|
@@ -31,7 +31,7 @@ import (
|
|
|
)
|
|
|
|
|
|
// #6509
|
|
|
-func (s *DockerSuite) TestRunRedirectStdout(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunRedirectStdout(c *testing.T) {
|
|
|
checkRedirect := func(command string) {
|
|
|
_, tty, err := pty.Open()
|
|
|
assert.Assert(c, err == nil, "Could not open pty")
|
|
@@ -59,7 +59,7 @@ func (s *DockerSuite) TestRunRedirectStdout(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// Test recursive bind mount works by default
|
|
|
-func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
|
|
|
// /tmp gets permission denied
|
|
|
testRequires(c, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
tmpDir, err := os.MkdirTemp("", "docker_recursive_mount_test")
|
|
@@ -80,7 +80,7 @@ func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, filepath.Base(f.Name())), "Recursive bind mount test failed. Expected file not found")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunDeviceDirectory(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunDeviceDirectory(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
|
|
|
if _, err := os.Stat("/dev/snd"); err != nil {
|
|
|
c.Skip("Host does not have /dev/snd")
|
|
@@ -93,7 +93,7 @@ func (s *DockerSuite) TestRunDeviceDirectory(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetach checks attaching and detaching with the default escape sequence.
|
|
|
-func (s *DockerSuite) TestRunAttachDetach(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachDetach(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
|
|
|
dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
|
|
@@ -144,7 +144,7 @@ func (s *DockerSuite) TestRunAttachDetach(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromFlag checks attaching and detaching with the escape sequence specified via flags.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromFlag(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachDetachFromFlag(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
@@ -205,7 +205,7 @@ func (s *DockerSuite) TestRunAttachDetachFromFlag(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromInvalidFlag checks attaching and detaching with the escape sequence specified via flags.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachDetachFromInvalidFlag(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
dockerCmd(c, "run", "--name", name, "-itd", "busybox", "top")
|
|
|
assert.Assert(c, waitRun(name) == nil)
|
|
@@ -238,7 +238,7 @@ func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromConfig checks attaching and detaching with the escape sequence specified via config file.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromConfig(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachDetachFromConfig(c *testing.T) {
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
|
|
|
@@ -318,7 +318,7 @@ func (s *DockerSuite) TestRunAttachDetachFromConfig(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachKeysOverrideConfig checks attaching and detaching with the detach flags, making sure it overrides config file
|
|
|
-func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T) {
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
|
|
|
@@ -397,7 +397,7 @@ func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T) {
|
|
|
assert.Equal(c, running, "true", "expected container to still be running")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
keyA := []byte{97}
|
|
|
keyB := []byte{98}
|
|
@@ -448,7 +448,7 @@ func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *testing.
|
|
|
}
|
|
|
|
|
|
// "test" should be printed
|
|
|
-func (s *DockerSuite) TestRunWithCPUQuota(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithCPUQuota(c *testing.T) {
|
|
|
testRequires(c, cpuCfsQuota)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
|
|
@@ -459,7 +459,7 @@ func (s *DockerSuite) TestRunWithCPUQuota(c *testing.T) {
|
|
|
assert.Equal(c, out, "8000", "setting the CPU CFS quota failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpuPeriod(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithCpuPeriod(c *testing.T) {
|
|
|
testRequires(c, cpuCfsPeriod)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
|
|
@@ -473,7 +473,7 @@ func (s *DockerSuite) TestRunWithCpuPeriod(c *testing.T) {
|
|
|
assert.Equal(c, out, "50000", "setting the CPU CFS period failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidCpuPeriod(c *testing.T) {
|
|
|
testRequires(c, cpuCfsPeriod)
|
|
|
out, _, err := dockerCmdWithError("run", "--cpu-period", "900", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
@@ -489,7 +489,7 @@ func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCPUShares(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithCPUShares(c *testing.T) {
|
|
|
testRequires(c, cpuShare)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.shares"
|
|
@@ -501,7 +501,7 @@ func (s *DockerSuite) TestRunWithCPUShares(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// "test" should be printed
|
|
|
-func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, cpuShare)
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
cli.DockerCmd(c, "run", "--cpu-shares", "1000", "-m", "32m", "busybox", "echo", "test").Assert(c, icmd.Expected{
|
|
@@ -509,7 +509,7 @@ func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *testing.T)
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpusetCpus(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithCpusetCpus(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpuset/cpuset.cpus"
|
|
