docker_cli_run_test.go 163 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869187018711872187318741875187618771878187918801881188218831884188518861887188818891890189118921893189418951896189718981899190019011902190319041905190619071908190919101911191219131914191519161917191819191920192119221923192419251926192719281929193019311932193319341935193619371938193919401941194219431944194519461947194819491950195119521953195419551956195719581959196019611962196319641965196619671968196919701971197219731974197519761977197819791980198119821983198419851986198719881989199019911992199319941995199619971998199920002001200220032004200520062007200820092010201120122013201420152016201720182019202020212022202320242025202620272028202920302031203220332034203520362037203820392040204120422043204420452046204720482049205020512052205320542055205620572058205920602061206220632064206520662067206820692070207120722073207420752076207720782079208020812082208320842085208620872088208920902091209220932094209520962097209820992100210121022103210421052106210721082109211021112112211321142115211621172118211921202121212221232124212521262127212821292130213121322133213421352136213721382139214021412142214321442145214621472148214921502151215221532154215521562157215821592160216121622163216421652166216721682169217021712172217321742175217621772178217921802181218221832184218521862187218821892190219121922193219421952196219721982199220022012202220322042205220622072208220922102211221222132214221522162217221822192220222122222223222422252226222722282229223022312232223322342235223622372238223922402241224222432244224522462247224822492250225122522253225422552256225722582259226022612262226322642265226622672268226922702271227222732274227522762277227822792280228122822283228422852286228722882289229022912292229322942295229622972298229923002301230223032304230523062307230823092310231123122313231423152316231723182319232023212322232323242325232623272328232923302331233223332334233523362337233823392340234123422343234423452346234723482349235023512352235323542355235623572358235923602361236223632364236523662367236823692370237123722373237423752376237723782379238023812382238323842385238623872388238923902391239223932394239523962397239823992400240124022403240424052406240724082409241024112412241324142415241624172418241924202421242224232424242524262427242824292430243124322433243424352436243724382439244024412442244324442445244624472448244924502451245224532454245524562457245824592460246124622463246424652466246724682469247024712472247324742475247624772478247924802481248224832484248524862487248824892490249124922493249424952496249724982499250025012502250325042505250625072508250925102511251225132514251525162517251825192520252125222523252425252526252725282529253025312532253325342535253625372538253925402541254225432544254525462547254825492550255125522553255425552556255725582559256025612562256325642565256625672568256925702571257225732574257525762577257825792580258125822583258425852586258725882589259025912592259325942595259625972598259926002601260226032604260526062607260826092610261126122613261426152616261726182619262026212622262326242625262626272628262926302631263226332634263526362637263826392640264126422643264426452646264726482649265026512652265326542655265626572658265926602661266226632664266526662667266826692670267126722673267426752676267726782679268026812682268326842685268626872688268926902691269226932694269526962697269826992700270127022703270427052706270727082709271027112712271327142715271627172718271927202721272227232724272527262727272827292730273127322733273427352736273727382739274027412742274327442745274627472748274927502751275227532754275527562757275827592760276127622763276427652766276727682769277027712772277327742775277627772778277927802781278227832784278527862787278827892790279127922793279427952796279727982799280028012802280328042805280628072808280928102811281228132814281528162817281828192820282128222823282428252826282728282829283028312832283328342835283628372838283928402841284228432844284528462847284828492850285128522853285428552856285728582859286028612862286328642865286628672868286928702871287228732874287528762877287828792880288128822883288428852886288728882889289028912892289328942895289628972898289929002901290229032904290529062907290829092910291129122913291429152916291729182919292029212922292329242925292629272928292929302931293229332934293529362937293829392940294129422943294429452946294729482949295029512952295329542955295629572958295929602961296229632964296529662967296829692970297129722973297429752976297729782979298029812982298329842985298629872988298929902991299229932994299529962997299829993000300130023003300430053006300730083009301030113012301330143015301630173018301930203021302230233024302530263027302830293030303130323033303430353036303730383039304030413042304330443045304630473048304930503051305230533054305530563057305830593060306130623063306430653066306730683069307030713072307330743075307630773078307930803081308230833084308530863087308830893090309130923093309430953096309730983099310031013102310331043105310631073108310931103111311231133114311531163117311831193120312131223123312431253126312731283129313031313132313331343135313631373138313931403141314231433144314531463147314831493150315131523153315431553156315731583159316031613162316331643165316631673168316931703171317231733174317531763177317831793180318131823183318431853186318731883189319031913192319331943195319631973198319932003201320232033204320532063207320832093210321132123213321432153216321732183219322032213222322332243225322632273228322932303231323232333234323532363237323832393240324132423243324432453246324732483249325032513252325332543255325632573258325932603261326232633264326532663267326832693270327132723273327432753276327732783279328032813282328332843285328632873288328932903291329232933294329532963297329832993300330133023303330433053306330733083309331033113312331333143315331633173318331933203321332233233324332533263327332833293330333133323333333433353336333733383339334033413342334333443345334633473348334933503351335233533354335533563357335833593360336133623363336433653366336733683369337033713372337333743375337633773378337933803381338233833384338533863387338833893390339133923393339433953396339733983399340034013402340334043405340634073408340934103411341234133414341534163417341834193420342134223423342434253426342734283429343034313432343334343435343634373438343934403441344234433444344534463447344834493450345134523453345434553456345734583459346034613462346334643465346634673468346934703471347234733474347534763477347834793480348134823483348434853486348734883489349034913492349334943495349634973498349935003501350235033504350535063507350835093510351135123513351435153516351735183519352035213522352335243525352635273528352935303531353235333534353535363537353835393540354135423543354435453546354735483549355035513552355335543555355635573558355935603561356235633564356535663567356835693570357135723573357435753576357735783579358035813582358335843585358635873588358935903591359235933594359535963597359835993600360136023603360436053606360736083609361036113612361336143615361636173618361936203621362236233624362536263627362836293630363136323633363436353636363736383639364036413642364336443645364636473648364936503651365236533654365536563657365836593660366136623663366436653666366736683669367036713672367336743675367636773678367936803681368236833684368536863687368836893690369136923693369436953696369736983699370037013702370337043705370637073708370937103711371237133714371537163717371837193720372137223723372437253726372737283729373037313732373337343735373637373738373937403741374237433744374537463747374837493750375137523753375437553756375737583759376037613762376337643765376637673768376937703771377237733774377537763777377837793780378137823783378437853786378737883789379037913792379337943795379637973798379938003801380238033804380538063807380838093810381138123813381438153816381738183819382038213822382338243825382638273828382938303831383238333834383538363837383838393840384138423843384438453846384738483849385038513852385338543855385638573858385938603861386238633864386538663867386838693870387138723873387438753876387738783879388038813882388338843885388638873888388938903891389238933894389538963897389838993900390139023903390439053906390739083909391039113912391339143915391639173918391939203921392239233924392539263927392839293930393139323933393439353936393739383939394039413942394339443945394639473948394939503951395239533954395539563957395839593960396139623963396439653966396739683969397039713972397339743975397639773978397939803981398239833984398539863987398839893990399139923993399439953996399739983999400040014002400340044005400640074008400940104011401240134014401540164017401840194020402140224023402440254026402740284029403040314032403340344035403640374038403940404041404240434044404540464047404840494050405140524053405440554056405740584059406040614062406340644065406640674068406940704071407240734074407540764077407840794080408140824083408440854086408740884089409040914092409340944095409640974098409941004101410241034104410541064107410841094110411141124113411441154116411741184119412041214122412341244125412641274128412941304131413241334134413541364137413841394140414141424143414441454146414741484149415041514152415341544155415641574158415941604161416241634164416541664167416841694170417141724173417441754176417741784179418041814182418341844185418641874188418941904191419241934194419541964197419841994200420142024203420442054206420742084209421042114212421342144215421642174218421942204221422242234224422542264227422842294230423142324233423442354236423742384239424042414242424342444245424642474248424942504251425242534254425542564257425842594260426142624263426442654266426742684269427042714272427342744275427642774278427942804281428242834284428542864287428842894290429142924293429442954296429742984299430043014302430343044305430643074308430943104311431243134314431543164317431843194320432143224323432443254326432743284329433043314332433343344335433643374338433943404341434243434344434543464347434843494350435143524353435443554356435743584359436043614362436343644365436643674368436943704371437243734374437543764377437843794380438143824383438443854386438743884389439043914392439343944395439643974398439944004401440244034404440544064407440844094410441144124413441444154416441744184419442044214422442344244425442644274428442944304431443244334434443544364437443844394440444144424443
  1. package main
  2. import (
  3. "bufio"
  4. "bytes"
  5. "context"
  6. "encoding/json"
  7. "fmt"
  8. "io"
  9. "io/ioutil"
  10. "net"
  11. "os"
  12. "os/exec"
  13. "path"
  14. "path/filepath"
  15. "reflect"
  16. "regexp"
  17. "runtime"
  18. "sort"
  19. "strconv"
  20. "strings"
  21. "sync"
  22. "testing"
  23. "time"
  24. "github.com/Microsoft/hcsshim/osversion"
  25. "github.com/docker/docker/client"
  26. "github.com/docker/docker/integration-cli/cli"
  27. "github.com/docker/docker/integration-cli/cli/build"
  28. "github.com/docker/docker/pkg/stringid"
  29. "github.com/docker/docker/runconfig"
  30. "github.com/docker/docker/testutil"
  31. "github.com/docker/docker/testutil/fakecontext"
  32. "github.com/docker/go-connections/nat"
  33. "github.com/docker/libnetwork/resolvconf"
  34. "github.com/docker/libnetwork/types"
  35. "github.com/moby/sys/mountinfo"
  36. "gotest.tools/v3/assert"
  37. "gotest.tools/v3/icmd"
  38. )
  39. // "test123" should be printed by docker run
  40. func (s *DockerSuite) TestRunEchoStdout(c *testing.T) {
  41. out, _ := dockerCmd(c, "run", "busybox", "echo", "test123")
  42. if out != "test123\n" {
  43. c.Fatalf("container should've printed 'test123', got '%s'", out)
  44. }
  45. }
  46. // "test" should be printed
  47. func (s *DockerSuite) TestRunEchoNamedContainer(c *testing.T) {
  48. out, _ := dockerCmd(c, "run", "--name", "testfoonamedcontainer", "busybox", "echo", "test")
  49. if out != "test\n" {
  50. c.Errorf("container should've printed 'test'")
  51. }
  52. }
  53. // docker run should not leak file descriptors. This test relies on Unix
  54. // specific functionality and cannot run on Windows.
  55. func (s *DockerSuite) TestRunLeakyFileDescriptors(c *testing.T) {
  56. testRequires(c, DaemonIsLinux)
  57. out, _ := dockerCmd(c, "run", "busybox", "ls", "-C", "/proc/self/fd")
  58. // normally, we should only get 0, 1, and 2, but 3 gets created by "ls" when it does "opendir" on the "fd" directory
  59. if out != "0 1 2 3\n" {
  60. c.Errorf("container should've printed '0 1 2 3', not: %s", out)
  61. }
  62. }
  63. // it should be possible to lookup Google DNS
  64. // this will fail when Internet access is unavailable
  65. func (s *DockerSuite) TestRunLookupGoogleDNS(c *testing.T) {
  66. testRequires(c, Network, NotArm)
  67. if testEnv.OSType == "windows" {
  68. // nslookup isn't present in Windows busybox. Is built-in. Further,
  69. // nslookup isn't present in nanoserver. Hence just use PowerShell...
  70. dockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "powershell", "Resolve-DNSName", "google.com")
  71. } else {
  72. dockerCmd(c, "run", "busybox", "nslookup", "google.com")
  73. }
  74. }
  75. // the exit code should be 0
  76. func (s *DockerSuite) TestRunExitCodeZero(c *testing.T) {
  77. dockerCmd(c, "run", "busybox", "true")
  78. }
  79. // the exit code should be 1
  80. func (s *DockerSuite) TestRunExitCodeOne(c *testing.T) {
  81. _, exitCode, err := dockerCmdWithError("run", "busybox", "false")
  82. assert.ErrorContains(c, err, "")
  83. assert.Equal(c, exitCode, 1)
  84. }
  85. // it should be possible to pipe in data via stdin to a process running in a container
  86. func (s *DockerSuite) TestRunStdinPipe(c *testing.T) {
  87. // TODO Windows: This needs some work to make compatible.
  88. testRequires(c, DaemonIsLinux)
  89. result := icmd.RunCmd(icmd.Cmd{
  90. Command: []string{dockerBinary, "run", "-i", "-a", "stdin", "busybox", "cat"},
  91. Stdin: strings.NewReader("blahblah"),
  92. })
  93. result.Assert(c, icmd.Success)
  94. out := result.Stdout()
  95. out = strings.TrimSpace(out)
  96. dockerCmd(c, "wait", out)
  97. logsOut, _ := dockerCmd(c, "logs", out)
  98. containerLogs := strings.TrimSpace(logsOut)
  99. if containerLogs != "blahblah" {
  100. c.Errorf("logs didn't print the container's logs %s", containerLogs)
  101. }
  102. dockerCmd(c, "rm", out)
  103. }
  104. // the container's ID should be printed when starting a container in detached mode
  105. func (s *DockerSuite) TestRunDetachedContainerIDPrinting(c *testing.T) {
  106. out, _ := dockerCmd(c, "run", "-d", "busybox", "true")
  107. out = strings.TrimSpace(out)
  108. dockerCmd(c, "wait", out)
  109. rmOut, _ := dockerCmd(c, "rm", out)
  110. rmOut = strings.TrimSpace(rmOut)
  111. if rmOut != out {
  112. c.Errorf("rm didn't print the container ID %s %s", out, rmOut)
  113. }
  114. }
  115. // the working directory should be set correctly
  116. func (s *DockerSuite) TestRunWorkingDirectory(c *testing.T) {
  117. dir := "/root"
  118. image := "busybox"
  119. if testEnv.OSType == "windows" {
  120. dir = `C:/Windows`
  121. }
  122. // First with -w
  123. out, _ := dockerCmd(c, "run", "-w", dir, image, "pwd")
  124. out = strings.TrimSpace(out)
  125. if out != dir {
  126. c.Errorf("-w failed to set working directory")
  127. }
  128. // Then with --workdir
  129. out, _ = dockerCmd(c, "run", "--workdir", dir, image, "pwd")
  130. out = strings.TrimSpace(out)
  131. if out != dir {
  132. c.Errorf("--workdir failed to set working directory")
  133. }
  134. }
  135. // pinging Google's DNS resolver should fail when we disable the networking
  136. func (s *DockerSuite) TestRunWithoutNetworking(c *testing.T) {
  137. count := "-c"
  138. image := "busybox"
  139. if testEnv.OSType == "windows" {
  140. count = "-n"
  141. image = testEnv.PlatformDefaults.BaseImage
  142. }
  143. // First using the long form --net
  144. out, exitCode, err := dockerCmdWithError("run", "--net=none", image, "ping", count, "1", "8.8.8.8")
  145. if err != nil && exitCode != 1 {
  146. c.Fatal(out, err)
  147. }
  148. if exitCode != 1 {
  149. c.Errorf("--net=none should've disabled the network; the container shouldn't have been able to ping 8.8.8.8")
  150. }
  151. }
  152. // test --link use container name to link target
  153. func (s *DockerSuite) TestRunLinksContainerWithContainerName(c *testing.T) {
  154. // TODO Windows: This test cannot run on a Windows daemon as the networking
  155. // settings are not populated back yet on inspect.
  156. testRequires(c, DaemonIsLinux)
  157. dockerCmd(c, "run", "-i", "-t", "-d", "--name", "parent", "busybox")
  158. ip := inspectField(c, "parent", "NetworkSettings.Networks.bridge.IPAddress")
  159. out, _ := dockerCmd(c, "run", "--link", "parent:test", "busybox", "/bin/cat", "/etc/hosts")
  160. if !strings.Contains(out, ip+" test") {
  161. c.Fatalf("use a container name to link target failed")
  162. }
  163. }
  164. // test --link use container id to link target
  165. func (s *DockerSuite) TestRunLinksContainerWithContainerID(c *testing.T) {
  166. // TODO Windows: This test cannot run on a Windows daemon as the networking
  167. // settings are not populated back yet on inspect.
