|
@@ -15,27 +15,26 @@ import (
|
|
|
"strconv"
|
|
|
"strings"
|
|
|
"syscall"
|
|
|
+ "testing"
|
|
|
"time"
|
|
|
|
|
|
"github.com/creack/pty"
|
|
|
"github.com/docker/docker/client"
|
|
|
- "github.com/docker/docker/integration-cli/checker"
|
|
|
"github.com/docker/docker/integration-cli/cli"
|
|
|
"github.com/docker/docker/integration-cli/cli/build"
|
|
|
"github.com/docker/docker/pkg/homedir"
|
|
|
"github.com/docker/docker/pkg/mount"
|
|
|
"github.com/docker/docker/pkg/parsers"
|
|
|
"github.com/docker/docker/pkg/sysinfo"
|
|
|
- "github.com/go-check/check"
|
|
|
"gotest.tools/assert"
|
|
|
"gotest.tools/icmd"
|
|
|
)
|
|
|
|
|
|
// #6509
|
|
|
-func (s *DockerSuite) TestRunRedirectStdout(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunRedirectStdout(c *testing.T) {
|
|
|
checkRedirect := func(command string) {
|
|
|
_, tty, err := pty.Open()
|
|
|
- c.Assert(err, checker.IsNil, check.Commentf("Could not open pty"))
|
|
|
+ assert.Assert(c, err == nil, "Could not open pty")
|
|
|
cmd := exec.Command("sh", "-c", command)
|
|
|
cmd.Stdin = tty
|
|
|
cmd.Stdout = tty
|
|
@@ -51,7 +50,7 @@ func (s *DockerSuite) TestRunRedirectStdout(c *check.C) {
|
|
|
case <-time.After(10 * time.Second):
|
|
|
c.Fatal("command timeout")
|
|
|
case err := <-ch:
|
|
|
- c.Assert(err, checker.IsNil, check.Commentf("wait err"))
|
|
|
+ assert.Assert(c, err == nil, "wait err")
|
|
|
}
|
|
|
}
|
|
|
|
|
@@ -60,7 +59,7 @@ func (s *DockerSuite) TestRunRedirectStdout(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// Test recursive bind mount works by default
|
|
|
-func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *testing.T) {
|
|
|
// /tmp gets permission denied
|
|
|
testRequires(c, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
tmpDir, err := ioutil.TempDir("", "docker_recursive_mount_test")
|
|
@@ -70,32 +69,31 @@ func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *check.C) {
|
|
|
|
|
|
// Create a temporary tmpfs mount.
|
|
|
tmpfsDir := filepath.Join(tmpDir, "tmpfs")
|
|
|
- c.Assert(os.MkdirAll(tmpfsDir, 0777), checker.IsNil, check.Commentf("failed to mkdir at %s", tmpfsDir))
|
|
|
- c.Assert(mount.Mount("tmpfs", tmpfsDir, "tmpfs", ""), checker.IsNil, check.Commentf("failed to create a tmpfs mount at %s", tmpfsDir))
|
|
|
+ assert.Assert(c, os.MkdirAll(tmpfsDir, 0777) == nil, "failed to mkdir at %s", tmpfsDir)
|
|
|
+ assert.Assert(c, mount.Mount("tmpfs", tmpfsDir, "tmpfs", "") == nil, "failed to create a tmpfs mount at %s", tmpfsDir)
|
|
|
|
|
|
f, err := ioutil.TempFile(tmpfsDir, "touch-me")
|
|
|
assert.NilError(c, err)
|
|
|
defer f.Close()
|
|
|
|
|
|
out, _ := dockerCmd(c, "run", "--name", "test-data", "--volume", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox:latest", "ls", "/tmp/tmpfs")
|
|
|
- c.Assert(out, checker.Contains, filepath.Base(f.Name()), check.Commentf("Recursive bind mount test failed. Expected file not found"))
|
|
|
+ assert.Assert(c, strings.Contains(out, filepath.Base(f.Name())), "Recursive bind mount test failed. Expected file not found")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunDeviceDirectory(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunDeviceDirectory(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
|
|
|
if _, err := os.Stat("/dev/snd"); err != nil {
|
|
|
c.Skip("Host does not have /dev/snd")
|
|
|
}
|
|
|
|
|
|
out, _ := dockerCmd(c, "run", "--device", "/dev/snd:/dev/snd", "busybox", "sh", "-c", "ls /dev/snd/")
|
|
|
- c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "timer", check.Commentf("expected output /dev/snd/timer"))
|
|
|
-
|
|
|
+ assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "timer"), "expected output /dev/snd/timer")
|
|
|
out, _ = dockerCmd(c, "run", "--device", "/dev/snd:/dev/othersnd", "busybox", "sh", "-c", "ls /dev/othersnd/")
|
|
|
- c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "seq", check.Commentf("expected output /dev/othersnd/seq"))
|
|
|
+ assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "seq"), "expected output /dev/othersnd/seq")
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetach checks attaching and detaching with the default escape sequence.