@@ -520,7 +520,7 @@ func (s *DockerSuite) TestRunWithCpusetCpus(c *testing.T) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpusetMems(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithCpusetMems(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpuset/cpuset.mems"
|
|
@@ -531,7 +531,7 @@ func (s *DockerSuite) TestRunWithCpusetMems(c *testing.T) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithBlkioWeight(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithBlkioWeight(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
|
|
|
file := "/sys/fs/cgroup/blkio/blkio.weight"
|
|
@@ -542,7 +542,7 @@ func (s *DockerSuite) TestRunWithBlkioWeight(c *testing.T) {
|
|
|
assert.Equal(c, out, "300")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidBlkioWeight(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--blkio-weight", "5", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
@@ -550,37 +550,37 @@ func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioWeightDevice(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidPathforBlkioWeightDevice(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--blkio-weight-device", "/dev/sdX:100", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadBps(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidPathforBlkioDeviceReadBps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-read-bps", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteBps(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidPathforBlkioDeviceWriteBps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-write-bps", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadIOps(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidPathforBlkioDeviceReadIOps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-read-iops", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteIOps(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithInvalidPathforBlkioDeviceWriteIOps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-write-iops", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunOOMExitCode(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunOOMExitCode(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport, swapMemorySupport, NotPpc64le)
|
|
|
errChan := make(chan error, 1)
|
|
|
go func() {
|
|
@@ -600,7 +600,7 @@ func (s *DockerSuite) TestRunOOMExitCode(c *testing.T) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryLimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
|
|
|
file := "/sys/fs/cgroup/memory/memory.limit_in_bytes"
|
|
@@ -616,14 +616,14 @@ func (s *DockerSuite) TestRunWithMemoryLimit(c *testing.T) {
|
|
|
// memory limit, this means the processes in the container can use
|
|
|
// 16M memory and as much swap memory as they need (if the host
|
|
|
// supports swap memory).
|
|
|
-func (s *DockerSuite) TestRunWithoutMemoryswapLimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithoutMemoryswapLimit(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, swapMemorySupport)
|
|
|
dockerCmd(c, "run", "-m", "32m", "--memory-swap", "-1", "busybox", "true")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithSwappiness(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithSwappiness(c *testing.T) {
|
|
|
testRequires(c, memorySwappinessSupport)
|
|
|
file := "/sys/fs/cgroup/memory/memory.swappiness"
|
|
|
out, _ := dockerCmd(c, "run", "--memory-swappiness", "0", "--name", "test", "busybox", "cat", file)
|
|
@@ -633,7 +633,7 @@ func (s *DockerSuite) TestRunWithSwappiness(c *testing.T) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithSwappinessInvalid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithSwappinessInvalid(c *testing.T) {
|
|
|
testRequires(c, memorySwappinessSupport)
|
|
|
out, _, err := dockerCmdWithError("run", "--memory-swappiness", "101", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
@@ -644,7 +644,7 @@ func (s *DockerSuite) TestRunWithSwappinessInvalid(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected), "Expected output to contain %q, not %q", out, expected)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryReservation(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithMemoryReservation(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
|
|
|
|
|
|
file := "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes"
|
|
@@ -655,7 +655,7 @@ func (s *DockerSuite) TestRunWithMemoryReservation(c *testing.T) {
|
|
|
assert.Equal(c, out, "209715200")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithMemoryReservationInvalid(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
|
|
|
out, _, err := dockerCmdWithError("run", "-m", "500M", "--memory-reservation", "800M", "busybox", "true")
|
|
@@ -668,7 +668,7 @@ func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(strings.TrimSpace(out), expected), "run container should fail with invalid memory reservation")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestStopContainerSignal(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestStopContainerSignal(c *testing.T) {
|
|
|
out, _ := dockerCmd(c, "run", "--stop-signal", "SIGUSR1", "-d", "busybox", "/bin/sh", "-c", `trap 'echo "exit trapped"; exit 0' USR1; while true; do sleep 1; done`)
|
|
|
containerID := strings.TrimSpace(out)
|
|
|
|
|
@@ -680,7 +680,7 @@ func (s *DockerSuite) TestStopContainerSignal(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, "exit trapped"), "Expected `exit trapped` in the log")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSwapLessThanMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, swapMemorySupport)
|
|
|
out, _, err := dockerCmdWithError("run", "-m", "16m", "--memory-swap", "15m", "busybox", "echo", "test")
|
|