  168. testRequires(c, DaemonIsLinux)
  169. cID, _ := dockerCmd(c, "run", "-i", "-t", "-d", "busybox")
  170. cID = strings.TrimSpace(cID)
  171. ip := inspectField(c, cID, "NetworkSettings.Networks.bridge.IPAddress")
  172. out, _ := dockerCmd(c, "run", "--link", cID+":test", "busybox", "/bin/cat", "/etc/hosts")
  173. if !strings.Contains(out, ip+" test") {
  174. c.Fatalf("use a container id to link target failed")
  175. }
  176. }
  177. func (s *DockerSuite) TestUserDefinedNetworkLinks(c *testing.T) {
  178. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  179. dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
  180. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
  181. assert.Assert(c, waitRun("first") == nil)
  182. // run a container in user-defined network udlinkNet with a link for an existing container
  183. // and a link for a container that doesn't exist
  184. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
  185. "--link=third:bar", "busybox", "top")
  186. assert.Assert(c, waitRun("second") == nil)
  187. // ping to first and its alias foo must succeed
  188. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  189. assert.NilError(c, err)
  190. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  191. assert.NilError(c, err)
  192. // ping to third and its alias must fail
  193. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
  194. assert.ErrorContains(c, err, "")
  195. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
  196. assert.ErrorContains(c, err, "")
  197. // start third container now
  198. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=third", "busybox", "top")
  199. assert.Assert(c, waitRun("third") == nil)
  200. // ping to third and its alias must succeed now
  201. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
  202. assert.NilError(c, err)
  203. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
  204. assert.NilError(c, err)
  205. }
  206. func (s *DockerSuite) TestUserDefinedNetworkLinksWithRestart(c *testing.T) {
  207. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  208. dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
  209. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
  210. assert.Assert(c, waitRun("first") == nil)
  211. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
  212. "busybox", "top")
  213. assert.Assert(c, waitRun("second") == nil)
  214. // ping to first and its alias foo must succeed
  215. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  216. assert.NilError(c, err)
  217. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  218. assert.NilError(c, err)
  219. // Restart first container
  220. dockerCmd(c, "restart", "first")
  221. assert.Assert(c, waitRun("first") == nil)
  222. // ping to first and its alias foo must still succeed
  223. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  224. assert.NilError(c, err)
  225. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  226. assert.NilError(c, err)
  227. // Restart second container
  228. dockerCmd(c, "restart", "second")
  229. assert.Assert(c, waitRun("second") == nil)
  230. // ping to first and its alias foo must still succeed
  231. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  232. assert.NilError(c, err)
  233. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  234. assert.NilError(c, err)
  235. }
  236. func (s *DockerSuite) TestRunWithNetAliasOnDefaultNetworks(c *testing.T) {
  237. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  238. defaults := []string{"bridge", "host", "none"}
  239. for _, net := range defaults {
  240. out, _, err := dockerCmdWithError("run", "-d", "--net", net, "--net-alias", "alias_"+net, "busybox", "top")
  241. assert.ErrorContains(c, err, "")
  242. assert.Assert(c, strings.Contains(out, runconfig.ErrUnsupportedNetworkAndAlias.Error()))
  243. }
  244. }
  245. func (s *DockerSuite) TestUserDefinedNetworkAlias(c *testing.T) {
  246. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  247. dockerCmd(c, "network", "create", "-d", "bridge", "net1")
  248. cid1, _ := dockerCmd(c, "run", "-d", "--net=net1", "--name=first", "--net-alias=foo1", "--net-alias=foo2", "busybox:glibc", "top")
  249. assert.Assert(c, waitRun("first") == nil)
  250. // Check if default short-id alias is added automatically
  251. id := strings.TrimSpace(cid1)
  252. aliases := inspectField(c, id, "NetworkSettings.Networks.net1.Aliases")
  253. assert.Assert(c, strings.Contains(aliases, stringid.TruncateID(id)))
  254. cid2, _ := dockerCmd(c, "run", "-d", "--net=net1", "--name=second", "busybox:glibc", "top")
  255. assert.Assert(c, waitRun("second") == nil)
  256. // Check if default short-id alias is added automatically
  257. id = strings.TrimSpace(cid2)
  258. aliases = inspectField(c, id, "NetworkSettings.Networks.net1.Aliases")
  259. assert.Assert(c, strings.Contains(aliases, stringid.TruncateID(id)))
  260. // ping to first and its network-scoped aliases
  261. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  262. assert.NilError(c, err)
  263. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
  264. assert.NilError(c, err)
  265. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
  266. assert.NilError(c, err)
  267. // ping first container's short-id alias
  268. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", stringid.TruncateID(cid1))
  269. assert.NilError(c, err)
  270. // Restart first container
  271. dockerCmd(c, "restart", "first")
  272. assert.Assert(c, waitRun("first") == nil)
  273. // ping to first and its network-scoped aliases must succeed
  274. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  275. assert.NilError(c, err)
  276. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
  277. assert.NilError(c, err)
  278. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
  279. assert.NilError(c, err)
  280. // ping first container's short-id alias
  281. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", stringid.TruncateID(cid1))
  282. assert.NilError(c, err)
  283. }
  284. // Issue 9677.
  285. func (s *DockerSuite) TestRunWithDaemonFlags(c *testing.T) {
  286. out, _, err := dockerCmdWithError("--exec-opt", "foo=bar", "run", "-i", "busybox", "true")
  287. assert.ErrorContains(c, err, "")
  288. assert.Assert(c, strings.Contains(out, "unknown flag: --exec-opt"))
  289. }
  290. // Regression test for #4979
  291. func (s *DockerSuite) TestRunWithVolumesFromExited(c *testing.T) {
  292. var (
  293. out string
  294. exitCode int
  295. )
  296. // Create a file in a volume
  297. if testEnv.OSType == "windows" {
  298. out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", `c:\some\dir`, testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `echo hello > c:\some\dir\file`)
  299. } else {
  300. out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", "/some/dir", "busybox", "touch", "/some/dir/file")
  301. }
  302. if exitCode != 0 {
  303. c.Fatal("1", out, exitCode)
  304. }
  305. // Read the file from another container using --volumes-from to access the volume in the second container
  306. if testEnv.OSType == "windows" {
  307. out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", testEnv.PlatformDefaults.BaseImage, "cmd", "/c", `type c:\some\dir\file`)
  308. } else {
  309. out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", "busybox", "cat", "/some/dir/file")
  310. }
  311. if exitCode != 0 {
  312. c.Fatal("2", out, exitCode)
  313. }
  314. }
  315. // Volume path is a symlink which also exists on the host, and the host side is a file not a dir
  316. // But the volume call is just a normal volume, not a bind mount
  317. func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir(c *testing.T) {
  318. var (
  319. dockerFile string
  320. containerPath string
  321. cmd string
  322. )
  323. // This test cannot run on a Windows daemon as
  324. // Windows does not support symlinks inside a volume path
  325. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  326. name := "test-volume-symlink"
  327. dir, err := ioutil.TempDir("", name)
  328. if err != nil {
  329. c.Fatal(err)
  330. }
  331. defer os.RemoveAll(dir)
  332. // In the case of Windows to Windows CI, if the machine is setup so that
  333. // the temp directory is not the C: drive, this test is invalid and will
  334. // not work.
  335. if testEnv.OSType == "windows" && strings.ToLower(dir[:1]) != "c" {
  336. c.Skip("Requires TEMP to point to C: drive")
  337. }
  338. f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_CREATE, 0700)
  339. if err != nil {
  340. c.Fatal(err)
  341. }
  342. f.Close()
  343. if testEnv.OSType == "windows" {
  344. dockerFile = fmt.Sprintf("FROM %s\nRUN mkdir %s\nRUN mklink /D c:\\test %s", testEnv.PlatformDefaults.BaseImage, dir, dir)
  345. containerPath = `c:\test\test`
  346. cmd = "tasklist"
  347. } else {
  348. dockerFile = fmt.Sprintf("FROM busybox\nRUN mkdir -p %s\nRUN ln -s %s /test", dir, dir)
  349. containerPath = "/test/test"
  350. cmd = "true"
  351. }
  352. buildImageSuccessfully(c, name, build.WithDockerfile(dockerFile))
  353. dockerCmd(c, "run", "-v", containerPath, name, cmd)
  354. }
  355. // Volume path is a symlink in the container
  356. func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir2(c *testing.T) {
  357. var (
  358. dockerFile string
  359. containerPath string
  360. cmd string
  361. )
  362. // This test cannot run on a Windows daemon as
  363. // Windows does not support symlinks inside a volume path
  364. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  365. name := "test-volume-symlink2"
  366. if testEnv.OSType == "windows" {
  367. dockerFile = fmt.Sprintf("FROM %s\nRUN mkdir c:\\%s\nRUN mklink /D c:\\test c:\\%s", testEnv.PlatformDefaults.BaseImage, name, name)
  368. containerPath = `c:\test\test`
  369. cmd = "tasklist"
  370. } else {
  371. dockerFile = fmt.Sprintf("FROM busybox\nRUN mkdir -p /%s\nRUN ln -s /%s /test", name, name)
  372. containerPath = "/test/test"
  373. cmd = "true"
  374. }
  375. buildImageSuccessfully(c, name, build.WithDockerfile(dockerFile))
  376. dockerCmd(c, "run", "-v", containerPath, name, cmd)
  377. }
  378. func (s *DockerSuite) TestRunVolumesMountedAsReadonly(c *testing.T) {
  379. if _, code, err := dockerCmdWithError("run", "-v", "/test:/test:ro", "busybox", "touch", "/test/somefile"); err == nil || code == 0 {
  380. c.Fatalf("run should fail because volume is ro: exit code %d", code)
  381. }
  382. }
  383. func (s *DockerSuite) TestRunVolumesFromInReadonlyModeFails(c *testing.T) {
  384. var (
  385. volumeDir string
  386. fileInVol string
  387. )
  388. if testEnv.OSType == "windows" {
  389. volumeDir = `c:/test` // Forward-slash as using busybox
  390. fileInVol = `c:/test/file`
  391. } else {
  392. testRequires(c, DaemonIsLinux)
  393. volumeDir = "/test"
  394. fileInVol = `/test/file`
  395. }
  396. dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
  397. if _, code, err := dockerCmdWithError("run", "--volumes-from", "parent:ro", "busybox", "touch", fileInVol); err == nil || code == 0 {
  398. c.Fatalf("run should fail because volume is ro: exit code %d", code)
  399. }
  400. }
  401. // Regression test for #1201
  402. func (s *DockerSuite) TestRunVolumesFromInReadWriteMode(c *testing.T) {
  403. var (
  404. volumeDir string
  405. fileInVol string
  406. )
  407. if testEnv.OSType == "windows" {
  408. volumeDir = `c:/test` // Forward-slash as using busybox
  409. fileInVol = `c:/test/file`
  410. } else {
  411. volumeDir = "/test"
  412. fileInVol = "/test/file"
  413. }
  414. dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
  415. dockerCmd(c, "run", "--volumes-from", "parent:rw", "busybox", "touch", fileInVol)
  416. if out, _, err := dockerCmdWithError("run", "--volumes-from", "parent:bar", "busybox", "touch", fileInVol); err == nil || !strings.Contains(out, `invalid mode: bar`) {
  417. c.Fatalf("running --volumes-from parent:bar should have failed with invalid mode: %q", out)
  418. }
  419. dockerCmd(c, "run", "--volumes-from", "parent", "busybox", "touch", fileInVol)
  420. }
  421. func (s *DockerSuite) TestVolumesFromGetsProperMode(c *testing.T) {
  422. testRequires(c, testEnv.IsLocalDaemon)
  423. prefix, slash := getPrefixAndSlashFromDaemonPlatform()
  424. hostpath := RandomTmpDirPath("test", testEnv.OSType)
  425. if err := os.MkdirAll(hostpath, 0755); err != nil {
  426. c.Fatalf("Failed to create %s: %q", hostpath, err)
  427. }
  428. defer os.RemoveAll(hostpath)
  429. dockerCmd(c, "run", "--name", "parent", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
  430. // Expect this "rw" mode to be be ignored since the inherited volume is "ro"
  431. if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent:rw", "busybox", "touch", prefix+slash+"test"+slash+"file"); err == nil {
  432. c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `rw`")
  433. }
  434. dockerCmd(c, "run", "--name", "parent2", "-v", hostpath+":"+prefix+slash+"test:ro", "busybox", "true")
  435. // Expect this to be read-only since both are "ro"
  436. if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent2:ro", "busybox", "touch", prefix+slash+"test"+slash+"file"); err == nil {
  437. c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `ro`")
  438. }
  439. }
  440. // Test for GH#10618
  441. func (s *DockerSuite) TestRunNoDupVolumes(c *testing.T) {
  442. path1 := RandomTmpDirPath("test1", testEnv.OSType)
  443. path2 := RandomTmpDirPath("test2", testEnv.OSType)
  444. someplace := ":/someplace"
  445. if testEnv.OSType == "windows" {
  446. // Windows requires that the source directory exists before calling HCS
  447. testRequires(c, testEnv.IsLocalDaemon)
  448. someplace = `:c:\someplace`
  449. if err := os.MkdirAll(path1, 0755); err != nil {
  450. c.Fatalf("Failed to create %s: %q", path1, err)
  451. }
  452. defer os.RemoveAll(path1)
  453. if err := os.MkdirAll(path2, 0755); err != nil {
  454. c.Fatalf("Failed to create %s: %q", path1, err)
  455. }
  456. defer os.RemoveAll(path2)
  457. }
  458. mountstr1 := path1 + someplace
  459. mountstr2 := path2 + someplace
  460. if out, _, err := dockerCmdWithError("run", "-v", mountstr1, "-v", mountstr2, "busybox", "true"); err == nil {
  461. c.Fatal("Expected error about duplicate mount definitions")
  462. } else {
  463. if !strings.Contains(out, "Duplicate mount point") {
  464. c.Fatalf("Expected 'duplicate mount point' error, got %v", out)
  465. }
  466. }
  467. // Test for https://github.com/docker/docker/issues/22093
  468. volumename1 := "test1"
  469. volumename2 := "test2"
  470. volume1 := volumename1 + someplace
  471. volume2 := volumename2 + someplace
  472. if out, _, err := dockerCmdWithError("run", "-v", volume1, "-v", volume2, "busybox", "true"); err == nil {
  473. c.Fatal("Expected error about duplicate mount definitions")
  474. } else {
  475. if !strings.Contains(out, "Duplicate mount point") {
  476. c.Fatalf("Expected 'duplicate mount point' error, got %v", out)
  477. }
  478. }
  479. // create failed should have create volume volumename1 or volumename2
  480. // we should remove volumename2 or volumename2 successfully
  481. out, _ := dockerCmd(c, "volume", "ls")
  482. if strings.Contains(out, volumename1) {
  483. dockerCmd(c, "volume", "rm", volumename1)
  484. } else {
  485. dockerCmd(c, "volume", "rm", volumename2)
  486. }
  487. }
  488. // Test for #1351
  489. func (s *DockerSuite) TestRunApplyVolumesFromBeforeVolumes(c *testing.T) {
  490. prefix := ""
  491. if testEnv.OSType == "windows" {
  492. prefix = `c:`
  493. }
  494. dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
  495. dockerCmd(c, "run", "--volumes-from", "parent", "-v", prefix+"/test", "busybox", "cat", prefix+"/test/foo")
  496. }
  497. func (s *DockerSuite) TestRunMultipleVolumesFrom(c *testing.T) {
  498. prefix := ""
  499. if testEnv.OSType == "windows" {
  500. prefix = `c:`
  501. }
  502. dockerCmd(c, "run", "--name", "parent1", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
  503. dockerCmd(c, "run", "--name", "parent2", "-v", prefix+"/other", "busybox", "touch", prefix+"/other/bar")
  504. dockerCmd(c, "run", "--volumes-from", "parent1", "--volumes-from", "parent2", "busybox", "sh", "-c", "cat /test/foo && cat /other/bar")
  505. }
  506. // this tests verifies the ID format for the container
  507. func (s *DockerSuite) TestRunVerifyContainerID(c *testing.T) {
  508. out, exit, err := dockerCmdWithError("run", "-d", "busybox", "true")
  509. if err != nil {
  510. c.Fatal(err)
  511. }
  512. if exit != 0 {
  513. c.Fatalf("expected exit code 0 received %d", exit)
  514. }
  515. match, err := regexp.MatchString("^[0-9a-f]{64}$", strings.TrimSuffix(out, "\n"))
  516. if err != nil {
  517. c.Fatal(err)
  518. }
  519. if !match {
  520. c.Fatalf("Invalid container ID: %s", out)
  521. }
  522. }
  523. // Test that creating a container with a volume doesn't crash. Regression test for #995.
  524. func (s *DockerSuite) TestRunCreateVolume(c *testing.T) {
  525. prefix := ""
  526. if testEnv.OSType == "windows" {
  527. prefix = `c:`
  528. }
  529. dockerCmd(c, "run", "-v", prefix+"/var/lib/data", "busybox", "true")
  530. }
  531. // Test that creating a volume with a symlink in its path works correctly. Test for #5152.
  532. // Note that this bug happens only with symlinks with a target that starts with '/'.
  533. func (s *DockerSuite) TestRunCreateVolumeWithSymlink(c *testing.T) {
  534. // Cannot run on Windows as relies on Linux-specific functionality (sh -c mount...)