|
|
|
-func (s *DockerSuite) TestRunAttachDetach(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachDetach(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
|
|
|
dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat")
|
|
@@ -108,7 +106,7 @@ func (s *DockerSuite) TestRunAttachDetach(c *check.C) {
|
|
|
defer cpty.Close()
|
|
|
cmd.Stdin = tty
|
|
|
assert.NilError(c, cmd.Start())
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
_, err = cpty.Write([]byte("hello\n"))
|
|
|
assert.NilError(c, err)
|
|
@@ -137,16 +135,16 @@ func (s *DockerSuite) TestRunAttachDetach(c *check.C) {
|
|
|
}
|
|
|
|
|
|
running := inspectField(c, name, "State.Running")
|
|
|
- c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
|
|
|
+ assert.Equal(c, running, "true", "expected container to still be running")
|
|
|
|
|
|
out, _ = dockerCmd(c, "events", "--since=0", "--until", daemonUnixTime(c), "-f", "container="+name)
|
|
|
// attach and detach event should be monitored
|
|
|
- c.Assert(out, checker.Contains, "attach")
|
|
|
- c.Assert(out, checker.Contains, "detach")
|
|
|
+ assert.Assert(c, strings.Contains(out, "attach"))
|
|
|
+ assert.Assert(c, strings.Contains(out, "detach"))
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromFlag checks attaching and detaching with the escape sequence specified via flags.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromFlag(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachDetachFromFlag(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
@@ -167,7 +165,7 @@ func (s *DockerSuite) TestRunAttachDetachFromFlag(c *check.C) {
|
|
|
if err := cmd.Start(); err != nil {
|
|
|
c.Fatal(err)
|
|
|
}
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
if _, err := cpty.Write([]byte("hello\n")); err != nil {
|
|
|
c.Fatal(err)
|
|
@@ -203,14 +201,14 @@ func (s *DockerSuite) TestRunAttachDetachFromFlag(c *check.C) {
|
|
|
}
|
|
|
|
|
|
running := inspectField(c, name, "State.Running")
|
|
|
- c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
|
|
|
+ assert.Equal(c, running, "true", "expected container to still be running")
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromInvalidFlag checks attaching and detaching with the escape sequence specified via flags.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
dockerCmd(c, "run", "--name", name, "-itd", "busybox", "top")
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
// specify an invalid detach key, container will ignore it and use default
|
|
|
cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-A,a", name)
|
|
@@ -240,7 +238,7 @@ func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachFromConfig checks attaching and detaching with the escape sequence specified via config file.
|
|
|
-func (s *DockerSuite) TestRunAttachDetachFromConfig(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachDetachFromConfig(c *testing.T) {
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
|
|
|
@@ -283,7 +281,7 @@ func (s *DockerSuite) TestRunAttachDetachFromConfig(c *check.C) {
|
|
|
if err := cmd.Start(); err != nil {
|
|
|
c.Fatal(err)
|
|
|
}
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
if _, err := cpty.Write([]byte("hello\n")); err != nil {
|
|
|
c.Fatal(err)
|
|
@@ -319,11 +317,11 @@ func (s *DockerSuite) TestRunAttachDetachFromConfig(c *check.C) {
|
|
|
}
|
|
|
|
|
|
running := inspectField(c, name, "State.Running")
|
|
|
- c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
|
|
|
+ assert.Equal(c, running, "true", "expected container to still be running")
|
|
|
}
|
|
|
|
|
|
// TestRunAttachDetachKeysOverrideConfig checks attaching and detaching with the detach flags, making sure it overrides config file
|
|
|
-func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *testing.T) {
|
|
|
keyCtrlA := []byte{1}
|
|
|
keyA := []byte{97}
|
|
|
|
|
@@ -366,7 +364,7 @@ func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *check.C) {
|
|
|
if err := cmd.Start(); err != nil {
|
|
|
c.Fatal(err)
|
|
|
}
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
if _, err := cpty.Write([]byte("hello\n")); err != nil {
|
|
|
c.Fatal(err)
|
|
@@ -402,10 +400,10 @@ func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *check.C) {
|
|
|
}
|
|
|
|
|
|
running := inspectField(c, name, "State.Running")
|
|
|
- c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running"))
|
|
|
+ assert.Equal(c, running, "true", "expected container to still be running")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *testing.T) {
|
|
|
name := "attach-detach"
|
|
|
keyA := []byte{97}
|
|
|
keyB := []byte{98}
|
|
@@ -427,7 +425,7 @@ func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *check.C)
|
|
|
c.Fatal(err)
|
|
|
}
|
|
|
go cmd.Wait()
|
|
|
- c.Assert(waitRun(name), check.IsNil)
|
|
|
+ assert.Assert(c, waitRun(name) == nil)
|
|
|
|
|
|
// Invalid escape sequence aba, should print aba in output
|
|
|
if _, err := cpty.Write(keyA); err != nil {
|
|
@@ -456,7 +454,7 @@ func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *check.C)
|
|
|
}
|
|
|
|
|
|
// "test" should be printed
|
|
|
-func (s *DockerSuite) TestRunWithCPUQuota(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithCPUQuota(c *testing.T) {
