3 files changed, 59 insertions, 7 deletions
diff --git a/internal/workflows/doc.go b/internal/workflows/doc.go
index 0c7e94b9..e34c59c8 100644
--- a/internal/workflows/doc.go
+++ b/internal/workflows/doc.go
@@ -47,6 +47,7 @@ The container can be specified via docker-compose:
 	  runner:
 	    restart: always
 	    image: docker.io/gitea/act_runner:nightly
+	    network_mode: host
 	    environment:
 	      CONFIG_FILE: /config.yaml
 	      GITEA_INSTANCE_URL: "https://git.gensokyo.uk"
@@ -62,17 +63,21 @@ The container can be specified via docker-compose:
 Before starting the container, configure act_runner via config.yaml:
 
 	container:
-	  network: host
 	  options: -e PAGER=cat -e MBF_CACHE_DIR=/rosa -e MBF_POISON_OPEN=1
 	    -v /var/lib/rosa:/rosa
+	    --security-opt='unmask=/proc/*'
+	    --cap-add=SYS_ADMIN
 	    --device=/dev/kvm
+	    --device=/dev/fuse
 	  valid_volumes:
 	  - /var/lib/rosa
 
 where /var/lib/rosa is the absolute pathname of the cache directory in the init
 namespace. Setting MBF_POISON_OPEN enables cmd/mbf to run as root. It is also
 a good idea here to set runner.capacity to reflect the capacity of the guest, so
-jobs can be consumed quicker.
+jobs can be consumed quicker. Removing mount points covering /proc enables
+testing of cmd/hakurei. Exposing the fuse device and adding capability SYS_ADMIN
+enables testing of cmd/sharefs.
 
 Build a statically-linked cmd/mbf:
 
diff --git a/internal/workflows/step.go b/internal/workflows/step.go
index 423a48ff..219ed78b 100644
--- a/internal/workflows/step.go
+++ b/internal/workflows/step.go
@@ -12,6 +12,16 @@ var fixup = Step{
 // checkout is the standard actions/checkout step.
 var checkout = Step{Name: "Checkout", Uses: "actions/checkout@v4"}
 
+// toolchain is a step for setting up the Go toolchain.
+var toolchain = Step{
+	Name: "Set up Go toolchain",
+	Uses: "actions/setup-go@v6",
+
+	With: []KV[any]{
+		{"go-version-file", "go.mod"},
+	},
+}
+
 // newUploadArtifact returns an actions/upload-artifact step uploading
 // everything in the result directory as the specified name.
 func newUploadArtifact(display, name string) Step {
@@ -33,13 +43,23 @@ func newCIRequest(display, name, id string) Step {
 	return Step{
 		Name: "Request " + display,
 		ID:   id,
-		Run: "export HAKUREI_REV=\"$(git rev-parse --short HEAD)\" && " +
+		Run: "HAKUREI_REV=\"$(git rev-parse --short HEAD)\" && " +
 			"/rosa/bin/mbf ci " + name + " " +
 			". \"$(cat cmd/dist/VERSION)-$HAKUREI_REV\" && " +
 			"echo \"rev=$HAKUREI_REV\" >> \"$GITHUB_OUTPUT\"",
 	}
 }
 
+// install is a step to unpack and deploy a hakurei distribution created by a
+// step with identifier dist.
+var install = Step{
+	Name: "Install hakurei",
+	Run: "HAKUREI_VERSION=\"$(cat cmd/dist/VERSION)-${{ steps.dist.outputs.rev }}\" && " +
+		"tar xf \"result/hakurei-$HAKUREI_VERSION-amd64.tar.gz\" && " +
+		"\"./hakurei-$HAKUREI_VERSION-amd64/install.sh\" && " +
+		"sudo -u ubuntu hakurei version",
+}
+
 // newNixOSTest returns a step for running the named NixOS test.
 func newNixOSTest(name string) Step {
 	return Step{
diff --git a/internal/workflows/test.go b/internal/workflows/test.go
index 88e91a22..28307b53 100644
--- a/internal/workflows/test.go
+++ b/internal/workflows/test.go
@@ -53,12 +53,40 @@ var _ = (&Workflow{
 
 		{"sharefs", Job{
 			Name: "ShareFS",
-			On:   "nix",
+			On:   "rosa",
 
 			Steps: []Step{
+				fixup,
 				checkout,
-				newNixOSTest("sharefs"),
-				newUploadArtifact("test output", "sharefs-vm-output"),
+				toolchain,
+
+				{
+					Name: "install fuse and fs_mark",
+					Run:  "apt-get update && apt-get install -y fuse3 fsmark",
+				},
+
+				newCIRequest("distribution", "dist -o result", "dist"),
+				install,
+
+				{
+					Name: "Mount sharefs",
+					Run: "useradd " +
+						"-ru 1023 " +
+						"-md /var/lib/sdcard " +
+						"-k /var/empty " +
+						"-s /sbin/nologin " +
+						"media_rw && install -dm0 /sdcard && " +
+						"sharefs " +
+						"-o rw,noexec,nosuid,nodev,noatime," +
+						"allow_other,mkdir,source=/var/lib/sdcard," +
+						"setuid=1023,setgid=1023 /sdcard",
+				},
+
+				{
+					Name: "Compile and run test suite",
+					Run: "sharefs -V && rm -rf result && " +
+						"go run -tags=testsuite ./test/sharefs ubuntu",
+				},
 			},
 		}},
 
@@ -71,7 +99,6 @@ var _ = (&Workflow{
 				"race",
 				"sandbox",
 				"sandbox-race",
-				"sharefs",
 			},
 
 			Steps: []Step{