  535. testRequires(c, DaemonIsLinux)
  536. workingDirectory, err := ioutil.TempDir("", "TestRunCreateVolumeWithSymlink")
  537. assert.NilError(c, err)
  538. image := "docker-test-createvolumewithsymlink"
  539. buildCmd := exec.Command(dockerBinary, "build", "-t", image, "-")
  540. buildCmd.Stdin = strings.NewReader(`FROM busybox
  541. RUN ln -s home /bar`)
  542. buildCmd.Dir = workingDirectory
  543. err = buildCmd.Run()
  544. if err != nil {
  545. c.Fatalf("could not build '%s': %v", image, err)
  546. }
  547. _, exitCode, err := dockerCmdWithError("run", "-v", "/bar/foo", "--name", "test-createvolumewithsymlink", image, "sh", "-c", "mount | grep -q /home/foo")
  548. if err != nil || exitCode != 0 {
  549. c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)
  550. }
  551. volPath, err := inspectMountSourceField("test-createvolumewithsymlink", "/bar/foo")
  552. assert.NilError(c, err)
  553. _, exitCode, err = dockerCmdWithError("rm", "-v", "test-createvolumewithsymlink")
  554. if err != nil || exitCode != 0 {
  555. c.Fatalf("[rm] err: %v, exitcode: %d", err, exitCode)
  556. }
  557. _, err = os.Stat(volPath)
  558. if !os.IsNotExist(err) {
  559. c.Fatalf("[open] (expecting 'file does not exist' error) err: %v, volPath: %s", err, volPath)
  560. }
  561. }
  562. // Tests that a volume path that has a symlink exists in a container mounting it with `--volumes-from`.
  563. func (s *DockerSuite) TestRunVolumesFromSymlinkPath(c *testing.T) {
  564. // This test cannot run on a Windows daemon as
  565. // Windows does not support symlinks inside a volume path
  566. testRequires(c, DaemonIsLinux)
  567. workingDirectory, err := ioutil.TempDir("", "TestRunVolumesFromSymlinkPath")
  568. assert.NilError(c, err)
  569. name := "docker-test-volumesfromsymlinkpath"
  570. prefix := ""
  571. dfContents := `FROM busybox
  572. RUN ln -s home /foo
  573. VOLUME ["/foo/bar"]`
  574. if testEnv.OSType == "windows" {
  575. prefix = `c:`
  576. dfContents = `FROM ` + testEnv.PlatformDefaults.BaseImage + `
  577. RUN mkdir c:\home
  578. RUN mklink /D c:\foo c:\home
  579. VOLUME ["c:/foo/bar"]
  580. ENTRYPOINT c:\windows\system32\cmd.exe`
  581. }
  582. buildCmd := exec.Command(dockerBinary, "build", "-t", name, "-")
  583. buildCmd.Stdin = strings.NewReader(dfContents)
  584. buildCmd.Dir = workingDirectory
  585. err = buildCmd.Run()
  586. if err != nil {
  587. c.Fatalf("could not build 'docker-test-volumesfromsymlinkpath': %v", err)
  588. }
  589. out, exitCode, err := dockerCmdWithError("run", "--name", "test-volumesfromsymlinkpath", name)
  590. if err != nil || exitCode != 0 {
  591. c.Fatalf("[run] (volume) err: %v, exitcode: %d, out: %s", err, exitCode, out)
  592. }
  593. _, exitCode, err = dockerCmdWithError("run", "--volumes-from", "test-volumesfromsymlinkpath", "busybox", "sh", "-c", "ls "+prefix+"/foo | grep -q bar")
  594. if err != nil || exitCode != 0 {
  595. c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)
  596. }
  597. }
  598. func (s *DockerSuite) TestRunExitCode(c *testing.T) {
  599. var (
  600. exit int
  601. err error
  602. )
  603. _, exit, err = dockerCmdWithError("run", "busybox", "/bin/sh", "-c", "exit 72")
  604. if err == nil {
  605. c.Fatal("should not have a non nil error")
  606. }
  607. if exit != 72 {
  608. c.Fatalf("expected exit code 72 received %d", exit)
  609. }
  610. }
  611. func (s *DockerSuite) TestRunUserDefaults(c *testing.T) {
  612. expected := "uid=0(root) gid=0(root)"
  613. if testEnv.OSType == "windows" {
  614. expected = "uid=0(root) gid=0(root) groups=0(root)"
  615. }
  616. out, _ := dockerCmd(c, "run", "busybox", "id")
  617. if !strings.Contains(out, expected) {
  618. c.Fatalf("expected '%s' got %s", expected, out)
  619. }
  620. }
  621. func (s *DockerSuite) TestRunUserByName(c *testing.T) {
  622. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  623. // not support the use of -u
  624. testRequires(c, DaemonIsLinux)
  625. out, _ := dockerCmd(c, "run", "-u", "root", "busybox", "id")
  626. if !strings.Contains(out, "uid=0(root) gid=0(root)") {
  627. c.Fatalf("expected root user got %s", out)
  628. }
  629. }
  630. func (s *DockerSuite) TestRunUserByID(c *testing.T) {
  631. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  632. // not support the use of -u
  633. testRequires(c, DaemonIsLinux)
  634. out, _ := dockerCmd(c, "run", "-u", "1", "busybox", "id")
  635. if !strings.Contains(out, "uid=1(daemon) gid=1(daemon)") {
  636. c.Fatalf("expected daemon user got %s", out)
  637. }
  638. }
  639. func (s *DockerSuite) TestRunUserByIDBig(c *testing.T) {
  640. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  641. // not support the use of -u
  642. testRequires(c, DaemonIsLinux, NotArm)
  643. out, _, err := dockerCmdWithError("run", "-u", "2147483648", "busybox", "id")
  644. if err == nil {
  645. c.Fatal("No error, but must be.", out)
  646. }
  647. if !strings.Contains(strings.ToLower(out), "uids and gids must be in range") {
  648. c.Fatalf("expected error about uids range, got %s", out)
  649. }
  650. }
  651. func (s *DockerSuite) TestRunUserByIDNegative(c *testing.T) {
  652. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  653. // not support the use of -u
  654. testRequires(c, DaemonIsLinux)
  655. out, _, err := dockerCmdWithError("run", "-u", "-1", "busybox", "id")
  656. if err == nil {
  657. c.Fatal("No error, but must be.", out)
  658. }
  659. if !strings.Contains(strings.ToLower(out), "uids and gids must be in range") {
  660. c.Fatalf("expected error about uids range, got %s", out)
  661. }
  662. }
  663. func (s *DockerSuite) TestRunUserByIDZero(c *testing.T) {
  664. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  665. // not support the use of -u
  666. testRequires(c, DaemonIsLinux)
  667. out, _, err := dockerCmdWithError("run", "-u", "0", "busybox", "id")
  668. if err != nil {
  669. c.Fatal(err, out)
  670. }
  671. if !strings.Contains(out, "uid=0(root) gid=0(root) groups=10(wheel)") {
  672. c.Fatalf("expected daemon user got %s", out)
  673. }
  674. }
  675. func (s *DockerSuite) TestRunUserNotFound(c *testing.T) {
  676. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  677. // not support the use of -u
  678. testRequires(c, DaemonIsLinux)
  679. _, _, err := dockerCmdWithError("run", "-u", "notme", "busybox", "id")
  680. if err == nil {
  681. c.Fatal("unknown user should cause container to fail")
  682. }
  683. }
  684. func (s *DockerSuite) TestRunTwoConcurrentContainers(c *testing.T) {
  685. sleepTime := "2"
  686. group := sync.WaitGroup{}
  687. group.Add(2)
  688. errChan := make(chan error, 2)
  689. for i := 0; i < 2; i++ {
  690. go func() {
  691. defer group.Done()
  692. _, _, err := dockerCmdWithError("run", "busybox", "sleep", sleepTime)
  693. errChan <- err
  694. }()
  695. }
  696. group.Wait()
  697. close(errChan)
  698. for err := range errChan {
  699. assert.NilError(c, err)
  700. }
  701. }
  702. func (s *DockerSuite) TestRunEnvironment(c *testing.T) {
  703. // TODO Windows: Environment handling is different between Linux and
  704. // Windows and this test relies currently on unix functionality.
  705. testRequires(c, DaemonIsLinux)
  706. result := icmd.RunCmd(icmd.Cmd{
  707. Command: []string{dockerBinary, "run", "-h", "testing", "-e=FALSE=true", "-e=TRUE", "-e=TRICKY", "-e=HOME=", "busybox", "env"},
  708. Env: append(os.Environ(),
  709. "TRUE=false",
  710. "TRICKY=tri\ncky\n",
  711. ),
  712. })
  713. result.Assert(c, icmd.Success)
  714. actualEnv := strings.Split(strings.TrimSuffix(result.Stdout(), "\n"), "\n")
  715. sort.Strings(actualEnv)
  716. goodEnv := []string{
  717. // The first two should not be tested here, those are "inherent" environment variable. This test validates
  718. // the -e behavior, not the default environment variable (that could be subject to change)
  719. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  720. "HOSTNAME=testing",
  721. "FALSE=true",
  722. "TRUE=false",
  723. "TRICKY=tri",
  724. "cky",
  725. "",
  726. "HOME=/root",
  727. }
  728. sort.Strings(goodEnv)
  729. if len(goodEnv) != len(actualEnv) {
  730. c.Fatalf("Wrong environment: should be %d variables, not %d: %q", len(goodEnv), len(actualEnv), strings.Join(actualEnv, ", "))
  731. }
  732. for i := range goodEnv {
  733. if actualEnv[i] != goodEnv[i] {
  734. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  735. }
  736. }
  737. }
  738. func (s *DockerSuite) TestRunEnvironmentErase(c *testing.T) {
  739. // TODO Windows: Environment handling is different between Linux and
  740. // Windows and this test relies currently on unix functionality.
  741. testRequires(c, DaemonIsLinux)
  742. // Test to make sure that when we use -e on env vars that are
  743. // not set in our local env that they're removed (if present) in
  744. // the container
  745. result := icmd.RunCmd(icmd.Cmd{
  746. Command: []string{dockerBinary, "run", "-e", "FOO", "-e", "HOSTNAME", "busybox", "env"},
  747. Env: appendBaseEnv(true),
  748. })
  749. result.Assert(c, icmd.Success)
  750. actualEnv := strings.Split(strings.TrimSpace(result.Combined()), "\n")
  751. sort.Strings(actualEnv)
  752. goodEnv := []string{
  753. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  754. "HOME=/root",
  755. }
  756. sort.Strings(goodEnv)
  757. if len(goodEnv) != len(actualEnv) {
  758. c.Fatalf("Wrong environment: should be %d variables, not %d: %q", len(goodEnv), len(actualEnv), strings.Join(actualEnv, ", "))
  759. }
  760. for i := range goodEnv {
  761. if actualEnv[i] != goodEnv[i] {
  762. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  763. }
  764. }
  765. }
  766. func (s *DockerSuite) TestRunEnvironmentOverride(c *testing.T) {
  767. // TODO Windows: Environment handling is different between Linux and
  768. // Windows and this test relies currently on unix functionality.
  769. testRequires(c, DaemonIsLinux)
  770. // Test to make sure that when we use -e on env vars that are
  771. // already in the env that we're overriding them
  772. result := icmd.RunCmd(icmd.Cmd{
  773. Command: []string{dockerBinary, "run", "-e", "HOSTNAME", "-e", "HOME=/root2", "busybox", "env"},
  774. Env: appendBaseEnv(true, "HOSTNAME=bar"),
  775. })
  776. result.Assert(c, icmd.Success)
  777. actualEnv := strings.Split(strings.TrimSpace(result.Combined()), "\n")
  778. sort.Strings(actualEnv)
  779. goodEnv := []string{
  780. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  781. "HOME=/root2",
  782. "HOSTNAME=bar",
  783. }
  784. sort.Strings(goodEnv)
  785. if len(goodEnv) != len(actualEnv) {
  786. c.Fatalf("Wrong environment: should be %d variables, not %d: %q", len(goodEnv), len(actualEnv), strings.Join(actualEnv, ", "))
  787. }
  788. for i := range goodEnv {
  789. if actualEnv[i] != goodEnv[i] {
  790. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  791. }
  792. }
  793. }
  794. func (s *DockerSuite) TestRunContainerNetwork(c *testing.T) {
  795. if testEnv.OSType == "windows" {
  796. // Windows busybox does not have ping. Use built in ping instead.
  797. dockerCmd(c, "run", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
  798. } else {
  799. dockerCmd(c, "run", "busybox", "ping", "-c", "1", "127.0.0.1")
  800. }
  801. }
  802. func (s *DockerSuite) TestRunNetHostNotAllowedWithLinks(c *testing.T) {
  803. // TODO Windows: This is Linux specific as --link is not supported and
  804. // this will be deprecated in favor of container networking model.
  805. testRequires(c, DaemonIsLinux, NotUserNamespace)
  806. dockerCmd(c, "run", "--name", "linked", "busybox", "true")
  807. _, _, err := dockerCmdWithError("run", "--net=host", "--link", "linked:linked", "busybox", "true")
  808. if err == nil {
  809. c.Fatal("Expected error")
  810. }
  811. }
  812. // #7851 hostname outside container shows FQDN, inside only shortname
  813. // For testing purposes it is not required to set host's hostname directly
  814. // and use "--net=host" (as the original issue submitter did), as the same
  815. // codepath is executed with "docker run -h <hostname>". Both were manually
  816. // tested, but this testcase takes the simpler path of using "run -h .."
  817. func (s *DockerSuite) TestRunFullHostnameSet(c *testing.T) {
  818. // TODO Windows: -h is not yet functional.
  819. testRequires(c, DaemonIsLinux)
  820. out, _ := dockerCmd(c, "run", "-h", "foo.bar.baz", "busybox", "hostname")
  821. if actual := strings.Trim(out, "\r\n"); actual != "foo.bar.baz" {
  822. c.Fatalf("expected hostname 'foo.bar.baz', received %s", actual)
  823. }
  824. }
  825. func (s *DockerSuite) TestRunPrivilegedCanMknod(c *testing.T) {
  826. // Not applicable for Windows as Windows daemon does not support
  827. // the concept of --privileged, and mknod is a Unix concept.
  828. testRequires(c, DaemonIsLinux, NotUserNamespace)
  829. out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  830. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  831. c.Fatalf("expected output ok received %s", actual)
  832. }
  833. }
  834. func (s *DockerSuite) TestRunUnprivilegedCanMknod(c *testing.T) {
  835. // Not applicable for Windows as Windows daemon does not support
  836. // the concept of --privileged, and mknod is a Unix concept.