|
|
|
testRequires(c, cpuCfsQuota)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
|
|
@@ -467,7 +465,7 @@ func (s *DockerSuite) TestRunWithCPUQuota(c *check.C) {
|
|
|
assert.Equal(c, out, "8000", "setting the CPU CFS quota failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpuPeriod(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithCpuPeriod(c *testing.T) {
|
|
|
testRequires(c, cpuCfsPeriod)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.cfs_period_us"
|
|
@@ -481,7 +479,7 @@ func (s *DockerSuite) TestRunWithCpuPeriod(c *check.C) {
|
|
|
assert.Equal(c, out, "50000", "setting the CPU CFS period failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *testing.T) {
|
|
|
testRequires(c, cpuCfsPeriod)
|
|
|
out, _, err := dockerCmdWithError("run", "--cpu-period", "900", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
@@ -497,7 +495,7 @@ func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithKernelMemory(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithKernelMemory(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, kernelMemorySupport)
|
|
|
|
|
|
file := "/sys/fs/cgroup/memory/memory.kmem.limit_in_bytes"
|
|
@@ -510,7 +508,7 @@ func (s *DockerSuite) TestRunWithKernelMemory(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidKernelMemory(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidKernelMemory(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, kernelMemorySupport)
|
|
|
|
|
|
out, _, err := dockerCmdWithError("run", "--kernel-memory", "2M", "busybox", "true")
|
|
@@ -524,7 +522,7 @@ func (s *DockerSuite) TestRunWithInvalidKernelMemory(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCPUShares(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithCPUShares(c *testing.T) {
|
|
|
testRequires(c, cpuShare)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpu/cpu.shares"
|
|
@@ -536,7 +534,7 @@ func (s *DockerSuite) TestRunWithCPUShares(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// "test" should be printed
|
|
|
-func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, cpuShare)
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
cli.DockerCmd(c, "run", "--cpu-shares", "1000", "-m", "32m", "busybox", "echo", "test").Assert(c, icmd.Expected{
|
|
@@ -544,7 +542,7 @@ func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpusetCpus(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithCpusetCpus(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpuset/cpuset.cpus"
|
|
@@ -555,7 +553,7 @@ func (s *DockerSuite) TestRunWithCpusetCpus(c *check.C) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithCpusetMems(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithCpusetMems(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
file := "/sys/fs/cgroup/cpuset/cpuset.mems"
|
|
@@ -566,7 +564,7 @@ func (s *DockerSuite) TestRunWithCpusetMems(c *check.C) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithBlkioWeight(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithBlkioWeight(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
|
|
|
file := "/sys/fs/cgroup/blkio/blkio.weight"
|
|
@@ -577,7 +575,7 @@ func (s *DockerSuite) TestRunWithBlkioWeight(c *check.C) {
|
|
|
assert.Equal(c, out, "300")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--blkio-weight", "5", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
@@ -585,37 +583,37 @@ func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioWeightDevice(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidPathforBlkioWeightDevice(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--blkio-weight-device", "/dev/sdX:100", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadBps(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadBps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-read-bps", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteBps(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteBps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-write-bps", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadIOps(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadIOps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-read-iops", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteIOps(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteIOps(c *testing.T) {
|
|
|
testRequires(c, blkioWeight)
|
|
|
out, _, err := dockerCmdWithError("run", "--device-write-iops", "/dev/sdX:500", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunOOMExitCode(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunOOMExitCode(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport, swapMemorySupport, NotPpc64le)
|
|
|
errChan := make(chan error)
|
|
|
go func() {
|
|
@@ -635,7 +633,7 @@ func (s *DockerSuite) TestRunOOMExitCode(c *check.C) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryLimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
|
|
|
file := "/sys/fs/cgroup/memory/memory.limit_in_bytes"
|
|
@@ -651,14 +649,14 @@ func (s *DockerSuite) TestRunWithMemoryLimit(c *check.C) {
|
|
|
// memory limit, this means the processes in the container can use
|
|
|
// 16M memory and as much swap memory as they need (if the host
|
|
|
// supports swap memory).