@@ -690,7 +690,7 @@ func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunInvalidCpusetCpusFlagValue(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset, testEnv.IsLocalDaemon)
|
|
|
|
|
|
sysInfo := sysinfo.New()
|
|
@@ -709,7 +709,7 @@ func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunInvalidCpusetMemsFlagValue(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
sysInfo := sysinfo.New()
|
|
@@ -728,7 +728,7 @@ func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCPUShares(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunInvalidCPUShares(c *testing.T) {
|
|
|
testRequires(c, cpuShare, DaemonIsLinux)
|
|
|
out, _, err := dockerCmdWithError("run", "--cpu-shares", "1", "busybox", "echo", "test")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
@@ -746,7 +746,7 @@ func (s *DockerSuite) TestRunInvalidCPUShares(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithDefaultShmSize(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithDefaultShmSize(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
name := "shm-default"
|
|
@@ -759,7 +759,7 @@ func (s *DockerSuite) TestRunWithDefaultShmSize(c *testing.T) {
|
|
|
assert.Equal(c, shmSize, "67108864")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithShmSize(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithShmSize(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
name := "shm"
|
|
@@ -772,7 +772,7 @@ func (s *DockerSuite) TestRunWithShmSize(c *testing.T) {
|
|
|
assert.Equal(c, shmSize, "1073741824")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsEnsureOrdered(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunTmpfsMountsEnsureOrdered(c *testing.T) {
|
|
|
tmpFile, err := os.CreateTemp("", "test")
|
|
|
assert.NilError(c, err)
|
|
|
defer tmpFile.Close()
|
|
@@ -780,7 +780,7 @@ func (s *DockerSuite) TestRunTmpfsMountsEnsureOrdered(c *testing.T) {
|
|
|
assert.Assert(c, strings.Contains(out, "test"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMounts(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunTmpfsMounts(c *testing.T) {
|
|
|
// TODO Windows (Post TP5): This test cannot run on a Windows daemon as
|
|
|
// Windows does not support tmpfs mounts.
|
|
|
testRequires(c, DaemonIsLinux)
|
|
@@ -801,7 +801,7 @@ func (s *DockerSuite) TestRunTmpfsMounts(c *testing.T) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunTmpfsMountsOverrideImageVolumes(c *testing.T) {
|
|
|
name := "img-with-volumes"
|
|
|
buildImageSuccessfully(c, name, build.WithDockerfile(`
|
|
|
FROM busybox
|
|
@@ -813,7 +813,7 @@ func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// Test case for #22420
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
expectedOptions := []string{"rw", "nosuid", "nodev", "noexec", "relatime"}
|
|
@@ -851,7 +851,7 @@ func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSysctls(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSysctls(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
var err error
|
|
|
|
|
@@ -882,7 +882,7 @@ func (s *DockerSuite) TestRunSysctls(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:bullseye-slim unshare' exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
|
|
|
jsonData := `{
|
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
@@ -911,7 +911,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompProfileDenyChmod checks that 'docker run --security-opt seccomp=/tmp/profile.json busybox chmod 400 /etc/hostname' exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
jsonData := `{
|
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
@@ -946,7 +946,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
|
|
|
|
|
|
// TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:bullseye-slim unshare --map-root-user --user sh -c whoami' with a specific profile to
|
|
|
// deny unshare of a userns exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
|
|
|
// from sched.h
|
|
|
jsonData := fmt.Sprintf(`{
|
|
@@ -984,7 +984,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T) {
|
|
|
|
|
|
// TestRunSeccompProfileDenyCloneUserns checks that 'docker run syscall-test'
|
|
|
// with a the default seccomp profile exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompProfileDenyCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -996,7 +996,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *testing.T) {
|
|
|
|
|
|
// TestRunSeccompUnconfinedCloneUserns checks that
|
|
|
// 'docker run --security-opt seccomp=unconfined syscall-test' allows creating a userns.
|
|
|
-func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompUnconfinedCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace, unprivilegedUsernsClone)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1009,7 +1009,7 @@ func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *testing.T) {
|
|
|
|
|
|
// TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged syscall-test'
|
|
|
// allows creating a userns.
|
|
|
-func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompAllowPrivCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1021,7 +1021,7 @@ func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *testing.T) {
|
|
|
|
|
|
// TestRunSeccompProfileAllow32Bit checks that 32 bit code can run on x86_64
|
|
|
// with the default seccomp profile.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompProfileAllow32Bit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, IsAmd64)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1029,14 +1029,14 @@ func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompAllowSetrlimit checks that 'docker run debian:bullseye-slim ulimit -v 1048510' succeeds.