  837. testRequires(c, DaemonIsLinux, NotUserNamespace)
  838. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  839. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  840. c.Fatalf("expected output ok received %s", actual)
  841. }
  842. }
  843. func (s *DockerSuite) TestRunCapDropInvalid(c *testing.T) {
  844. // Not applicable for Windows as there is no concept of --cap-drop
  845. testRequires(c, DaemonIsLinux)
  846. out, _, err := dockerCmdWithError("run", "--cap-drop=CHPASS", "busybox", "ls")
  847. if err == nil {
  848. c.Fatal(err, out)
  849. }
  850. }
  851. func (s *DockerSuite) TestRunCapDropCannotMknod(c *testing.T) {
  852. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  853. testRequires(c, DaemonIsLinux)
  854. out, _, err := dockerCmdWithError("run", "--cap-drop=MKNOD", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  855. if err == nil {
  856. c.Fatal(err, out)
  857. }
  858. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  859. c.Fatalf("expected output not ok received %s", actual)
  860. }
  861. }
  862. func (s *DockerSuite) TestRunCapDropCannotMknodLowerCase(c *testing.T) {
  863. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  864. testRequires(c, DaemonIsLinux)
  865. out, _, err := dockerCmdWithError("run", "--cap-drop=mknod", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  866. if err == nil {
  867. c.Fatal(err, out)
  868. }
  869. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  870. c.Fatalf("expected output not ok received %s", actual)
  871. }
  872. }
  873. func (s *DockerSuite) TestRunCapDropALLCannotMknod(c *testing.T) {
  874. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  875. testRequires(c, DaemonIsLinux)
  876. out, _, err := dockerCmdWithError("run", "--cap-drop=ALL", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  877. if err == nil {
  878. c.Fatal(err, out)
  879. }
  880. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  881. c.Fatalf("expected output not ok received %s", actual)
  882. }
  883. }
  884. func (s *DockerSuite) TestRunCapDropALLAddMknodCanMknod(c *testing.T) {
  885. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  886. testRequires(c, DaemonIsLinux, NotUserNamespace)
  887. out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=MKNOD", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  888. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  889. c.Fatalf("expected output ok received %s", actual)
  890. }
  891. }
  892. func (s *DockerSuite) TestRunCapAddInvalid(c *testing.T) {
  893. // Not applicable for Windows as there is no concept of --cap-add
  894. testRequires(c, DaemonIsLinux)
  895. out, _, err := dockerCmdWithError("run", "--cap-add=CHPASS", "busybox", "ls")
  896. if err == nil {
  897. c.Fatal(err, out)
  898. }
  899. }
  900. func (s *DockerSuite) TestRunCapAddCanDownInterface(c *testing.T) {
  901. // Not applicable for Windows as there is no concept of --cap-add
  902. testRequires(c, DaemonIsLinux)
  903. out, _ := dockerCmd(c, "run", "--cap-add=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  904. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  905. c.Fatalf("expected output ok received %s", actual)
  906. }
  907. }
  908. func (s *DockerSuite) TestRunCapAddALLCanDownInterface(c *testing.T) {
  909. // Not applicable for Windows as there is no concept of --cap-add
  910. testRequires(c, DaemonIsLinux)
  911. out, _ := dockerCmd(c, "run", "--cap-add=ALL", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  912. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  913. c.Fatalf("expected output ok received %s", actual)
  914. }
  915. }
  916. func (s *DockerSuite) TestRunCapAddALLDropNetAdminCanDownInterface(c *testing.T) {
  917. // Not applicable for Windows as there is no concept of --cap-add
  918. testRequires(c, DaemonIsLinux)
  919. out, _, err := dockerCmdWithError("run", "--cap-add=ALL", "--cap-drop=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  920. if err == nil {
  921. c.Fatal(err, out)
  922. }
  923. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  924. c.Fatalf("expected output not ok received %s", actual)
  925. }
  926. }
  927. func (s *DockerSuite) TestRunGroupAdd(c *testing.T) {
  928. // Not applicable for Windows as there is no concept of --group-add
  929. testRequires(c, DaemonIsLinux)
  930. out, _ := dockerCmd(c, "run", "--group-add=audio", "--group-add=staff", "--group-add=777", "busybox", "sh", "-c", "id")
  931. groupsList := "uid=0(root) gid=0(root) groups=10(wheel),29(audio),50(staff),777"
  932. if actual := strings.Trim(out, "\r\n"); actual != groupsList {
  933. c.Fatalf("expected output %s received %s", groupsList, actual)
  934. }
  935. }
  936. func (s *DockerSuite) TestRunPrivilegedCanMount(c *testing.T) {
  937. // Not applicable for Windows as there is no concept of --privileged
  938. testRequires(c, DaemonIsLinux, NotUserNamespace)
  939. out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")
  940. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  941. c.Fatalf("expected output ok received %s", actual)
  942. }
  943. }
  944. func (s *DockerSuite) TestRunUnprivilegedCannotMount(c *testing.T) {
  945. // Not applicable for Windows as there is no concept of unprivileged
  946. testRequires(c, DaemonIsLinux)
  947. out, _, err := dockerCmdWithError("run", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")
  948. if err == nil {
  949. c.Fatal(err, out)
  950. }
  951. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  952. c.Fatalf("expected output not ok received %s", actual)
  953. }
  954. }
  955. func (s *DockerSuite) TestRunSysNotWritableInNonPrivilegedContainers(c *testing.T) {
  956. // Not applicable for Windows as there is no concept of unprivileged
  957. testRequires(c, DaemonIsLinux, NotArm)
  958. if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/sys/kernel/profiling"); err == nil || code == 0 {
  959. c.Fatal("sys should not be writable in a non privileged container")
  960. }
  961. }
  962. func (s *DockerSuite) TestRunSysWritableInPrivilegedContainers(c *testing.T) {
  963. // Not applicable for Windows as there is no concept of unprivileged
  964. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  965. if _, code, err := dockerCmdWithError("run", "--privileged", "busybox", "touch", "/sys/kernel/profiling"); err != nil || code != 0 {
  966. c.Fatalf("sys should be writable in privileged container")
  967. }
  968. }
  969. func (s *DockerSuite) TestRunProcNotWritableInNonPrivilegedContainers(c *testing.T) {
  970. // Not applicable for Windows as there is no concept of unprivileged
  971. testRequires(c, DaemonIsLinux)
  972. if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/proc/sysrq-trigger"); err == nil || code == 0 {
  973. c.Fatal("proc should not be writable in a non privileged container")
  974. }
  975. }
  976. func (s *DockerSuite) TestRunProcWritableInPrivilegedContainers(c *testing.T) {
  977. // Not applicable for Windows as there is no concept of --privileged
  978. testRequires(c, DaemonIsLinux, NotUserNamespace)
  979. if _, code := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "touch /proc/sysrq-trigger"); code != 0 {
  980. c.Fatalf("proc should be writable in privileged container")
  981. }
  982. }
  983. func (s *DockerSuite) TestRunDeviceNumbers(c *testing.T) {
  984. // Not applicable on Windows as /dev/ is a Unix specific concept
  985. // TODO: NotUserNamespace could be removed here if "root" "root" is replaced w user
  986. testRequires(c, DaemonIsLinux, NotUserNamespace)
  987. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "ls -l /dev/null")
  988. deviceLineFields := strings.Fields(out)
  989. deviceLineFields[6] = ""
  990. deviceLineFields[7] = ""
  991. deviceLineFields[8] = ""
  992. expected := []string{"crw-rw-rw-", "1", "root", "root", "1,", "3", "", "", "", "/dev/null"}
  993. if !(reflect.DeepEqual(deviceLineFields, expected)) {
  994. c.Fatalf("expected output\ncrw-rw-rw- 1 root root 1, 3 May 24 13:29 /dev/null\n received\n %s\n", out)
  995. }
  996. }
  997. func (s *DockerSuite) TestRunThatCharacterDevicesActLikeCharacterDevices(c *testing.T) {
  998. // Not applicable on Windows as /dev/ is a Unix specific concept
  999. testRequires(c, DaemonIsLinux)
  1000. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "dd if=/dev/zero of=/zero bs=1k count=5 2> /dev/null ; du -h /zero")
  1001. if actual := strings.Trim(out, "\r\n"); actual[0] == '0' {
  1002. c.Fatalf("expected a new file called /zero to be create that is greater than 0 bytes long, but du says: %s", actual)
  1003. }
  1004. }
  1005. func (s *DockerSuite) TestRunUnprivilegedWithChroot(c *testing.T) {
  1006. // Not applicable on Windows as it does not support chroot
  1007. testRequires(c, DaemonIsLinux)
  1008. dockerCmd(c, "run", "busybox", "chroot", "/", "true")
  1009. }
  1010. func (s *DockerSuite) TestRunAddingOptionalDevices(c *testing.T) {
  1011. // Not applicable on Windows as Windows does not support --device
  1012. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1013. out, _ := dockerCmd(c, "run", "--device", "/dev/zero:/dev/nulo", "busybox", "sh", "-c", "ls /dev/nulo")
  1014. if actual := strings.Trim(out, "\r\n"); actual != "/dev/nulo" {
  1015. c.Fatalf("expected output /dev/nulo, received %s", actual)
  1016. }
  1017. }
  1018. func (s *DockerSuite) TestRunAddingOptionalDevicesNoSrc(c *testing.T) {
  1019. // Not applicable on Windows as Windows does not support --device
  1020. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1021. out, _ := dockerCmd(c, "run", "--device", "/dev/zero:rw", "busybox", "sh", "-c", "ls /dev/zero")
  1022. if actual := strings.Trim(out, "\r\n"); actual != "/dev/zero" {
  1023. c.Fatalf("expected output /dev/zero, received %s", actual)
  1024. }
  1025. }
  1026. func (s *DockerSuite) TestRunAddingOptionalDevicesInvalidMode(c *testing.T) {
  1027. // Not applicable on Windows as Windows does not support --device
  1028. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1029. _, _, err := dockerCmdWithError("run", "--device", "/dev/zero:ro", "busybox", "sh", "-c", "ls /dev/zero")
  1030. if err == nil {
  1031. c.Fatalf("run container with device mode ro should fail")
  1032. }
  1033. }
  1034. func (s *DockerSuite) TestRunModeHostname(c *testing.T) {
  1035. // Not applicable on Windows as Windows does not support -h
  1036. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  1037. out, _ := dockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname")
  1038. if actual := strings.Trim(out, "\r\n"); actual != "testhostname" {
  1039. c.Fatalf("expected 'testhostname', but says: %q", actual)
  1040. }
  1041. out, _ = dockerCmd(c, "run", "--net=host", "busybox", "cat", "/etc/hostname")
  1042. hostname, err := os.Hostname()
  1043. if err != nil {
  1044. c.Fatal(err)
  1045. }
  1046. if actual := strings.Trim(out, "\r\n"); actual != hostname {
  1047. c.Fatalf("expected %q, but says: %q", hostname, actual)
  1048. }
  1049. }
  1050. func (s *DockerSuite) TestRunRootWorkdir(c *testing.T) {
  1051. out, _ := dockerCmd(c, "run", "--workdir", "/", "busybox", "pwd")
  1052. expected := "/\n"
  1053. if testEnv.OSType == "windows" {
  1054. expected = "C:" + expected
  1055. }
  1056. if out != expected {
  1057. c.Fatalf("pwd returned %q (expected %s)", s, expected)
  1058. }
  1059. }
  1060. func (s *DockerSuite) TestRunAllowBindMountingRoot(c *testing.T) {
  1061. if testEnv.OSType == "windows" {
  1062. // Windows busybox will fail with Permission Denied on items such as pagefile.sys
  1063. dockerCmd(c, "run", "-v", `c:\:c:\host`, testEnv.PlatformDefaults.BaseImage, "cmd", "-c", "dir", `c:\host`)
  1064. } else {
  1065. dockerCmd(c, "run", "-v", "/:/host", "busybox", "ls", "/host")
  1066. }
  1067. }
  1068. func (s *DockerSuite) TestRunDisallowBindMountingRootToRoot(c *testing.T) {
  1069. mount := "/:/"
  1070. targetDir := "/host"
  1071. if testEnv.OSType == "windows" {
  1072. mount = `c:\:c\`
  1073. targetDir = "c:/host" // Forward slash as using busybox
  1074. }
  1075. out, _, err := dockerCmdWithError("run", "-v", mount, "busybox", "ls", targetDir)
  1076. if err == nil {
  1077. c.Fatal(out, err)
  1078. }
  1079. }
  1080. // Verify that a container gets default DNS when only localhost resolvers exist
  1081. func (s *DockerSuite) TestRunDNSDefaultOptions(c *testing.T) {
  1082. // Not applicable on Windows as this is testing Unix specific functionality
  1083. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1084. // preserve original resolv.conf for restoring after test
  1085. origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1086. if os.IsNotExist(err) {
  1087. c.Fatalf("/etc/resolv.conf does not exist")
  1088. }
  1089. // defer restored original conf
  1090. defer func() {
  1091. if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
  1092. c.Fatal(err)
  1093. }
  1094. }()
  1095. // test 3 cases: standard IPv4 localhost, commented out localhost, and IPv6 localhost
  1096. // 2 are removed from the file at container start, and the 3rd (commented out) one is ignored by
  1097. // GetNameservers(), leading to a replacement of nameservers with the default set
  1098. tmpResolvConf := []byte("nameserver 127.0.0.1\n#nameserver 127.0.2.1\nnameserver ::1")
  1099. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1100. c.Fatal(err)
  1101. }
  1102. actual, _ := dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
  1103. // check that the actual defaults are appended to the commented out
  1104. // localhost resolver (which should be preserved)
  1105. // NOTE: if we ever change the defaults from google dns, this will break
  1106. expected := "#nameserver 127.0.2.1\n\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"
  1107. if actual != expected {
  1108. c.Fatalf("expected resolv.conf be: %q, but was: %q", expected, actual)
  1109. }
  1110. }
  1111. func (s *DockerSuite) TestRunDNSOptions(c *testing.T) {
  1112. // Not applicable on Windows as Windows does not support --dns*, or
  1113. // the Unix-specific functionality of resolv.conf.
  1114. testRequires(c, DaemonIsLinux)
  1115. result := cli.DockerCmd(c, "run", "--dns=127.0.0.1", "--dns-search=mydomain", "--dns-opt=ndots:9", "busybox", "cat", "/etc/resolv.conf")
  1116. // The client will get a warning on stderr when setting DNS to a localhost address; verify this:
  1117. if !strings.Contains(result.Stderr(), "Localhost DNS setting") {
  1118. c.Fatalf("Expected warning on stderr about localhost resolver, but got %q", result.Stderr())
  1119. }
  1120. actual := strings.Replace(strings.Trim(result.Stdout(), "\r\n"), "\n", " ", -1)
  1121. if actual != "search mydomain nameserver 127.0.0.1 options ndots:9" {
  1122. c.Fatalf("expected 'search mydomain nameserver 127.0.0.1 options ndots:9', but says: %q", actual)
  1123. }
  1124. out := cli.DockerCmd(c, "run", "--dns=1.1.1.1", "--dns-search=.", "--dns-opt=ndots:3", "busybox", "cat", "/etc/resolv.conf").Combined()
  1125. actual = strings.Replace(strings.Trim(strings.Trim(out, "\r\n"), " "), "\n", " ", -1)
  1126. if actual != "nameserver 1.1.1.1 options ndots:3" {
  1127. c.Fatalf("expected 'nameserver 1.1.1.1 options ndots:3', but says: %q", actual)
  1128. }
  1129. }
  1130. func (s *DockerSuite) TestRunDNSRepeatOptions(c *testing.T) {
  1131. testRequires(c, DaemonIsLinux)
  1132. out := cli.DockerCmd(c, "run", "--dns=1.1.1.1", "--dns=2.2.2.2", "--dns-search=mydomain", "--dns-search=mydomain2", "--dns-opt=ndots:9", "--dns-opt=timeout:3", "busybox", "cat", "/etc/resolv.conf").Stdout()
  1133. actual := strings.Replace(strings.Trim(out, "\r\n"), "\n", " ", -1)
  1134. if actual != "search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3" {
  1135. c.Fatalf("expected 'search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3', but says: %q", actual)
  1136. }
  1137. }
  1138. func (s *DockerSuite) TestRunDNSOptionsBasedOnHostResolvConf(c *testing.T) {
  1139. // Not applicable on Windows as testing Unix specific functionality
  1140. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1141. origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1142. if os.IsNotExist(err) {
  1143. c.Fatalf("/etc/resolv.conf does not exist")
  1144. }
  1145. hostNameservers := resolvconf.GetNameservers(origResolvConf, types.IP)
  1146. hostSearch := resolvconf.GetSearchDomains(origResolvConf)
  1147. var out string
  1148. out, _ = dockerCmd(c, "run", "--dns=127.0.0.1", "busybox", "cat", "/etc/resolv.conf")
  1149. if actualNameservers := resolvconf.GetNameservers([]byte(out), types.IP); actualNameservers[0] != "127.0.0.1" {
  1150. c.Fatalf("expected '127.0.0.1', but says: %q", actualNameservers[0])
  1151. }
  1152. actualSearch := resolvconf.GetSearchDomains([]byte(out))
  1153. if len(actualSearch) != len(hostSearch) {
  1154. c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))
  1155. }
  1156. for i := range actualSearch {
  1157. if actualSearch[i] != hostSearch[i] {
  1158. c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])
  1159. }
  1160. }
  1161. out, _ = dockerCmd(c, "run", "--dns-search=mydomain", "busybox", "cat", "/etc/resolv.conf")
  1162. actualNameservers := resolvconf.GetNameservers([]byte(out), types.IP)
  1163. if len(actualNameservers) != len(hostNameservers) {
  1164. c.Fatalf("expected %q nameserver(s), but it has: %q", len(hostNameservers), len(actualNameservers))
  1165. }
  1166. for i := range actualNameservers {
  1167. if actualNameservers[i] != hostNameservers[i] {
  1168. c.Fatalf("expected %q nameserver, but says: %q", actualNameservers[i], hostNameservers[i])
  1169. }
  1170. }
  1171. if actualSearch = resolvconf.GetSearchDomains([]byte(out)); actualSearch[0] != "mydomain" {
  1172. c.Fatalf("expected 'mydomain', but says: %q", actualSearch[0])
  1173. }
  1174. // test with file
  1175. tmpResolvConf := []byte("search example.com\nnameserver 12.34.56.78\nnameserver 127.0.0.1")
  1176. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1177. c.Fatal(err)
  1178. }
  1179. // put the old resolvconf back
  1180. defer func() {
  1181. if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
  1182. c.Fatal(err)
  1183. }
  1184. }()
  1185. resolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1186. if os.IsNotExist(err) {
  1187. c.Fatalf("/etc/resolv.conf does not exist")
  1188. }
  1189. hostSearch = resolvconf.GetSearchDomains(resolvConf)
  1190. out, _ = dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
  1191. if actualNameservers = resolvconf.GetNameservers([]byte(out), types.IP); actualNameservers[0] != "12.34.56.78" || len(actualNameservers) != 1 {
  1192. c.Fatalf("expected '12.34.56.78', but has: %v", actualNameservers)
  1193. }
  1194. actualSearch = resolvconf.GetSearchDomains([]byte(out))
  1195. if len(actualSearch) != len(hostSearch) {
  1196. c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))
  1197. }
  1198. for i := range actualSearch {
  1199. if actualSearch[i] != hostSearch[i] {
  1200. c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])
  1201. }
  1202. }
  1203. }
  1204. // Test to see if a non-root user can resolve a DNS name. Also
  1205. // check if the container resolv.conf file has at least 0644 perm.