|
|
|
-func (s *DockerSuite) TestRunWithoutMemoryswapLimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithoutMemoryswapLimit(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, swapMemorySupport)
|
|
|
dockerCmd(c, "run", "-m", "32m", "--memory-swap", "-1", "busybox", "true")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithSwappiness(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithSwappiness(c *testing.T) {
|
|
|
testRequires(c, memorySwappinessSupport)
|
|
|
file := "/sys/fs/cgroup/memory/memory.swappiness"
|
|
|
out, _ := dockerCmd(c, "run", "--memory-swappiness", "0", "--name", "test", "busybox", "cat", file)
|
|
@@ -668,19 +666,18 @@ func (s *DockerSuite) TestRunWithSwappiness(c *check.C) {
|
|
|
assert.Equal(c, out, "0")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithSwappinessInvalid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithSwappinessInvalid(c *testing.T) {
|
|
|
testRequires(c, memorySwappinessSupport)
|
|
|
out, _, err := dockerCmdWithError("run", "--memory-swappiness", "101", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
expected := "Valid memory swappiness range is 0-100"
|
|
|
- c.Assert(out, checker.Contains, expected, check.Commentf("Expected output to contain %q, not %q", out, expected))
|
|
|
-
|
|
|
+ assert.Assert(c, strings.Contains(out, expected), "Expected output to contain %q, not %q", out, expected)
|
|
|
out, _, err = dockerCmdWithError("run", "--memory-swappiness", "-10", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, expected, check.Commentf("Expected output to contain %q, not %q", out, expected))
|
|
|
+ assert.Assert(c, strings.Contains(out, expected), "Expected output to contain %q, not %q", out, expected)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryReservation(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithMemoryReservation(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
|
|
|
|
|
|
file := "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes"
|
|
@@ -691,33 +688,32 @@ func (s *DockerSuite) TestRunWithMemoryReservation(c *check.C) {
|
|
|
assert.Equal(c, out, "209715200")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, testEnv.IsLocalDaemon, memoryReservationSupport)
|
|
|
out, _, err := dockerCmdWithError("run", "-m", "500M", "--memory-reservation", "800M", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
expected := "Minimum memory limit can not be less than memory reservation limit"
|
|
|
- c.Assert(strings.TrimSpace(out), checker.Contains, expected, check.Commentf("run container should fail with invalid memory reservation"))
|
|
|
-
|
|
|
+ assert.Assert(c, strings.Contains(strings.TrimSpace(out), expected), "run container should fail with invalid memory reservation")
|
|
|
out, _, err = dockerCmdWithError("run", "--memory-reservation", "1k", "busybox", "true")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
expected = "Minimum memory reservation allowed is 4MB"
|
|
|
- c.Assert(strings.TrimSpace(out), checker.Contains, expected, check.Commentf("run container should fail with invalid memory reservation"))
|
|
|
+ assert.Assert(c, strings.Contains(strings.TrimSpace(out), expected), "run container should fail with invalid memory reservation")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestStopContainerSignal(c *check.C) {
|
|
|
+func (s *DockerSuite) TestStopContainerSignal(c *testing.T) {
|
|
|
out, _ := dockerCmd(c, "run", "--stop-signal", "SIGUSR1", "-d", "busybox", "/bin/sh", "-c", `trap 'echo "exit trapped"; exit 0' USR1; while true; do sleep 1; done`)
|
|
|
containerID := strings.TrimSpace(out)
|
|
|
|
|
|
- c.Assert(waitRun(containerID), checker.IsNil)
|
|
|
+ assert.Assert(c, waitRun(containerID) == nil)
|
|
|
|
|
|
dockerCmd(c, "stop", containerID)
|
|
|
out, _ = dockerCmd(c, "logs", containerID)
|
|
|
|
|
|
- c.Assert(out, checker.Contains, "exit trapped", check.Commentf("Expected `exit trapped` in the log"))
|
|
|
+ assert.Assert(c, strings.Contains(out, "exit trapped"), "Expected `exit trapped` in the log")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *testing.T) {
|
|
|
testRequires(c, memoryLimitSupport)
|
|
|
testRequires(c, swapMemorySupport)
|
|
|
out, _, err := dockerCmdWithError("run", "-m", "16m", "--memory-swap", "15m", "busybox", "echo", "test")
|
|
@@ -727,7 +723,7 @@ func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset, testEnv.IsLocalDaemon)
|
|
|
|
|
|
sysInfo := sysinfo.New(true)
|
|
@@ -746,7 +742,7 @@ func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *testing.T) {
|
|
|
testRequires(c, cgroupCpuset)
|
|
|
|
|
|