|
|
|
-func (s *DockerSuite) TestRunSeccompAllowSetrlimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompAllowSetrlimit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
|
|
|
// ulimit uses setrlimit, so we want to make sure we don't break it
|
|
|
icmd.RunCommand(dockerBinary, "run", "debian:bullseye-slim", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompDefaultProfileAcct(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1066,7 +1066,7 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *testing.T) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompDefaultProfileNS(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1103,7 +1103,7 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *testing.T) {
|
|
|
|
|
|
// TestRunNoNewPrivSetuid checks that --security-opt='no-new-privileges=true' prevents
|
|
|
// effective uid transitions on executing setuid binaries.
|
|
|
-func (s *DockerSuite) TestRunNoNewPrivSetuid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunNoNewPrivSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureNNPTest(c)
|
|
|
|
|
@@ -1116,7 +1116,7 @@ func (s *DockerSuite) TestRunNoNewPrivSetuid(c *testing.T) {
|
|
|
|
|
|
// TestLegacyRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents
|
|
|
// effective uid transitions on executing setuid binaries.
|
|
|
-func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestLegacyRunNoNewPrivSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureNNPTest(c)
|
|
|
|
|
@@ -1127,7 +1127,7 @@ func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesChown(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1145,7 +1145,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1158,7 +1158,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesFowner(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1174,7 +1174,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *testing.T) {
|
|
|
|
|
|
// TODO CAP_KILL
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1192,7 +1192,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesSetgid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1220,7 +1220,7 @@ func sysctlExists(s string) bool {
|
|
|
return err == nil
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1249,7 +1249,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *testing.T
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1267,7 +1267,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesChroot(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1285,7 +1285,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *testing.T) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestUserNoEffectiveCapabilitiesMknod(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1307,7 +1307,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *testing.T) {
|
|
|
// TODO CAP_AUDIT_WRITE
|
|
|
// TODO CAP_SETFCAP
|
|
|
|
|
|
-func (s *DockerSuite) TestRunApparmorProcDirectory(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunApparmorProcDirectory(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, Apparmor)
|
|
|
|
|
|
// running w seccomp unconfined tests the apparmor profile
|
|
@@ -1326,7 +1326,7 @@ func (s *DockerSuite) TestRunApparmorProcDirectory(c *testing.T) {
|
|
|
|
|
|
// make sure the default profile can be successfully parsed (using unshare as it is
|
|
|
// something which we know is blocked in the default profile)
|
|
|
-func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
|
|
|
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:bullseye-slim", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
|
|
@@ -1335,7 +1335,7 @@ func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunDeviceSymlink checks run with device that follows symlink (#13840 and #22271)
|
|
|
-func (s *DockerSuite) TestRunDeviceSymlink(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunDeviceSymlink(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm, testEnv.IsLocalDaemon)
|
|
|
if _, err := os.Stat("/dev/zero"); err != nil {
|
|
|
c.Skip("Host does not have /dev/zero")
|
|
@@ -1382,7 +1382,7 @@ func (s *DockerSuite) TestRunDeviceSymlink(c *testing.T) {
|
|
|
}
|
|
|
|
|
|
// TestRunPIDsLimit makes sure the pids cgroup is set with --pids-limit
|
|
|
-func (s *DockerSuite) TestRunPIDsLimit(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunPIDsLimit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, pidsLimit)
|
|
|
|
|
|
file := "/sys/fs/cgroup/pids/pids.max"
|
|
@@ -1393,7 +1393,7 @@ func (s *DockerSuite) TestRunPIDsLimit(c *testing.T) {
|
|
|
assert.Equal(c, out, "4", "setting the pids limit failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunPrivilegedAllowedDevices(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace)
|
|
|
|
|
|
file := "/sys/fs/cgroup/devices/devices.list"
|
|
@@ -1402,7 +1402,7 @@ func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *testing.T) {
|
|
|
assert.Equal(c, strings.TrimSpace(out), "a *:* rwm")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunUserDeviceAllowed(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunUserDeviceAllowed(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
fi, err := os.Stat("/dev/snd/timer")
|
|
@@ -1543,7 +1543,7 @@ func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *testing.T)
|
|
|
assert.Assert(c, strings.Contains(out, "Operation not permitted"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithNanoCPUs(c *testing.T) {
|
|
|
+func (s *DockerCLIRunSuite) TestRunWithNanoCPUs(c *testing.T) {
|
|
|
testRequires(c, cpuCfsQuota, cpuCfsPeriod)
|
|
|
|
|
|
file1 := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
|