_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd) # shellcheck source=../shell_config.sh From 3a21e29a90019e3403337208219b514461738977 Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Tue, 25 Aug 2026 16:00:27 -0300 Subject: [PATCH 6/8] Give every test_s3_cluster instance a unique shard/replica pair so the database disk prefix is not shared Co-Authored-By: Claude Opus 5 (1M context) (cherry picked from commit cd1ec6368b61521b419a42cd7c2f7267d52209cd) Signed-off-by: CarlosFelipeOR --- tests/integration/test_s3_cluster/test.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/integration/test_s3_cluster/test.py b/tests/integration/test_s3_cluster/test.py index d4d91b923782a..c154b8a8529f7 100644 --- a/tests/integration/test_s3_cluster/test.py +++ b/tests/integration/test_s3_cluster/test.py @@ -125,7 +125,8 @@ def started_cluster(): "c2.s0_0_1", main_configs=["configs/cluster.xml", "configs/named_collections.xml", "configs/hidden_clusters.xml"], user_configs=["configs/users.xml"], - macros={"replica": "replica2", "shard": "shard1"}, + # Must be unique per instance: the database disk prefix is .../test-{shard}|{replica} + macros={"replica": "replica2_c2", "shard": "shard1"}, with_zookeeper=True, stay_alive=True, ) From 9893a0e696e3c198a1dc90093b349d978abe6bb7 Mon Sep 17 00:00:00 2001 From: Groene AI <270696204+groeneai@users.noreply.github.com> Date: Sun, 21 Jun 2026 21:41:33 +0000 Subject: [PATCH 7/8] Fix flaky test_storage_iceberg_concurrent (thread-pool oversubscription) test_concurrent_reads runs 25 concurrent SELECT * queries against one accumulating Iceberg table while 15 Spark writers commit in parallel, for 10 rounds. By default each SELECT fans out to ~max_threads (number of CPU cores) internal read threads, so 25 simultaneous readers request hundreds of threads at once. On a loaded CI shard this oversubscribes the global thread pool: a single SELECT either gets starved past the 300s client receive_timeout (Return code 159, seen on the asan/db-disk/old-analyzer 5/6 shard for PRs #100651 and #108049 and on master) or the server rejects the query outright with CANNOT_SCHEDULE_TASK (Code 439, threads=1000, jobs=1000). Pin max_threads=4 on the concurrent SELECT so the readers' aggregate thread demand stays bounded. This does not change what the test verifies: all 25 readers still race all 15 writers across every round and the exact row-count assertion is unchanged. Only the per-query intra-read parallelism is capped, which is irrelevant to concurrent-read snapshot consistency. Locally reproduced both directions on a debug build: pristine test fails at round 2 with CANNOT_SCHEDULE_TASK; with the cap it passes all 10 rounds (~150s). (cherry picked from commit 0ee2f261d887c675dae116d547431f544719f69a) Signed-off-by: CarlosFelipeOR --- .../test_storage_iceberg_concurrent/test_concurrent_reads.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py b/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py index 8ce061d9156af..ebd6f89268433 100644 --- a/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py +++ b/tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py @@ -39,8 +39,10 @@ def test_concurrent_reads(started_cluster_iceberg): def run_concurrent_queries(i): def select(_): + # Bound per-query fan-out so the concurrent readers don't exhaust the global thread pool. instance.query( f"SELECT * FROM {TABLE_NAME}", + settings={"max_threads": 4}, ) From bc147088918f8cfc6a74ce99758483c27ce65dbe Mon Sep 17 00:00:00 2001 From: CarlosFelipeOR Date: Tue, 20 Oct 2026 23:00:55 -0300 Subject: [PATCH 8/8] Upgrade all packages when building the alpine server and keeper images Grype Scan reports High CVEs in libssl3/libcrypto3 and zlib in both alpine images. Running `apk upgrade` at build time pulls the fixed packages, as stable-26.3 already does since #2590. Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: CarlosFelipeOR --- docker/keeper/Dockerfile | 2 ++ docker/server/Dockerfile.alpine | 2 ++ 2 files changed, 4 insertions(+) diff --git a/docker/keeper/Dockerfile b/docker/keeper/Dockerfile index aae7fe7b524f9..4926898872567 100644 --- a/docker/keeper/Dockerfile +++ b/docker/keeper/Dockerfile @@ -84,6 +84,8 @@ RUN clickhouse-keeper --version \ && chown root:clickhouse "${DEFAULT_LOG_DIR}" \ && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CONFIG_DIR}" +RUN apk update && apk upgrade --no-cache + # /var/lib/clickhouse is necessary due to the current default configuration for Keeper VOLUME "${DEFAULT_DATA_DIR}" /var/lib/clickhouse EXPOSE 2181 10181 44444 9181 diff --git a/docker/server/Dockerfile.alpine b/docker/server/Dockerfile.alpine index 4eb936f3c8e7b..c35cbc4e0db1d 100644 --- a/docker/server/Dockerfile.alpine +++ b/docker/server/Dockerfile.alpine @@ -89,6 +89,8 @@ RUN mkdir -p \ && chown root:clickhouse "${DEFAULT_LOG_DIR}" \ && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CLIENT_CONFIG_DIR}" "${DEFAULT_SERVER_CONFIG_DIR}" +RUN apk update && apk upgrade --no-cache + VOLUME "${DEFAULT_DATA_DIR}" EXPOSE 9000 8123 9009