  1206. func (s *DockerSuite) TestRunNonRootUserResolvName(c *testing.T) {
  1207. // Not applicable on Windows as Windows does not support --user
  1208. testRequires(c, testEnv.IsLocalDaemon, Network, DaemonIsLinux, NotArm)
  1209. dockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "example.com")
  1210. cID := getIDByName(c, "testperm")
  1211. fmode := (os.FileMode)(0644)
  1212. finfo, err := os.Stat(containerStorageFile(cID, "resolv.conf"))
  1213. if err != nil {
  1214. c.Fatal(err)
  1215. }
  1216. if (finfo.Mode() & fmode) != fmode {
  1217. c.Fatalf("Expected container resolv.conf mode to be at least %s, instead got %s", fmode.String(), finfo.Mode().String())
  1218. }
  1219. }
  1220. // Test if container resolv.conf gets updated the next time it restarts
  1221. // if host /etc/resolv.conf has changed. This only applies if the container
  1222. // uses the host's /etc/resolv.conf and does not have any dns options provided.
  1223. func (s *DockerSuite) TestRunResolvconfUpdate(c *testing.T) {
  1224. // Not applicable on Windows as testing unix specific functionality
  1225. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1226. c.Skip("Unstable test, to be re-activated once #19937 is resolved")
  1227. tmpResolvConf := []byte("search pommesfrites.fr\nnameserver 12.34.56.78\n")
  1228. tmpLocalhostResolvConf := []byte("nameserver 127.0.0.1")
  1229. // take a copy of resolv.conf for restoring after test completes
  1230. resolvConfSystem, err := ioutil.ReadFile("/etc/resolv.conf")
  1231. if err != nil {
  1232. c.Fatal(err)
  1233. }
  1234. // This test case is meant to test monitoring resolv.conf when it is
  1235. // a regular file not a bind mounc. So we unmount resolv.conf and replace
  1236. // it with a file containing the original settings.
  1237. mounted, err := mountinfo.Mounted("/etc/resolv.conf")
  1238. if err != nil {
  1239. c.Fatal(err)
  1240. }
  1241. if mounted {
  1242. icmd.RunCommand("umount", "/etc/resolv.conf").Assert(c, icmd.Success)
  1243. }
  1244. // cleanup
  1245. defer func() {
  1246. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1247. c.Fatal(err)
  1248. }
  1249. }()
  1250. // 1. test that a restarting container gets an updated resolv.conf
  1251. dockerCmd(c, "run", "--name=first", "busybox", "true")
  1252. containerID1 := getIDByName(c, "first")
  1253. // replace resolv.conf with our temporary copy
  1254. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1255. c.Fatal(err)
  1256. }
  1257. // start the container again to pickup changes
  1258. dockerCmd(c, "start", "first")
  1259. // check for update in container
  1260. containerResolv := readContainerFile(c, containerID1, "resolv.conf")
  1261. if !bytes.Equal(containerResolv, tmpResolvConf) {
  1262. c.Fatalf("Restarted container does not have updated resolv.conf; expected %q, got %q", tmpResolvConf, string(containerResolv))
  1263. }
  1264. /* // make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
  1265. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1266. c.Fatal(err)
  1267. } */
  1268. // 2. test that a restarting container does not receive resolv.conf updates
  1269. // if it modified the container copy of the starting point resolv.conf
  1270. dockerCmd(c, "run", "--name=second", "busybox", "sh", "-c", "echo 'search mylittlepony.com' >>/etc/resolv.conf")
  1271. containerID2 := getIDByName(c, "second")
  1272. // make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
  1273. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1274. c.Fatal(err)
  1275. }
  1276. // start the container again
  1277. dockerCmd(c, "start", "second")
  1278. // check for update in container
  1279. containerResolv = readContainerFile(c, containerID2, "resolv.conf")
  1280. if bytes.Equal(containerResolv, resolvConfSystem) {
  1281. c.Fatalf("Container's resolv.conf should not have been updated with host resolv.conf: %q", string(containerResolv))
  1282. }
  1283. // 3. test that a running container's resolv.conf is not modified while running
  1284. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  1285. runningContainerID := strings.TrimSpace(out)
  1286. // replace resolv.conf
  1287. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1288. c.Fatal(err)
  1289. }
  1290. // check for update in container
  1291. containerResolv = readContainerFile(c, runningContainerID, "resolv.conf")
  1292. if bytes.Equal(containerResolv, tmpResolvConf) {
  1293. c.Fatalf("Running container should not have updated resolv.conf; expected %q, got %q", string(resolvConfSystem), string(containerResolv))
  1294. }
  1295. // 4. test that a running container's resolv.conf is updated upon restart
  1296. // (the above container is still running..)
  1297. dockerCmd(c, "restart", runningContainerID)
  1298. // check for update in container
  1299. containerResolv = readContainerFile(c, runningContainerID, "resolv.conf")
  1300. if !bytes.Equal(containerResolv, tmpResolvConf) {
  1301. c.Fatalf("Restarted container should have updated resolv.conf; expected %q, got %q", string(tmpResolvConf), string(containerResolv))
  1302. }
  1303. // 5. test that additions of a localhost resolver are cleaned from
  1304. // host resolv.conf before updating container's resolv.conf copies
  1305. // replace resolv.conf with a localhost-only nameserver copy
  1306. if err = ioutil.WriteFile("/etc/resolv.conf", tmpLocalhostResolvConf, 0644); err != nil {
  1307. c.Fatal(err)
  1308. }
  1309. // start the container again to pickup changes
  1310. dockerCmd(c, "start", "first")
  1311. // our first exited container ID should have been updated, but with default DNS
  1312. // after the cleanup of resolv.conf found only a localhost nameserver:
  1313. containerResolv = readContainerFile(c, containerID1, "resolv.conf")
  1314. expected := "\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"
  1315. if !bytes.Equal(containerResolv, []byte(expected)) {
  1316. c.Fatalf("Container does not have cleaned/replaced DNS in resolv.conf; expected %q, got %q", expected, string(containerResolv))
  1317. }
  1318. // 6. Test that replacing (as opposed to modifying) resolv.conf triggers an update
  1319. // of containers' resolv.conf.
  1320. // Restore the original resolv.conf
  1321. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1322. c.Fatal(err)
  1323. }
  1324. // Run the container so it picks up the old settings
  1325. dockerCmd(c, "run", "--name=third", "busybox", "true")
  1326. containerID3 := getIDByName(c, "third")
  1327. // Create a modified resolv.conf.aside and override resolv.conf with it
  1328. if err := ioutil.WriteFile("/etc/resolv.conf.aside", tmpResolvConf, 0644); err != nil {
  1329. c.Fatal(err)
  1330. }
  1331. err = os.Rename("/etc/resolv.conf.aside", "/etc/resolv.conf")
  1332. if err != nil {
  1333. c.Fatal(err)
  1334. }
  1335. // start the container again to pickup changes
  1336. dockerCmd(c, "start", "third")
  1337. // check for update in container
  1338. containerResolv = readContainerFile(c, containerID3, "resolv.conf")
  1339. if !bytes.Equal(containerResolv, tmpResolvConf) {
  1340. c.Fatalf("Stopped container does not have updated resolv.conf; expected\n%q\n got\n%q", tmpResolvConf, string(containerResolv))
  1341. }
  1342. // cleanup, restore original resolv.conf happens in defer func()
  1343. }
  1344. func (s *DockerSuite) TestRunAddHost(c *testing.T) {
  1345. // Not applicable on Windows as it does not support --add-host
  1346. testRequires(c, DaemonIsLinux)
  1347. out, _ := dockerCmd(c, "run", "--add-host=extra:86.75.30.9", "busybox", "grep", "extra", "/etc/hosts")
  1348. actual := strings.Trim(out, "\r\n")
  1349. if actual != "86.75.30.9\textra" {
  1350. c.Fatalf("expected '86.75.30.9\textra', but says: %q", actual)
  1351. }
  1352. }
  1353. // Regression test for #6983
  1354. func (s *DockerSuite) TestRunAttachStdErrOnlyTTYMode(c *testing.T) {
  1355. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stderr", "busybox", "true")
  1356. if exitCode != 0 {
  1357. c.Fatalf("Container should have exited with error code 0")
  1358. }
  1359. }
  1360. // Regression test for #6983
  1361. func (s *DockerSuite) TestRunAttachStdOutOnlyTTYMode(c *testing.T) {
  1362. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "busybox", "true")
  1363. if exitCode != 0 {
  1364. c.Fatalf("Container should have exited with error code 0")
  1365. }
  1366. }
  1367. // Regression test for #6983
  1368. func (s *DockerSuite) TestRunAttachStdOutAndErrTTYMode(c *testing.T) {
  1369. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "-a", "stderr", "busybox", "true")
  1370. if exitCode != 0 {
  1371. c.Fatalf("Container should have exited with error code 0")
  1372. }
  1373. }
  1374. // Test for #10388 - this will run the same test as TestRunAttachStdOutAndErrTTYMode
  1375. // but using --attach instead of -a to make sure we read the flag correctly
  1376. func (s *DockerSuite) TestRunAttachWithDetach(c *testing.T) {
  1377. icmd.RunCommand(dockerBinary, "run", "-d", "--attach", "stdout", "busybox", "true").Assert(c, icmd.Expected{
  1378. ExitCode: 1,
  1379. Error: "exit status 1",
  1380. Err: "Conflicting options: -a and -d",
  1381. })
  1382. }
  1383. func (s *DockerSuite) TestRunState(c *testing.T) {
  1384. // TODO Windows: This needs some rework as Windows busybox does not support top
  1385. testRequires(c, DaemonIsLinux)
  1386. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  1387. id := strings.TrimSpace(out)
  1388. state := inspectField(c, id, "State.Running")
  1389. if state != "true" {
  1390. c.Fatal("Container state is 'not running'")
  1391. }
  1392. pid1 := inspectField(c, id, "State.Pid")
  1393. if pid1 == "0" {
  1394. c.Fatal("Container state Pid 0")
  1395. }
  1396. dockerCmd(c, "stop", id)
  1397. state = inspectField(c, id, "State.Running")
  1398. if state != "false" {
  1399. c.Fatal("Container state is 'running'")
  1400. }
  1401. pid2 := inspectField(c, id, "State.Pid")
  1402. if pid2 == pid1 {
  1403. c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)
  1404. }
  1405. dockerCmd(c, "start", id)
  1406. state = inspectField(c, id, "State.Running")
  1407. if state != "true" {
  1408. c.Fatal("Container state is 'not running'")
  1409. }
  1410. pid3 := inspectField(c, id, "State.Pid")
  1411. if pid3 == pid1 {
  1412. c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)
  1413. }
  1414. }
  1415. // Test for #1737
  1416. func (s *DockerSuite) TestRunCopyVolumeUIDGID(c *testing.T) {
  1417. // Not applicable on Windows as it does not support uid or gid in this way
  1418. testRequires(c, DaemonIsLinux)
  1419. name := "testrunvolumesuidgid"
  1420. buildImageSuccessfully(c, name, build.WithDockerfile(`FROM busybox
  1421. RUN echo 'dockerio:x:1001:1001::/bin:/bin/false' >> /etc/passwd
  1422. RUN echo 'dockerio:x:1001:' >> /etc/group
  1423. RUN mkdir -p /hello && touch /hello/test && chown dockerio.dockerio /hello`))
  1424. // Test that the uid and gid is copied from the image to the volume
  1425. out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "sh", "-c", "ls -l / | grep hello | awk '{print $3\":\"$4}'")
  1426. out = strings.TrimSpace(out)
  1427. if out != "dockerio:dockerio" {
  1428. c.Fatalf("Wrong /hello ownership: %s, expected dockerio:dockerio", out)
  1429. }
  1430. }
  1431. // Test for #1582
  1432. func (s *DockerSuite) TestRunCopyVolumeContent(c *testing.T) {
  1433. // TODO Windows, post RS1. Windows does not yet support volume functionality
  1434. // that copies from the image to the volume.
  1435. testRequires(c, DaemonIsLinux)
  1436. name := "testruncopyvolumecontent"
  1437. buildImageSuccessfully(c, name, build.WithDockerfile(`FROM busybox
  1438. RUN mkdir -p /hello/local && echo hello > /hello/local/world`))
  1439. // Test that the content is copied from the image to the volume
  1440. out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "find", "/hello")
  1441. if !(strings.Contains(out, "/hello/local/world") && strings.Contains(out, "/hello/local")) {
  1442. c.Fatal("Container failed to transfer content to volume")
  1443. }
  1444. }
  1445. func (s *DockerSuite) TestRunCleanupCmdOnEntrypoint(c *testing.T) {
  1446. name := "testrunmdcleanuponentrypoint"
  1447. buildImageSuccessfully(c, name, build.WithDockerfile(`FROM busybox
  1448. ENTRYPOINT ["echo"]
  1449. CMD ["testingpoint"]`))
  1450. out, exit := dockerCmd(c, "run", "--entrypoint", "whoami", name)
  1451. if exit != 0 {
  1452. c.Fatalf("expected exit code 0 received %d, out: %q", exit, out)
  1453. }
  1454. out = strings.TrimSpace(out)
  1455. expected := "root"
  1456. if testEnv.OSType == "windows" {
  1457. if strings.Contains(testEnv.PlatformDefaults.BaseImage, "servercore") {
  1458. expected = `user manager\containeradministrator`
  1459. } else {
  1460. expected = `ContainerAdministrator` // nanoserver
  1461. }
  1462. }
  1463. if out != expected {
  1464. c.Fatalf("Expected output %s, got %q. %s", expected, out, testEnv.PlatformDefaults.BaseImage)
  1465. }
  1466. }
  1467. // TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected
  1468. func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *testing.T) {
  1469. existingFile := "/bin/cat"
  1470. expected := "not a directory"
  1471. if testEnv.OSType == "windows" {
  1472. existingFile = `\windows\system32\ntdll.dll`
  1473. expected = `The directory name is invalid.`
  1474. }
  1475. out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox")
  1476. if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) {
  1477. c.Fatalf("Existing binary as a directory should error out with exitCode 125; we got: %s, exitCode: %d", out, exitCode)
  1478. }
  1479. }
  1480. func (s *DockerSuite) TestRunExitOnStdinClose(c *testing.T) {
  1481. name := "testrunexitonstdinclose"
  1482. meow := "/bin/cat"
  1483. delay := 60
  1484. if testEnv.OSType == "windows" {
  1485. meow = "cat"
  1486. }
  1487. runCmd := exec.Command(dockerBinary, "run", "--name", name, "-i", "busybox", meow)
  1488. stdin, err := runCmd.StdinPipe()
  1489. if err != nil {
  1490. c.Fatal(err)
  1491. }
  1492. stdout, err := runCmd.StdoutPipe()
  1493. if err != nil {
  1494. c.Fatal(err)
  1495. }
  1496. if err := runCmd.Start(); err != nil {
  1497. c.Fatal(err)
  1498. }
  1499. if _, err := stdin.Write([]byte("hello\n")); err != nil {
  1500. c.Fatal(err)
  1501. }
  1502. r := bufio.NewReader(stdout)
  1503. line, err := r.ReadString('\n')
  1504. if err != nil {
  1505. c.Fatal(err)
  1506. }
  1507. line = strings.TrimSpace(line)
  1508. if line != "hello" {
  1509. c.Fatalf("Output should be 'hello', got '%q'", line)
  1510. }
  1511. if err := stdin.Close(); err != nil {
  1512. c.Fatal(err)
  1513. }
  1514. finish := make(chan error, 1)
  1515. go func() {
  1516. finish <- runCmd.Wait()
  1517. close(finish)
  1518. }()
  1519. select {
  1520. case err := <-finish:
  1521. assert.NilError(c, err)
  1522. case <-time.After(time.Duration(delay) * time.Second):
  1523. c.Fatal("docker run failed to exit on stdin close")
  1524. }
  1525. state := inspectField(c, name, "State.Running")
  1526. if state != "false" {
  1527. c.Fatal("Container must be stopped after stdin closing")
  1528. }
  1529. }
  1530. // Test run -i --restart xxx doesn't hang
  1531. func (s *DockerSuite) TestRunInteractiveWithRestartPolicy(c *testing.T) {
  1532. name := "test-inter-restart"
  1533. result := icmd.RunCmd(icmd.Cmd{
  1534. Command: []string{dockerBinary, "run", "-i", "--name", name, "--restart=always", "busybox", "sh"},
  1535. Stdin: bytes.NewBufferString("exit 11"),
  1536. })
  1537. defer func() {
  1538. cli.Docker(cli.Args("stop", name)).Assert(c, icmd.Success)
  1539. }()
  1540. result.Assert(c, icmd.Expected{ExitCode: 11})
  1541. }
  1542. // Test for #2267
  1543. func (s *DockerSuite) TestRunWriteSpecialFilesAndNotCommit(c *testing.T) {
  1544. // Cannot run on Windows as this files are not present in Windows
  1545. testRequires(c, DaemonIsLinux)
  1546. testRunWriteSpecialFilesAndNotCommit(c, "writehosts", "/etc/hosts")
  1547. testRunWriteSpecialFilesAndNotCommit(c, "writehostname", "/etc/hostname")
  1548. testRunWriteSpecialFilesAndNotCommit(c, "writeresolv", "/etc/resolv.conf")
  1549. }
  1550. func testRunWriteSpecialFilesAndNotCommit(c *testing.T, name, path string) {
  1551. command := fmt.Sprintf("echo test2267 >> %s && cat %s", path, path)
  1552. out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", command)
  1553. if !strings.Contains(out, "test2267") {
  1554. c.Fatalf("%s should contain 'test2267'", path)
  1555. }
  1556. out, _ = dockerCmd(c, "diff", name)
  1557. if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
  1558. c.Fatal("diff should be empty")
  1559. }
  1560. }
  1561. func eqToBaseDiff(out string, c *testing.T) bool {
  1562. name := "eqToBaseDiff" + testutil.GenerateRandomAlphaOnlyString(32)
  1563. dockerCmd(c, "run", "--name", name, "busybox", "echo", "hello")
  1564. cID := getIDByName(c, name)
  1565. baseDiff, _ := dockerCmd(c, "diff", cID)
  1566. baseArr := strings.Split(baseDiff, "\n")
  1567. sort.Strings(baseArr)
  1568. outArr := strings.Split(out, "\n")
  1569. sort.Strings(outArr)
  1570. return sliceEq(baseArr, outArr)
  1571. }
  1572. func sliceEq(a, b []string) bool {
  1573. if len(a) != len(b) {
  1574. return false
  1575. }
  1576. for i := range a {
  1577. if a[i] != b[i] {
  1578. return false
  1579. }
  1580. }
  1581. return true
  1582. }
  1583. func (s *DockerSuite) TestRunWithBadDevice(c *testing.T) {
  1584. // Cannot run on Windows as Windows does not support --device
  1585. testRequires(c, DaemonIsLinux)
  1586. name := "baddevice"
  1587. out, _, err := dockerCmdWithError("run", "--name", name, "--device", "/etc", "busybox", "true")
  1588. if err == nil {
  1589. c.Fatal("Run should fail with bad device")
  1590. }
  1591. expected := `"/etc": not a device node`
  1592. if !strings.Contains(out, expected) {
  1593. c.Fatalf("Output should contain %q, actual out: %q", expected, out)
  1594. }
  1595. }
  1596. func (s *DockerSuite) TestRunEntrypoint(c *testing.T) {
  1597. name := "entrypoint"
  1598. out, _ := dockerCmd(c, "run", "--name", name, "--entrypoint", "echo", "busybox", "-n", "foobar")
  1599. expected := "foobar"
  1600. if out != expected {
  1601. c.Fatalf("Output should be %q, actual out: %q", expected, out)
  1602. }
  1603. }
  1604. func (s *DockerSuite) TestRunBindMounts(c *testing.T) {
  1605. testRequires(c, testEnv.IsLocalDaemon)
  1606. if testEnv.OSType == "linux" {
  1607. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1608. }
  1609. if testEnv.OSType == "windows" {
  1610. // Disabled prior to RS5 due to how volumes are mapped
  1611. testRequires(c, DaemonIsWindowsAtLeastBuild(osversion.RS5))
  1612. }
  1613. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  1614. tmpDir, err := ioutil.TempDir("", "docker-test-container")
  1615. if err != nil {
  1616. c.Fatal(err)
  1617. }
  1618. defer os.RemoveAll(tmpDir)
  1619. writeFile(path.Join(tmpDir, "touch-me"), "", c)
  1620. // Test reading from a read-only bind mount
  1621. out, _ := dockerCmd(c, "run", "-v", fmt.Sprintf("%s:%s/tmpx:ro", tmpDir, prefix), "busybox", "ls", prefix+"/tmpx")
  1622. if !strings.Contains(out, "touch-me") {
  1623. c.Fatal("Container failed to read from bind mount")
  1624. }
  1625. // test writing to bind mount
  1626. if testEnv.OSType == "windows" {
  1627. dockerCmd(c, "run", "-v", fmt.Sprintf(`%s:c:\tmp:rw`, tmpDir), "busybox", "touch", "c:/tmp/holla")
  1628. } else {
  1629. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:rw", tmpDir), "busybox", "touch", "/tmp/holla")
  1630. }
  1631. readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
  1632. // test mounting to an illegal destination directory
  1633. _, _, err = dockerCmdWithError("run", "-v", fmt.Sprintf("%s:.", tmpDir), "busybox", "ls", ".")