sysInfo := sysinfo.New(true)
|
|
@@ -765,7 +761,7 @@ func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunInvalidCPUShares(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunInvalidCPUShares(c *testing.T) {
|
|
|
testRequires(c, cpuShare, DaemonIsLinux)
|
|
|
out, _, err := dockerCmdWithError("run", "--cpu-shares", "1", "busybox", "echo", "test")
|
|
|
assert.ErrorContains(c, err, "", out)
|
|
@@ -783,7 +779,7 @@ func (s *DockerSuite) TestRunInvalidCPUShares(c *check.C) {
|
|
|
assert.Assert(c, strings.Contains(out, expected))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithDefaultShmSize(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithDefaultShmSize(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
name := "shm-default"
|
|
@@ -793,10 +789,10 @@ func (s *DockerSuite) TestRunWithDefaultShmSize(c *check.C) {
|
|
|
c.Fatalf("Expected shm of 64MB in mount command, got %v", out)
|
|
|
}
|
|
|
shmSize := inspectField(c, name, "HostConfig.ShmSize")
|
|
|
- c.Assert(shmSize, check.Equals, "67108864")
|
|
|
+ assert.Equal(c, shmSize, "67108864")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithShmSize(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithShmSize(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
name := "shm"
|
|
@@ -806,18 +802,18 @@ func (s *DockerSuite) TestRunWithShmSize(c *check.C) {
|
|
|
c.Fatalf("Expected shm of 1GB in mount command, got %v", out)
|
|
|
}
|
|
|
shmSize := inspectField(c, name, "HostConfig.ShmSize")
|
|
|
- c.Assert(shmSize, check.Equals, "1073741824")
|
|
|
+ assert.Equal(c, shmSize, "1073741824")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsEnsureOrdered(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunTmpfsMountsEnsureOrdered(c *testing.T) {
|
|
|
tmpFile, err := ioutil.TempFile("", "test")
|
|
|
assert.NilError(c, err)
|
|
|
defer tmpFile.Close()
|
|
|
out, _ := dockerCmd(c, "run", "--tmpfs", "/run", "-v", tmpFile.Name()+":/run/test", "busybox", "ls", "/run")
|
|
|
- c.Assert(out, checker.Contains, "test")
|
|
|
+ assert.Assert(c, strings.Contains(out, "test"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMounts(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunTmpfsMounts(c *testing.T) {
|
|
|
// TODO Windows (Post TP5): This test cannot run on a Windows daemon as
|
|
|
// Windows does not support tmpfs mounts.
|
|
|
testRequires(c, DaemonIsLinux)
|
|
@@ -838,7 +834,7 @@ func (s *DockerSuite) TestRunTmpfsMounts(c *check.C) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *testing.T) {
|
|
|
name := "img-with-volumes"
|
|
|
buildImageSuccessfully(c, name, build.WithDockerfile(`
|
|
|
FROM busybox
|
|
@@ -846,37 +842,35 @@ func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *check.C) {
|
|
|
RUN touch /run/stuff
|
|
|
`))
|
|
|
out, _ := dockerCmd(c, "run", "--tmpfs", "/run", name, "ls", "/run")
|
|
|
- c.Assert(out, checker.Not(checker.Contains), "stuff")
|
|
|
+ assert.Assert(c, !strings.Contains(out, "stuff"))
|
|
|
}
|
|
|
|
|
|
// Test case for #22420
|
|
|
-func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
expectedOptions := []string{"rw", "nosuid", "nodev", "noexec", "relatime"}
|
|
|
out, _ := dockerCmd(c, "run", "--tmpfs", "/tmp", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
|
|
|
for _, option := range expectedOptions {
|
|
|
- c.Assert(out, checker.Contains, option)
|
|
|
+ assert.Assert(c, strings.Contains(out, option))
|
|
|
}
|
|
|
- c.Assert(out, checker.Not(checker.Contains), "size=")
|
|
|
-
|
|
|
+ assert.Assert(c, !strings.Contains(out, "size="))
|
|
|
expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime"}
|
|
|
out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
|
|
|
for _, option := range expectedOptions {
|
|
|
- c.Assert(out, checker.Contains, option)
|
|
|
+ assert.Assert(c, strings.Contains(out, option))
|
|
|
}
|
|
|
- c.Assert(out, checker.Not(checker.Contains), "size=")
|
|
|
-
|
|
|
+ assert.Assert(c, !strings.Contains(out, "size="))
|
|
|
expectedOptions = []string{"rw", "nosuid", "nodev", "relatime", "size=8192k"}
|
|
|
out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,exec,size=8192k", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
|
|
|
for _, option := range expectedOptions {
|
|
|
- c.Assert(out, checker.Contains, option)
|
|
|
+ assert.Assert(c, strings.Contains(out, option))
|
|
|
}
|
|
|
|
|
|
expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime", "size=4096k"}
|
|
|
out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,size=8192k,exec,size=4096k,noexec", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'")
|
|
|
for _, option := range expectedOptions {
|
|
|
- c.Assert(out, checker.Contains, option)
|
|
|
+ assert.Assert(c, strings.Contains(out, option))
|
|
|
}
|
|
|
|
|
|
// We use debian:jessie as there is no findmnt in busybox. Also the output will be in the format of
|
|
@@ -886,32 +880,32 @@ func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *check.C) {
|
|
|
expectedOptions = []string{"shared"}
|
|
|
out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:jessie", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp")
|
|
|
for _, option := range expectedOptions {
|
|
|
- c.Assert(out, checker.Contains, option)
|
|
|
+ assert.Assert(c, strings.Contains(out, option))
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSysctls(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSysctls(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
var err error
|
|
|
|
|
|
out, _ := dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=1", "--name", "test", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward")
|
|
|
- c.Assert(strings.TrimSpace(out), check.Equals, "1")
|
|
|
+ assert.Equal(c, strings.TrimSpace(out), "1")
|
|
|
|
|
|
out = inspectFieldJSON(c, "test", "HostConfig.Sysctls")
|
|
|
|
|
|
sysctls := make(map[string]string)
|
|
|
err = json.Unmarshal([]byte(out), &sysctls)
|
|
|
assert.NilError(c, err)
|
|
|
- c.Assert(sysctls["net.ipv4.ip_forward"], check.Equals, "1")
|
|
|
+ assert.Equal(c, sysctls["net.ipv4.ip_forward"], "1")
|
|
|
|
|
|
out, _ = dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=0", "--name", "test1", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward")
|
|
|
- c.Assert(strings.TrimSpace(out), check.Equals, "0")
|
|
|
+ assert.Equal(c, strings.TrimSpace(out), "0")
|
|
|
|
|
|
out = inspectFieldJSON(c, "test1", "HostConfig.Sysctls")
|
|
|
|
|
|
err = json.Unmarshal([]byte(out), &sysctls)
|
|
|
assert.NilError(c, err)
|
|
|
- c.Assert(sysctls["net.ipv4.ip_forward"], check.Equals, "0")
|
|
|
+ assert.Equal(c, sysctls["net.ipv4.ip_forward"], "0")
|
|
|
|
|
|
icmd.RunCommand(dockerBinary, "run", "--sysctl", "kernel.foobar=1", "--name", "test2",
|
|
|
"busybox", "cat", "/proc/sys/kernel/foobar").Assert(c, icmd.Expected{
|
|
@@ -921,7 +915,7 @@ func (s *DockerSuite) TestRunSysctls(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:jessie unshare' exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
|
|
|
jsonData := `{
|
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
@@ -950,7 +944,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompProfileDenyChmod checks that 'docker run --security-opt seccomp=/tmp/profile.json busybox chmod 400 /etc/hostname' exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
jsonData := `{
|
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
@@ -985,7 +979,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) {
|
|
|
|
|
|
// TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:jessie unshare --map-root-user --user sh -c whoami' with a specific profile to
|
|
|
// deny unshare of a userns exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotArm, Apparmor)
|
|
|
// from sched.h
|
|
|
jsonData := fmt.Sprintf(`{
|
|
@@ -1023,7 +1017,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) {
|
|
|
|
|
|
// TestRunSeccompProfileDenyCloneUserns checks that 'docker run syscall-test'
|
|
|
// with a the default seccomp profile exits with operation not permitted.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1035,7 +1029,7 @@ func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) {
|
|
|
|
|
|
// TestRunSeccompUnconfinedCloneUserns checks that
|
|
|
// 'docker run --security-opt seccomp=unconfined syscall-test' allows creating a userns.
|
|
|
-func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace, unprivilegedUsernsClone)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1048,7 +1042,7 @@ func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) {
|
|
|
|
|
|
// TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged syscall-test'
|
|
|
// allows creating a userns.
|
|
|
-func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1060,7 +1054,7 @@ func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) {
|
|
|
|
|
|
// TestRunSeccompProfileAllow32Bit checks that 32 bit code can run on x86_64
|
|
|
// with the default seccomp profile.
|
|
|
-func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, IsAmd64)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1068,14 +1062,14 @@ func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// TestRunSeccompAllowSetrlimit checks that 'docker run debian:jessie ulimit -v 1048510' succeeds.