  1634. if err == nil {
  1635. c.Fatal("Container bind mounted illegal directory")
  1636. }
  1637. // Windows does not (and likely never will) support mounting a single file
  1638. if testEnv.OSType != "windows" {
  1639. // test mount a file
  1640. dockerCmd(c, "run", "-v", fmt.Sprintf("%s/holla:/tmp/holla:rw", tmpDir), "busybox", "sh", "-c", "echo -n 'yotta' > /tmp/holla")
  1641. content := readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
  1642. expected := "yotta"
  1643. if content != expected {
  1644. c.Fatalf("Output should be %q, actual out: %q", expected, content)
  1645. }
  1646. }
  1647. }
  1648. // Ensure that CIDFile gets deleted if it's empty
  1649. // Perform this test by making `docker run` fail
  1650. func (s *DockerSuite) TestRunCidFileCleanupIfEmpty(c *testing.T) {
  1651. // Skip on Windows. Base image on Windows has a CMD set in the image.
  1652. testRequires(c, DaemonIsLinux)
  1653. tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
  1654. if err != nil {
  1655. c.Fatal(err)
  1656. }
  1657. defer os.RemoveAll(tmpDir)
  1658. tmpCidFile := path.Join(tmpDir, "cid")
  1659. image := "emptyfs"
  1660. if testEnv.OSType == "windows" {
  1661. // Windows can't support an emptyfs image. Just use the regular Windows image
  1662. image = testEnv.PlatformDefaults.BaseImage
  1663. }
  1664. out, _, err := dockerCmdWithError("run", "--cidfile", tmpCidFile, image)
  1665. if err == nil {
  1666. c.Fatalf("Run without command must fail. out=%s", out)
  1667. } else if !strings.Contains(out, "No command specified") {
  1668. c.Fatalf("Run without command failed with wrong output. out=%s\nerr=%v", out, err)
  1669. }
  1670. if _, err := os.Stat(tmpCidFile); err == nil {
  1671. c.Fatalf("empty CIDFile %q should've been deleted", tmpCidFile)
  1672. }
  1673. }
  1674. // #2098 - Docker cidFiles only contain short version of the containerId
  1675. // sudo docker run --cidfile /tmp/docker_tesc.cid ubuntu echo "test"
  1676. // TestRunCidFile tests that run --cidfile returns the longid
  1677. func (s *DockerSuite) TestRunCidFileCheckIDLength(c *testing.T) {
  1678. tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
  1679. if err != nil {
  1680. c.Fatal(err)
  1681. }
  1682. tmpCidFile := path.Join(tmpDir, "cid")
  1683. defer os.RemoveAll(tmpDir)
  1684. out, _ := dockerCmd(c, "run", "-d", "--cidfile", tmpCidFile, "busybox", "true")
  1685. id := strings.TrimSpace(out)
  1686. buffer, err := ioutil.ReadFile(tmpCidFile)
  1687. if err != nil {
  1688. c.Fatal(err)
  1689. }
  1690. cid := string(buffer)
  1691. if len(cid) != 64 {
  1692. c.Fatalf("--cidfile should be a long id, not %q", id)
  1693. }
  1694. if cid != id {
  1695. c.Fatalf("cid must be equal to %s, got %s", id, cid)
  1696. }
  1697. }
  1698. func (s *DockerSuite) TestRunSetMacAddress(c *testing.T) {
  1699. mac := "12:34:56:78:9a:bc"
  1700. var out string
  1701. if testEnv.OSType == "windows" {
  1702. out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "sh", "-c", "ipconfig /all | grep 'Physical Address' | awk '{print $12}'")
  1703. mac = strings.Replace(strings.ToUpper(mac), ":", "-", -1) // To Windows-style MACs
  1704. } else {
  1705. out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "/bin/sh", "-c", "ip link show eth0 | tail -1 | awk '{print $2}'")
  1706. }
  1707. actualMac := strings.TrimSpace(out)
  1708. if actualMac != mac {
  1709. c.Fatalf("Set MAC address with --mac-address failed. The container has an incorrect MAC address: %q, expected: %q", actualMac, mac)
  1710. }
  1711. }
  1712. func (s *DockerSuite) TestRunInspectMacAddress(c *testing.T) {
  1713. // TODO Windows. Network settings are not propagated back to inspect.
  1714. testRequires(c, DaemonIsLinux)
  1715. mac := "12:34:56:78:9a:bc"
  1716. out, _ := dockerCmd(c, "run", "-d", "--mac-address="+mac, "busybox", "top")
  1717. id := strings.TrimSpace(out)
  1718. inspectedMac := inspectField(c, id, "NetworkSettings.Networks.bridge.MacAddress")
  1719. if inspectedMac != mac {
  1720. c.Fatalf("docker inspect outputs wrong MAC address: %q, should be: %q", inspectedMac, mac)
  1721. }
  1722. }
  1723. // test docker run use an invalid mac address
  1724. func (s *DockerSuite) TestRunWithInvalidMacAddress(c *testing.T) {
  1725. out, _, err := dockerCmdWithError("run", "--mac-address", "92:d0:c6:0a:29", "busybox")
  1726. // use an invalid mac address should with an error out
  1727. if err == nil || !strings.Contains(out, "is not a valid mac address") {
  1728. c.Fatalf("run with an invalid --mac-address should with error out")
  1729. }
  1730. }
  1731. func (s *DockerSuite) TestRunDeallocatePortOnMissingIptablesRule(c *testing.T) {
  1732. // TODO Windows. Network settings are not propagated back to inspect.
  1733. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1734. out := cli.DockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top").Combined()
  1735. id := strings.TrimSpace(out)
  1736. ip := inspectField(c, id, "NetworkSettings.Networks.bridge.IPAddress")
  1737. icmd.RunCommand("iptables", "-D", "DOCKER", "-d", fmt.Sprintf("%s/32", ip),
  1738. "!", "-i", "docker0", "-o", "docker0", "-p", "tcp", "-m", "tcp", "--dport", "23", "-j", "ACCEPT").Assert(c, icmd.Success)
  1739. cli.DockerCmd(c, "rm", "-fv", id)
  1740. cli.DockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top")
  1741. }
  1742. func (s *DockerSuite) TestRunPortInUse(c *testing.T) {
  1743. // TODO Windows. The duplicate NAT message returned by Windows will be
  1744. // changing as is currently completely undecipherable. Does need modifying
  1745. // to run sh rather than top though as top isn't in Windows busybox.
  1746. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1747. port := "1234"
  1748. dockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")
  1749. out, _, err := dockerCmdWithError("run", "-d", "-p", port+":80", "busybox", "top")
  1750. if err == nil {
  1751. c.Fatalf("Binding on used port must fail")
  1752. }
  1753. if !strings.Contains(out, "port is already allocated") {
  1754. c.Fatalf("Out must be about \"port is already allocated\", got %s", out)
  1755. }
  1756. }
  1757. // https://github.com/docker/docker/issues/12148
  1758. func (s *DockerSuite) TestRunAllocatePortInReservedRange(c *testing.T) {
  1759. // TODO Windows. -P is not yet supported
  1760. testRequires(c, DaemonIsLinux)
  1761. // allocate a dynamic port to get the most recent
  1762. out, _ := dockerCmd(c, "run", "-d", "-P", "-p", "80", "busybox", "top")
  1763. id := strings.TrimSpace(out)
  1764. out, _ = dockerCmd(c, "port", id, "80")
  1765. strPort := strings.Split(strings.TrimSpace(out), ":")[1]
  1766. port, err := strconv.ParseInt(strPort, 10, 64)
  1767. if err != nil {
  1768. c.Fatalf("invalid port, got: %s, error: %s", strPort, err)
  1769. }
  1770. // allocate a static port and a dynamic port together, with static port
  1771. // takes the next recent port in dynamic port range.
  1772. dockerCmd(c, "run", "-d", "-P", "-p", "80", "-p", fmt.Sprintf("%d:8080", port+1), "busybox", "top")
  1773. }
  1774. // Regression test for #7792
  1775. func (s *DockerSuite) TestRunMountOrdering(c *testing.T) {
  1776. // TODO Windows: Post RS1. Windows does not support nested mounts.
  1777. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  1778. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  1779. tmpDir, err := ioutil.TempDir("", "docker_nested_mount_test")
  1780. if err != nil {
  1781. c.Fatal(err)
  1782. }
  1783. defer os.RemoveAll(tmpDir)
  1784. tmpDir2, err := ioutil.TempDir("", "docker_nested_mount_test2")
  1785. if err != nil {
  1786. c.Fatal(err)
  1787. }
  1788. defer os.RemoveAll(tmpDir2)
  1789. // Create a temporary tmpfs mounc.
  1790. fooDir := filepath.Join(tmpDir, "foo")
  1791. if err := os.MkdirAll(filepath.Join(tmpDir, "foo"), 0755); err != nil {
  1792. c.Fatalf("failed to mkdir at %s - %s", fooDir, err)
  1793. }
  1794. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", fooDir), []byte{}, 0644); err != nil {
  1795. c.Fatal(err)
  1796. }
  1797. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir), []byte{}, 0644); err != nil {
  1798. c.Fatal(err)
  1799. }
  1800. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir2), []byte{}, 0644); err != nil {
  1801. c.Fatal(err)
  1802. }
  1803. dockerCmd(c, "run",
  1804. "-v", fmt.Sprintf("%s:"+prefix+"/tmp", tmpDir),
  1805. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/foo", fooDir),
  1806. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2", tmpDir2),
  1807. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2/foo", fooDir),
  1808. "busybox:latest", "sh", "-c",
  1809. "ls "+prefix+"/tmp/touch-me && ls "+prefix+"/tmp/foo/touch-me && ls "+prefix+"/tmp/tmp2/touch-me && ls "+prefix+"/tmp/tmp2/foo/touch-me")
  1810. }
  1811. // Regression test for https://github.com/docker/docker/issues/8259
  1812. func (s *DockerSuite) TestRunReuseBindVolumeThatIsSymlink(c *testing.T) {
  1813. // Not applicable on Windows as Windows does not support volumes
  1814. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  1815. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  1816. tmpDir, err := ioutil.TempDir(os.TempDir(), "testlink")
  1817. if err != nil {
  1818. c.Fatal(err)
  1819. }
  1820. defer os.RemoveAll(tmpDir)
  1821. linkPath := os.TempDir() + "/testlink2"
  1822. if err := os.Symlink(tmpDir, linkPath); err != nil {
  1823. c.Fatal(err)
  1824. }
  1825. defer os.RemoveAll(linkPath)
  1826. // Create first container
  1827. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
  1828. // Create second container with same symlinked path
  1829. // This will fail if the referenced issue is hit with a "Volume exists" error
  1830. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
  1831. }
  1832. // GH#10604: Test an "/etc" volume doesn't overlay special bind mounts in container
  1833. func (s *DockerSuite) TestRunCreateVolumeEtc(c *testing.T) {
  1834. // While Windows supports volumes, it does not support --add-host hence
  1835. // this test is not applicable on Windows.
  1836. testRequires(c, DaemonIsLinux)
  1837. out, _ := dockerCmd(c, "run", "--dns=127.0.0.1", "-v", "/etc", "busybox", "cat", "/etc/resolv.conf")
  1838. if !strings.Contains(out, "nameserver 127.0.0.1") {
  1839. c.Fatal("/etc volume mount hides /etc/resolv.conf")
  1840. }
  1841. out, _ = dockerCmd(c, "run", "-h=test123", "-v", "/etc", "busybox", "cat", "/etc/hostname")
  1842. if !strings.Contains(out, "test123") {
  1843. c.Fatal("/etc volume mount hides /etc/hostname")
  1844. }
  1845. out, _ = dockerCmd(c, "run", "--add-host=test:192.168.0.1", "-v", "/etc", "busybox", "cat", "/etc/hosts")
  1846. out = strings.Replace(out, "\n", " ", -1)
  1847. if !strings.Contains(out, "192.168.0.1\ttest") || !strings.Contains(out, "127.0.0.1\tlocalhost") {
  1848. c.Fatal("/etc volume mount hides /etc/hosts")
  1849. }
  1850. }
  1851. func (s *DockerSuite) TestVolumesNoCopyData(c *testing.T) {
  1852. // TODO Windows (Post RS1). Windows does not support volumes which
  1853. // are pre-populated such as is built in the dockerfile used in this test.
  1854. testRequires(c, DaemonIsLinux)
  1855. prefix, slash := getPrefixAndSlashFromDaemonPlatform()
  1856. buildImageSuccessfully(c, "dataimage", build.WithDockerfile(`FROM busybox
  1857. RUN ["mkdir", "-p", "/foo"]
  1858. RUN ["touch", "/foo/bar"]`))
  1859. dockerCmd(c, "run", "--name", "test", "-v", prefix+slash+"foo", "busybox")
  1860. if out, _, err := dockerCmdWithError("run", "--volumes-from", "test", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {
  1861. c.Fatalf("Data was copied on volumes-from but shouldn't be:\n%q", out)
  1862. }
  1863. tmpDir := RandomTmpDirPath("docker_test_bind_mount_copy_data", testEnv.OSType)
  1864. if out, _, err := dockerCmdWithError("run", "-v", tmpDir+":/foo", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {
  1865. c.Fatalf("Data was copied on bind mount but shouldn't be:\n%q", out)
  1866. }
  1867. }
  1868. func (s *DockerSuite) TestRunNoOutputFromPullInStdout(c *testing.T) {
  1869. // just run with unknown image
  1870. cmd := exec.Command(dockerBinary, "run", "asdfsg")
  1871. stdout := bytes.NewBuffer(nil)
  1872. cmd.Stdout = stdout
  1873. if err := cmd.Run(); err == nil {
  1874. c.Fatal("Run with unknown image should fail")
  1875. }
  1876. if stdout.Len() != 0 {
  1877. c.Fatalf("Stdout contains output from pull: %s", stdout)
  1878. }
  1879. }
  1880. func (s *DockerSuite) TestRunVolumesCleanPaths(c *testing.T) {
  1881. testRequires(c, testEnv.IsLocalDaemon)
  1882. prefix, slash := getPrefixAndSlashFromDaemonPlatform()
  1883. buildImageSuccessfully(c, "run_volumes_clean_paths", build.WithDockerfile(`FROM busybox
  1884. VOLUME `+prefix+`/foo/`))
  1885. dockerCmd(c, "run", "-v", prefix+"/foo", "-v", prefix+"/bar/", "--name", "dark_helmet", "run_volumes_clean_paths")
  1886. out, err := inspectMountSourceField("dark_helmet", prefix+slash+"foo"+slash)
  1887. if err != errMountNotFound {
  1888. c.Fatalf("Found unexpected volume entry for '%s/foo/' in volumes\n%q", prefix, out)
  1889. }
  1890. out, err = inspectMountSourceField("dark_helmet", prefix+slash+`foo`)
  1891. assert.NilError(c, err)
  1892. if !strings.Contains(strings.ToLower(out), strings.ToLower(testEnv.PlatformDefaults.VolumesConfigPath)) {
  1893. c.Fatalf("Volume was not defined for %s/foo\n%q", prefix, out)
  1894. }
  1895. out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar"+slash)
  1896. if err != errMountNotFound {
  1897. c.Fatalf("Found unexpected volume entry for '%s/bar/' in volumes\n%q", prefix, out)
  1898. }
  1899. out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar")
  1900. assert.NilError(c, err)
  1901. if !strings.Contains(strings.ToLower(out), strings.ToLower(testEnv.PlatformDefaults.VolumesConfigPath)) {
  1902. c.Fatalf("Volume was not defined for %s/bar\n%q", prefix, out)
  1903. }
  1904. }
  1905. // Regression test for #3631
  1906. func (s *DockerSuite) TestRunSlowStdoutConsumer(c *testing.T) {
  1907. // TODO Windows: This should be able to run on Windows if can find an
  1908. // alternate to /dev/zero and /dev/stdout.
  1909. testRequires(c, DaemonIsLinux)
  1910. args := []string{"run", "--rm", "busybox", "/bin/sh", "-c", "dd if=/dev/zero of=/dev/stdout bs=1024 count=2000 | cat -v"}
  1911. cont := exec.Command(dockerBinary, args...)
  1912. stdout, err := cont.StdoutPipe()
  1913. if err != nil {
  1914. c.Fatal(err)
  1915. }
  1916. if err := cont.Start(); err != nil {
  1917. c.Fatal(err)
  1918. }
  1919. defer func() { go cont.Wait() }()
  1920. n, err := ConsumeWithSpeed(stdout, 10000, 5*time.Millisecond, nil)
  1921. if err != nil {
  1922. c.Fatal(err)
  1923. }
  1924. expected := 2 * 1024 * 2000
  1925. if n != expected {
  1926. c.Fatalf("Expected %d, got %d", expected, n)
  1927. }
  1928. }
  1929. func (s *DockerSuite) TestRunAllowPortRangeThroughExpose(c *testing.T) {
  1930. // TODO Windows: -P is not currently supported. Also network
  1931. // settings are not propagated back.
  1932. testRequires(c, DaemonIsLinux)
  1933. out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-P", "busybox", "top")
  1934. id := strings.TrimSpace(out)
  1935. portstr := inspectFieldJSON(c, id, "NetworkSettings.Ports")
  1936. var ports nat.PortMap
  1937. if err := json.Unmarshal([]byte(portstr), &ports); err != nil {
  1938. c.Fatal(err)
  1939. }
  1940. for port, binding := range ports {
  1941. portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
  1942. if portnum < 3000 || portnum > 3003 {
  1943. c.Fatalf("Port %d is out of range ", portnum)
  1944. }
  1945. if binding == nil || len(binding) != 1 || len(binding[0].HostPort) == 0 {
  1946. c.Fatalf("Port is not mapped for the port %s", port)
  1947. }
  1948. }
  1949. }
  1950. func (s *DockerSuite) TestRunExposePort(c *testing.T) {
  1951. out, _, err := dockerCmdWithError("run", "--expose", "80000", "busybox")
  1952. assert.Assert(c, err != nil, "--expose with an invalid port should error out")
  1953. assert.Assert(c, strings.Contains(out, "invalid range format for --expose"))
  1954. }
  1955. func (s *DockerSuite) TestRunModeIpcHost(c *testing.T) {
  1956. // Not applicable on Windows as uses Unix-specific capabilities
  1957. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  1958. hostIpc, err := os.Readlink("/proc/1/ns/ipc")
  1959. if err != nil {
  1960. c.Fatal(err)
  1961. }
  1962. out, _ := dockerCmd(c, "run", "--ipc=host", "busybox", "readlink", "/proc/self/ns/ipc")
  1963. out = strings.Trim(out, "\n")
  1964. if hostIpc != out {
  1965. c.Fatalf("IPC different with --ipc=host %s != %s\n", hostIpc, out)
  1966. }
  1967. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/ipc")
  1968. out = strings.Trim(out, "\n")
  1969. if hostIpc == out {
  1970. c.Fatalf("IPC should be different without --ipc=host %s == %s\n", hostIpc, out)
  1971. }
  1972. }
  1973. func (s *DockerSuite) TestRunModeIpcContainerNotExists(c *testing.T) {
  1974. // Not applicable on Windows as uses Unix-specific capabilities
  1975. testRequires(c, DaemonIsLinux)
  1976. out, _, err := dockerCmdWithError("run", "-d", "--ipc", "container:abcd1234", "busybox", "top")
  1977. if !strings.Contains(out, "abcd1234") || err == nil {
  1978. c.Fatalf("run IPC from a non exists container should with correct error out")
  1979. }
  1980. }
  1981. func (s *DockerSuite) TestRunModeIpcContainerNotRunning(c *testing.T) {
  1982. // Not applicable on Windows as uses Unix-specific capabilities
  1983. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1984. out, _ := dockerCmd(c, "create", "busybox")
  1985. id := strings.TrimSpace(out)
  1986. out, _, err := dockerCmdWithError("run", fmt.Sprintf("--ipc=container:%s", id), "busybox")
  1987. if err == nil {
  1988. c.Fatalf("Run container with ipc mode container should fail with non running container: %s\n%s", out, err)
  1989. }
  1990. }
  1991. func (s *DockerSuite) TestRunModePIDContainer(c *testing.T) {
  1992. // Not applicable on Windows as uses Unix-specific capabilities
  1993. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  1994. out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "top")
  1995. id := strings.TrimSpace(out)
  1996. state := inspectField(c, id, "State.Running")
  1997. if state != "true" {
  1998. c.Fatal("Container state is 'not running'")
  1999. }
  2000. pid1 := inspectField(c, id, "State.Pid")
  2001. parentContainerPid, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/pid", pid1))
  2002. if err != nil {
  2003. c.Fatal(err)
  2004. }
  2005. out, _ = dockerCmd(c, "run", fmt.Sprintf("--pid=container:%s", id), "busybox", "readlink", "/proc/self/ns/pid")
  2006. out = strings.Trim(out, "\n")
  2007. if parentContainerPid != out {
  2008. c.Fatalf("PID different with --pid=container:%s %s != %s\n", id, parentContainerPid, out)
  2009. }
  2010. }
  2011. func (s *DockerSuite) TestRunModePIDContainerNotExists(c *testing.T) {
  2012. // Not applicable on Windows as uses Unix-specific capabilities
  2013. testRequires(c, DaemonIsLinux)
  2014. out, _, err := dockerCmdWithError("run", "-d", "--pid", "container:abcd1234", "busybox", "top")
  2015. if !strings.Contains(out, "abcd1234") || err == nil {
  2016. c.Fatalf("run PID from a non exists container should with correct error out")
  2017. }
  2018. }
  2019. func (s *DockerSuite) TestRunModePIDContainerNotRunning(c *testing.T) {
  2020. // Not applicable on Windows as uses Unix-specific capabilities
  2021. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  2022. out, _ := dockerCmd(c, "create", "busybox")
  2023. id := strings.TrimSpace(out)
  2024. out, _, err := dockerCmdWithError("run", fmt.Sprintf("--pid=container:%s", id), "busybox")
  2025. if err == nil {
  2026. c.Fatalf("Run container with pid mode container should fail with non running container: %s\n%s", out, err)
  2027. }
  2028. }
  2029. func (s *DockerSuite) TestRunMountShmMqueueFromHost(c *testing.T) {
  2030. // Not applicable on Windows as uses Unix-specific capabilities
  2031. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  2032. dockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "-v", "/dev/mqueue:/dev/mqueue", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")
  2033. defer os.Remove("/dev/mqueue/toto")
  2034. defer os.Remove("/dev/shm/test")
  2035. volPath, err := inspectMountSourceField("shmfromhost", "/dev/shm")
  2036. assert.NilError(c, err)
  2037. if volPath != "/dev/shm" {
  2038. c.Fatalf("volumePath should have been /dev/shm, was %s", volPath)
  2039. }
  2040. out, _ := dockerCmd(c, "run", "--name", "ipchost", "--ipc", "host", "busybox", "cat", "/dev/shm/test")
  2041. if out != "test" {
  2042. c.Fatalf("Output of /dev/shm/test expected test but found: %s", out)
  2043. }
  2044. // Check that the mq was created
  2045. if _, err := os.Stat("/dev/mqueue/toto"); err != nil {
  2046. c.Fatalf("Failed to confirm '/dev/mqueue/toto' presence on host: %s", err.Error())
  2047. }
  2048. }
  2049. func (s *DockerSuite) TestContainerNetworkMode(c *testing.T) {
  2050. // Not applicable on Windows as uses Unix-specific capabilities
  2051. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  2052. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  2053. id := strings.TrimSpace(out)
  2054. assert.NilError(c, waitRun(id))
  2055. pid1 := inspectField(c, id, "State.Pid")
  2056. parentContainerNet, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
  2057. if err != nil {
  2058. c.Fatal(err)
  2059. }
  2060. out, _ = dockerCmd(c, "run", fmt.Sprintf("--net=container:%s", id), "busybox", "readlink", "/proc/self/ns/net")
  2061. out = strings.Trim(out, "\n")
  2062. if parentContainerNet != out {
  2063. c.Fatalf("NET different with --net=container:%s %s != %s\n", id, parentContainerNet, out)
  2064. }
  2065. }
  2066. func (s *DockerSuite) TestRunModePIDHost(c *testing.T) {
  2067. // Not applicable on Windows as uses Unix-specific capabilities
  2068. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  2069. hostPid, err := os.Readlink("/proc/1/ns/pid")
  2070. if err != nil {
  2071. c.Fatal(err)
  2072. }
  2073. out, _ := dockerCmd(c, "run", "--pid=host", "busybox", "readlink", "/proc/self/ns/pid")
  2074. out = strings.Trim(out, "\n")
  2075. if hostPid != out {
  2076. c.Fatalf("PID different with --pid=host %s != %s\n", hostPid, out)
  2077. }
  2078. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/pid")
  2079. out = strings.Trim(out, "\n")
  2080. if hostPid == out {
  2081. c.Fatalf("PID should be different without --pid=host %s == %s\n", hostPid, out)
  2082. }
  2083. }
  2084. func (s *DockerSuite) TestRunModeUTSHost(c *testing.T) {
  2085. // Not applicable on Windows as uses Unix-specific capabilities
  2086. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  2087. hostUTS, err := os.Readlink("/proc/1/ns/uts")
  2088. if err != nil {
  2089. c.Fatal(err)
  2090. }
  2091. out, _ := dockerCmd(c, "run", "--uts=host", "busybox", "readlink", "/proc/self/ns/uts")
  2092. out = strings.Trim(out, "\n")
  2093. if hostUTS != out {
  2094. c.Fatalf("UTS different with --uts=host %s != %s\n", hostUTS, out)
  2095. }
  2096. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/uts")
  2097. out = strings.Trim(out, "\n")
  2098. if hostUTS == out {
  2099. c.Fatalf("UTS should be different without --uts=host %s == %s\n", hostUTS, out)
  2100. }
  2101. out, _ = dockerCmdWithFail(c, "run", "-h=name", "--uts=host", "busybox", "ps")
  2102. assert.Assert(c, strings.Contains(out, runconfig.ErrConflictUTSHostname.Error()))
  2103. }
  2104. func (s *DockerSuite) TestRunTLSVerify(c *testing.T) {
  2105. // Remote daemons use TLS and this test is not applicable when TLS is required.
  2106. testRequires(c, testEnv.IsLocalDaemon)
  2107. if out, code, err := dockerCmdWithError("ps"); err != nil || code != 0 {
  2108. c.Fatalf("Should have worked: %v:\n%v", err, out)
  2109. }
  2110. // Regardless of whether we specify true or false we need to
  2111. // test to make sure tls is turned on if --tlsverify is specified at all
  2112. result := dockerCmdWithResult("--tlsverify=false", "ps")
  2113. result.Assert(c, icmd.Expected{ExitCode: 1, Err: "error during connect"})
  2114. result = dockerCmdWithResult("--tlsverify=true", "ps")
  2115. result.Assert(c, icmd.Expected{ExitCode: 1, Err: "cert"})
  2116. }
  2117. func (s *DockerSuite) TestRunPortFromDockerRangeInUse(c *testing.T) {
  2118. // TODO Windows. Once moved to libnetwork/CNM, this may be able to be
  2119. // re-instated.
  2120. testRequires(c, DaemonIsLinux)
  2121. // first find allocator current position
  2122. out, _ := dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
  2123. id := strings.TrimSpace(out)
  2124. out, _ = dockerCmd(c, "port", id)
  2125. out = strings.TrimSpace(out)
  2126. if out == "" {
  2127. c.Fatal("docker port command output is empty")
  2128. }
  2129. out = strings.Split(out, ":")[1]
  2130. lastPort, err := strconv.Atoi(out)
  2131. if err != nil {
  2132. c.Fatal(err)
  2133. }
  2134. port := lastPort + 1
  2135. l, err := net.Listen("tcp", ":"+strconv.Itoa(port))
  2136. if err != nil {
  2137. c.Fatal(err)
  2138. }
  2139. defer l.Close()
  2140. out, _ = dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
  2141. id = strings.TrimSpace(out)
  2142. dockerCmd(c, "port", id)
  2143. }
  2144. func (s *DockerSuite) TestRunTTYWithPipe(c *testing.T) {
  2145. errChan := make(chan error, 1)
  2146. go func() {
  2147. defer close(errChan)
  2148. cmd := exec.Command(dockerBinary, "run", "-ti", "busybox", "true")
  2149. if _, err := cmd.StdinPipe(); err != nil {
  2150. errChan <- err
  2151. return
  2152. }
  2153. expected := "the input device is not a TTY"
  2154. if runtime.GOOS == "windows" {
  2155. expected += ". If you are using mintty, try prefixing the command with 'winpty'"
  2156. }
  2157. if out, _, err := runCommandWithOutput(cmd); err == nil {
  2158. errChan <- fmt.Errorf("run should have failed")
  2159. return
  2160. } else if !strings.Contains(out, expected) {
  2161. errChan <- fmt.Errorf("run failed with error %q: expected %q", out, expected)
  2162. return
  2163. }
  2164. }()
  2165. select {
  2166. case err := <-errChan:
  2167. assert.NilError(c, err)
  2168. case <-time.After(30 * time.Second):
  2169. c.Fatal("container is running but should have failed")
  2170. }
  2171. }
  2172. func (s *DockerSuite) TestRunNonLocalMacAddress(c *testing.T) {
  2173. addr := "00:16:3E:08:00:50"
  2174. args := []string{"run", "--mac-address", addr}
  2175. expected := addr
  2176. if testEnv.OSType != "windows" {
  2177. args = append(args, "busybox", "ifconfig")
  2178. } else {
  2179. args = append(args, testEnv.PlatformDefaults.BaseImage, "ipconfig", "/all")
  2180. expected = strings.Replace(strings.ToUpper(addr), ":", "-", -1)
  2181. }
  2182. if out, _ := dockerCmd(c, args...); !strings.Contains(out, expected) {
  2183. c.Fatalf("Output should have contained %q: %s", expected, out)
  2184. }
  2185. }
  2186. func (s *DockerSuite) TestRunNetHost(c *testing.T) {
  2187. // Not applicable on Windows as uses Unix-specific capabilities
  2188. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  2189. hostNet, err := os.Readlink("/proc/1/ns/net")
  2190. if err != nil {
  2191. c.Fatal(err)
  2192. }
  2193. out, _ := dockerCmd(c, "run", "--net=host", "busybox", "readlink", "/proc/self/ns/net")
  2194. out = strings.Trim(out, "\n")
  2195. if hostNet != out {
  2196. c.Fatalf("Net namespace different with --net=host %s != %s\n", hostNet, out)
  2197. }
  2198. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/net")
  2199. out = strings.Trim(out, "\n")
  2200. if hostNet == out {
  2201. c.Fatalf("Net namespace should be different without --net=host %s == %s\n", hostNet, out)
  2202. }
  2203. }
  2204. func (s *DockerSuite) TestRunNetHostTwiceSameName(c *testing.T) {
  2205. // TODO Windows. As Windows networking evolves and converges towards
  2206. // CNM, this test may be possible to enable on Windows.