|
|
|
-func (s *DockerSuite) TestRunSeccompAllowSetrlimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompAllowSetrlimit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
|
|
|
// ulimit uses setrlimit, so we want to make sure we don't break it
|
|
|
icmd.RunCommand(dockerBinary, "run", "debian:jessie", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success)
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1105,7 +1099,7 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *check.C) {
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled, NotUserNamespace)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1142,7 +1136,7 @@ func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) {
|
|
|
|
|
|
// TestRunNoNewPrivSetuid checks that --security-opt='no-new-privileges=true' prevents
|
|
|
// effective uid transitions on executing setuid binaries.
|
|
|
-func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunNoNewPrivSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureNNPTest(c)
|
|
|
|
|
@@ -1155,7 +1149,7 @@ func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) {
|
|
|
|
|
|
// TestLegacyRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents
|
|
|
// effective uid transitions on executing setuid binaries.
|
|
|
-func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureNNPTest(c)
|
|
|
|
|
@@ -1166,7 +1160,7 @@ func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1184,7 +1178,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1197,7 +1191,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1213,7 +1207,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *check.C) {
|
|
|
|
|
|
// TODO CAP_KILL
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1231,7 +1225,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1251,7 +1245,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *check.C) {
|
|
|
|
|
|
// TODO CAP_SETPCAP
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1269,7 +1263,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *check.C)
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1287,7 +1281,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1305,7 +1299,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *check.C) {
|
|
|
})
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *check.C) {
|
|
|
+func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, testEnv.IsLocalDaemon)
|
|
|
ensureSyscallTest(c)
|
|
|
|
|
@@ -1327,7 +1321,7 @@ func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *check.C) {
|
|
|
// TODO CAP_AUDIT_WRITE
|
|
|
// TODO CAP_SETFCAP
|
|
|
|
|
|
-func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunApparmorProcDirectory(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, Apparmor)
|
|
|
|
|
|
// running w seccomp unconfined tests the apparmor profile
|
|
@@ -1346,7 +1340,7 @@ func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) {
|
|
|
|
|
|
// make sure the default profile can be successfully parsed (using unshare as it is
|
|
|
// something which we know is blocked in the default profile)
|
|
|
-func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, seccompEnabled)
|
|
|
|
|
|
out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami")
|
|
@@ -1355,7 +1349,7 @@ func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) {
|
|
|
}
|
|
|
|
|
|
// TestRunDeviceSymlink checks run with device that follows symlink (#13840 and #22271)
|
|
|
-func (s *DockerSuite) TestRunDeviceSymlink(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunDeviceSymlink(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm, testEnv.IsLocalDaemon)
|
|
|
if _, err := os.Stat("/dev/zero"); err != nil {
|
|
|
c.Skip("Host does not have /dev/zero")
|
|
@@ -1391,20 +1385,18 @@ func (s *DockerSuite) TestRunDeviceSymlink(c *check.C) {
|
|
|
|
|
|
// md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23
|
|
|
out, _ := dockerCmd(c, "run", "--device", symZero+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
|
|
|
- c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "bb7df04e1b0a2570657527a7e108ae23", check.Commentf("expected output bb7df04e1b0a2570657527a7e108ae23"))
|
|
|
-
|
|
|
+ assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "bb7df04e1b0a2570657527a7e108ae23"), "expected output bb7df04e1b0a2570657527a7e108ae23")
|
|
|
// symlink "tmpDir/file" to a file "tmpDir/temp" will result in an error as it is not a device.
|
|
|
out, _, err = dockerCmdWithError("run", "--device", symFile+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "not a device node", check.Commentf("expected output 'not a device node'"))
|
|
|
-
|
|
|
+ assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "not a device node"), "expected output 'not a device node'")
|
|
|
// md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23 (this time check with relative path backed, see #22271)
|
|
|
out, _ = dockerCmd(c, "run", "--device", "/dev/symzero:/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum")
|
|
|
- c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "bb7df04e1b0a2570657527a7e108ae23", check.Commentf("expected output bb7df04e1b0a2570657527a7e108ae23"))
|
|
|
+ assert.Assert(c, strings.Contains(strings.Trim(out, "\r\n"), "bb7df04e1b0a2570657527a7e108ae23"), "expected output bb7df04e1b0a2570657527a7e108ae23")
|
|
|
}
|
|
|
|
|
|
// TestRunPIDsLimit makes sure the pids cgroup is set with --pids-limit
|
|
|
-func (s *DockerSuite) TestRunPIDsLimit(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunPIDsLimit(c *testing.T) {
|
|
|
testRequires(c, testEnv.IsLocalDaemon, pidsLimit)
|
|
|
|
|
|
file := "/sys/fs/cgroup/pids/pids.max"
|
|
@@ -1415,7 +1407,7 @@ func (s *DockerSuite) TestRunPIDsLimit(c *check.C) {
|
|
|
assert.Equal(c, out, "4", "setting the pids limit failed")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux, NotUserNamespace)
|
|
|
|
|
|
file := "/sys/fs/cgroup/devices/devices.list"
|
|
@@ -1424,7 +1416,7 @@ func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *check.C) {
|
|
|
assert.Equal(c, strings.TrimSpace(out), "a *:* rwm")
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunUserDeviceAllowed(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunUserDeviceAllowed(c *testing.T) {
|
|
|
testRequires(c, DaemonIsLinux)
|
|
|
|
|
|
fi, err := os.Stat("/dev/snd/timer")
|
|
@@ -1438,10 +1430,10 @@ func (s *DockerSuite) TestRunUserDeviceAllowed(c *check.C) {
|
|
|
|
|
|
file := "/sys/fs/cgroup/devices/devices.list"
|
|
|
out, _ := dockerCmd(c, "run", "--device", "/dev/snd/timer:w", "busybox", "cat", file)
|
|
|
- c.Assert(out, checker.Contains, fmt.Sprintf("c %d:%d w", stat.Rdev/256, stat.Rdev%256))
|
|
|
+ assert.Assert(c, strings.Contains(out, fmt.Sprintf("c %d:%d w", stat.Rdev/256, stat.Rdev%256)))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) {
|
|
|
+func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *testing.T) {
|
|
|
testRequires(c, seccompEnabled)
|
|
|
|
|
|
s.d.StartWithBusybox(c)
|
|
@@ -1463,10 +1455,10 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) {
|
|
|
|
|
|
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, "Operation not permitted")
|
|
|
+ assert.Assert(c, strings.Contains(out, "Operation not permitted"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) {
|
|
|
+func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *testing.T) {
|
|
|
testRequires(c, seccompEnabled)
|
|
|
|
|
|
s.d.StartWithBusybox(c)
|
|
@@ -1489,10 +1481,10 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) {
|
|
|
|
|
|
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, "'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'")
|
|
|
+ assert.Assert(c, strings.Contains(out, "'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
|
|
|
+func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *testing.T) {
|
|
|
testRequires(c, seccompEnabled)
|
|
|
|
|
|
s.d.StartWithBusybox(c)
|
|
@@ -1526,10 +1518,10 @@ func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) {
|
|
|
|
|
|
out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, "'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'")
|
|
|
+ assert.Assert(c, strings.Contains(out, "'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *check.C) {
|
|
|
+func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *testing.T) {
|
|
|
testRequires(c, seccompEnabled)
|
|
|
|
|
|
s.d.StartWithBusybox(c)
|
|
@@ -1562,10 +1554,10 @@ func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *check.C) {
|
|
|
|
|
|
out, err := s.d.Cmd("run", "busybox", "chmod", "777", ".")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, "Operation not permitted")
|
|
|
+ assert.Assert(c, strings.Contains(out, "Operation not permitted"))
|
|
|
}
|
|
|
|
|
|
-func (s *DockerSuite) TestRunWithNanoCPUs(c *check.C) {
|
|
|
+func (s *DockerSuite) TestRunWithNanoCPUs(c *testing.T) {
|
|
|
testRequires(c, cpuCfsQuota, cpuCfsPeriod)
|
|
|
|
|
|
file1 := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us"
|
|
@@ -1577,7 +1569,7 @@ func (s *DockerSuite) TestRunWithNanoCPUs(c *check.C) {
|
|
|
assert.NilError(c, err)
|
|
|
inspect, err := clt.ContainerInspect(context.Background(), "test")
|
|
|
assert.NilError(c, err)
|
|
|
- c.Assert(inspect.HostConfig.NanoCPUs, checker.Equals, int64(500000000))
|
|
|
+ assert.Equal(c, inspect.HostConfig.NanoCPUs, int64(500000000))
|
|
|
|
|
|
out = inspectField(c, "test", "HostConfig.CpuQuota")
|
|
|
assert.Equal(c, out, "0", "CPU CFS quota should be 0")
|
|
@@ -1586,5 +1578,5 @@ func (s *DockerSuite) TestRunWithNanoCPUs(c *check.C) {
|
|
|
|
|
|
out, _, err = dockerCmdWithError("run", "--cpus", "0.5", "--cpu-quota", "50000", "--cpu-period", "100000", "busybox", "sh")
|
|
|
assert.ErrorContains(c, err, "")
|
|
|
- c.Assert(out, checker.Contains, "Conflicting options: Nano CPUs and CPU Period cannot both be set")
|
|
|
+ assert.Assert(c, strings.Contains(out, "Conflicting options: Nano CPUs and CPU Period cannot both be set"))
|
|
|
}
|