  2207. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  2208. dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
  2209. dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
  2210. }
  2211. func (s *DockerSuite) TestRunNetContainerWhichHost(c *testing.T) {
  2212. // Not applicable on Windows as uses Unix-specific capabilities
  2213. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  2214. hostNet, err := os.Readlink("/proc/1/ns/net")
  2215. if err != nil {
  2216. c.Fatal(err)
  2217. }
  2218. dockerCmd(c, "run", "-d", "--net=host", "--name=test", "busybox", "top")
  2219. out, _ := dockerCmd(c, "run", "--net=container:test", "busybox", "readlink", "/proc/self/ns/net")
  2220. out = strings.Trim(out, "\n")
  2221. if hostNet != out {
  2222. c.Fatalf("Container should have host network namespace")
  2223. }
  2224. }
  2225. func (s *DockerSuite) TestRunAllowPortRangeThroughPublish(c *testing.T) {
  2226. // TODO Windows. This may be possible to enable in the future. However,
  2227. // Windows does not currently support --expose, or populate the network
  2228. // settings seen through inspect.
  2229. testRequires(c, DaemonIsLinux)
  2230. out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-p", "3000-3003", "busybox", "top")
  2231. id := strings.TrimSpace(out)
  2232. portstr := inspectFieldJSON(c, id, "NetworkSettings.Ports")
  2233. var ports nat.PortMap
  2234. err := json.Unmarshal([]byte(portstr), &ports)
  2235. assert.NilError(c, err, "failed to unmarshal: %v", portstr)
  2236. for port, binding := range ports {
  2237. portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
  2238. if portnum < 3000 || portnum > 3003 {
  2239. c.Fatalf("Port %d is out of range ", portnum)
  2240. }
  2241. if binding == nil || len(binding) != 1 || len(binding[0].HostPort) == 0 {
  2242. c.Fatal("Port is not mapped for the port "+port, out)
  2243. }
  2244. }
  2245. }
  2246. func (s *DockerSuite) TestRunSetDefaultRestartPolicy(c *testing.T) {
  2247. runSleepingContainer(c, "--name=testrunsetdefaultrestartpolicy")
  2248. out := inspectField(c, "testrunsetdefaultrestartpolicy", "HostConfig.RestartPolicy.Name")
  2249. if out != "no" {
  2250. c.Fatalf("Set default restart policy failed")
  2251. }
  2252. }
  2253. func (s *DockerSuite) TestRunRestartMaxRetries(c *testing.T) {
  2254. out, _ := dockerCmd(c, "run", "-d", "--restart=on-failure:3", "busybox", "false")
  2255. timeout := 10 * time.Second
  2256. if testEnv.OSType == "windows" {
  2257. timeout = 120 * time.Second
  2258. }
  2259. id := strings.TrimSpace(out)
  2260. if err := waitInspect(id, "{{ .State.Restarting }} {{ .State.Running }}", "false false", timeout); err != nil {
  2261. c.Fatal(err)
  2262. }
  2263. count := inspectField(c, id, "RestartCount")
  2264. if count != "3" {
  2265. c.Fatalf("Container was restarted %s times, expected %d", count, 3)
  2266. }
  2267. MaximumRetryCount := inspectField(c, id, "HostConfig.RestartPolicy.MaximumRetryCount")
  2268. if MaximumRetryCount != "3" {
  2269. c.Fatalf("Container Maximum Retry Count is %s, expected %s", MaximumRetryCount, "3")
  2270. }
  2271. }
  2272. func (s *DockerSuite) TestRunContainerWithWritableRootfs(c *testing.T) {
  2273. dockerCmd(c, "run", "--rm", "busybox", "touch", "/file")
  2274. }
  2275. func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *testing.T) {
  2276. // Not applicable on Windows which does not support --read-only
  2277. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  2278. testPriv := true
  2279. // don't test privileged mode subtest if user namespaces enabled
  2280. if root := os.Getenv("DOCKER_REMAP_ROOT"); root != "" {
  2281. testPriv = false
  2282. }
  2283. testReadOnlyFile(c, testPriv, "/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname")
  2284. }
  2285. func (s *DockerSuite) TestPermissionsPtsReadonlyRootfs(c *testing.T) {
  2286. // Not applicable on Windows due to use of Unix specific functionality, plus
  2287. // the use of --read-only which is not supported.
  2288. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  2289. // Ensure we have not broken writing /dev/pts
  2290. out, status := dockerCmd(c, "run", "--read-only", "--rm", "busybox", "mount")
  2291. if status != 0 {
  2292. c.Fatal("Could not obtain mounts when checking /dev/pts mntpnt.")
  2293. }
  2294. expected := "type devpts (rw,"
  2295. if !strings.Contains(out, expected) {
  2296. c.Fatalf("expected output to contain %s but contains %s", expected, out)
  2297. }
  2298. }
  2299. func testReadOnlyFile(c *testing.T, testPriv bool, filenames ...string) {
  2300. touch := "touch " + strings.Join(filenames, " ")
  2301. out, _, err := dockerCmdWithError("run", "--read-only", "--rm", "busybox", "sh", "-c", touch)
  2302. assert.ErrorContains(c, err, "")
  2303. for _, f := range filenames {
  2304. expected := "touch: " + f + ": Read-only file system"
  2305. assert.Assert(c, strings.Contains(out, expected))
  2306. }
  2307. if !testPriv {
  2308. return
  2309. }
  2310. out, _, err = dockerCmdWithError("run", "--read-only", "--privileged", "--rm", "busybox", "sh", "-c", touch)
  2311. assert.ErrorContains(c, err, "")
  2312. for _, f := range filenames {
  2313. expected := "touch: " + f + ": Read-only file system"
  2314. assert.Assert(c, strings.Contains(out, expected))
  2315. }
  2316. }
  2317. func (s *DockerSuite) TestRunContainerWithReadonlyEtcHostsAndLinkedContainer(c *testing.T) {
  2318. // Not applicable on Windows which does not support --link
  2319. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  2320. dockerCmd(c, "run", "-d", "--name", "test-etc-hosts-ro-linked", "busybox", "top")
  2321. out, _ := dockerCmd(c, "run", "--read-only", "--link", "test-etc-hosts-ro-linked:testlinked", "busybox", "cat", "/etc/hosts")
  2322. if !strings.Contains(out, "testlinked") {
  2323. c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled")
  2324. }
  2325. }
  2326. func (s *DockerSuite) TestRunContainerWithReadonlyRootfsWithDNSFlag(c *testing.T) {
  2327. // Not applicable on Windows which does not support either --read-only or --dns.
  2328. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  2329. out, _ := dockerCmd(c, "run", "--read-only", "--dns", "1.1.1.1", "busybox", "/bin/cat", "/etc/resolv.conf")
  2330. if !strings.Contains(out, "1.1.1.1") {
  2331. c.Fatal("Expected /etc/resolv.conf to be updated even if --read-only enabled and --dns flag used")
  2332. }
  2333. }
  2334. func (s *DockerSuite) TestRunContainerWithReadonlyRootfsWithAddHostFlag(c *testing.T) {
  2335. // Not applicable on Windows which does not support --read-only
  2336. testRequires(c, DaemonIsLinux, UserNamespaceROMount)
  2337. out, _ := dockerCmd(c, "run", "--read-only", "--add-host", "testreadonly:127.0.0.1", "busybox", "/bin/cat", "/etc/hosts")
  2338. if !strings.Contains(out, "testreadonly") {
  2339. c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled and --add-host flag used")
  2340. }
  2341. }
  2342. func (s *DockerSuite) TestRunVolumesFromRestartAfterRemoved(c *testing.T) {
  2343. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  2344. runSleepingContainer(c, "--name=voltest", "-v", prefix+"/foo")
  2345. runSleepingContainer(c, "--name=restarter", "--volumes-from", "voltest")
  2346. // Remove the main volume container and restart the consuming container
  2347. dockerCmd(c, "rm", "-f", "voltest")
  2348. // This should not fail since the volumes-from were already applied
  2349. dockerCmd(c, "restart", "restarter")
  2350. }
  2351. // run container with --rm should remove container if exit code != 0
  2352. func (s *DockerSuite) TestRunContainerWithRmFlagExitCodeNotEqualToZero(c *testing.T) {
  2353. existingContainers := ExistingContainerIDs(c)
  2354. name := "flowers"
  2355. cli.Docker(cli.Args("run", "--name", name, "--rm", "busybox", "ls", "/notexists")).Assert(c, icmd.Expected{
  2356. ExitCode: 1,
  2357. })
  2358. out := cli.DockerCmd(c, "ps", "-q", "-a").Combined()
  2359. out = RemoveOutputForExistingElements(out, existingContainers)
  2360. if out != "" {
  2361. c.Fatal("Expected not to have containers", out)
  2362. }
  2363. }
  2364. func (s *DockerSuite) TestRunContainerWithRmFlagCannotStartContainer(c *testing.T) {
  2365. existingContainers := ExistingContainerIDs(c)
  2366. name := "sparkles"
  2367. cli.Docker(cli.Args("run", "--name", name, "--rm", "busybox", "commandNotFound")).Assert(c, icmd.Expected{
  2368. ExitCode: 127,
  2369. })
  2370. out := cli.DockerCmd(c, "ps", "-q", "-a").Combined()
  2371. out = RemoveOutputForExistingElements(out, existingContainers)
  2372. if out != "" {
  2373. c.Fatal("Expected not to have containers", out)
  2374. }
  2375. }
  2376. func (s *DockerSuite) TestRunPIDHostWithChildIsKillable(c *testing.T) {
  2377. // Not applicable on Windows as uses Unix specific functionality
  2378. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2379. name := "ibuildthecloud"
  2380. dockerCmd(c, "run", "-d", "--pid=host", "--name", name, "busybox", "sh", "-c", "sleep 30; echo hi")
  2381. assert.Assert(c, waitRun(name) == nil)
  2382. errchan := make(chan error, 1)
  2383. go func() {
  2384. if out, _, err := dockerCmdWithError("kill", name); err != nil {
  2385. errchan <- fmt.Errorf("%v:\n%s", err, out)
  2386. }
  2387. close(errchan)
  2388. }()
  2389. select {
  2390. case err := <-errchan:
  2391. assert.NilError(c, err)
  2392. case <-time.After(5 * time.Second):
  2393. c.Fatal("Kill container timed out")
  2394. }
  2395. }
  2396. func (s *DockerSuite) TestRunWithTooSmallMemoryLimit(c *testing.T) {
  2397. // TODO Windows. This may be possible to enable once Windows supports memory limits on containers
  2398. testRequires(c, DaemonIsLinux)
  2399. // this memory limit is 1 byte less than the min (daemon.linuxMinMemory), which is 6MB (6291456 bytes)
  2400. out, _, err := dockerCmdWithError("create", "-m", "6291455", "busybox")
  2401. if err == nil || !strings.Contains(out, "Minimum memory limit allowed is 6MB") {
  2402. c.Fatalf("expected run to fail when using too low a memory limit: %q", out)
  2403. }
  2404. }
  2405. func (s *DockerSuite) TestRunWriteToProcAsound(c *testing.T) {
  2406. // Not applicable on Windows as uses Unix specific functionality
  2407. testRequires(c, DaemonIsLinux)
  2408. _, code, err := dockerCmdWithError("run", "busybox", "sh", "-c", "echo 111 >> /proc/asound/version")
  2409. if err == nil || code == 0 {
  2410. c.Fatal("standard container should not be able to write to /proc/asound")
  2411. }
  2412. }
  2413. func (s *DockerSuite) TestRunReadProcTimer(c *testing.T) {
  2414. // Not applicable on Windows as uses Unix specific functionality
  2415. testRequires(c, DaemonIsLinux)
  2416. out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/timer_stats")
  2417. if code != 0 {
  2418. return
  2419. }
  2420. if err != nil {
  2421. c.Fatal(err)
  2422. }
  2423. if strings.Trim(out, "\n ") != "" {
  2424. c.Fatalf("expected to receive no output from /proc/timer_stats but received %q", out)
  2425. }
  2426. }
  2427. func (s *DockerSuite) TestRunReadProcLatency(c *testing.T) {
  2428. // Not applicable on Windows as uses Unix specific functionality
  2429. testRequires(c, DaemonIsLinux)
  2430. // some kernels don't have this configured so skip the test if this file is not found
  2431. // on the host running the tests.
  2432. if _, err := os.Stat("/proc/latency_stats"); err != nil {
  2433. c.Skip("kernel doesn't have latency_stats configured")
  2434. return
  2435. }
  2436. out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/latency_stats")
  2437. if code != 0 {
  2438. return
  2439. }
  2440. if err != nil {
  2441. c.Fatal(err)
  2442. }
  2443. if strings.Trim(out, "\n ") != "" {
  2444. c.Fatalf("expected to receive no output from /proc/latency_stats but received %q", out)
  2445. }
  2446. }
  2447. func (s *DockerSuite) TestRunReadFilteredProc(c *testing.T) {
  2448. // Not applicable on Windows as uses Unix specific functionality
  2449. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2450. testReadPaths := []string{
  2451. "/proc/latency_stats",
  2452. "/proc/timer_stats",
  2453. "/proc/kcore",
  2454. }
  2455. for i, filePath := range testReadPaths {
  2456. name := fmt.Sprintf("procsieve-%d", i)
  2457. shellCmd := fmt.Sprintf("exec 3<%s", filePath)
  2458. out, exitCode, err := dockerCmdWithError("run", "--privileged", "--security-opt", "apparmor=docker-default", "--name", name, "busybox", "sh", "-c", shellCmd)
  2459. if exitCode != 0 {
  2460. return
  2461. }
  2462. if err != nil {
  2463. c.Fatalf("Open FD for read should have failed with permission denied, got: %s, %v", out, err)
  2464. }
  2465. }
  2466. }
  2467. func (s *DockerSuite) TestMountIntoProc(c *testing.T) {
  2468. // Not applicable on Windows as uses Unix specific functionality
  2469. testRequires(c, DaemonIsLinux)
  2470. _, code, err := dockerCmdWithError("run", "-v", "/proc//sys", "busybox", "true")
  2471. if err == nil || code == 0 {
  2472. c.Fatal("container should not be able to mount into /proc")
  2473. }
  2474. }
  2475. func (s *DockerSuite) TestMountIntoSys(c *testing.T) {
  2476. // Not applicable on Windows as uses Unix specific functionality
  2477. testRequires(c, DaemonIsLinux)
  2478. testRequires(c, NotUserNamespace)
  2479. dockerCmd(c, "run", "-v", "/sys/fs/cgroup", "busybox", "true")
  2480. }
  2481. func (s *DockerSuite) TestRunUnshareProc(c *testing.T) {
  2482. // Not applicable on Windows as uses Unix specific functionality
  2483. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2484. // In this test goroutines are used to run test cases in parallel to prevent the test from taking a long time to run.
  2485. errChan := make(chan error)
  2486. go func() {
  2487. name := "acidburn"
  2488. out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:buster", "unshare", "-p", "-m", "-f", "-r", "--mount-proc=/proc", "mount")
  2489. if err == nil ||
  2490. !(strings.Contains(strings.ToLower(out), "permission denied") ||
  2491. strings.Contains(strings.ToLower(out), "operation not permitted")) {
  2492. errChan <- fmt.Errorf("unshare with --mount-proc should have failed with 'permission denied' or 'operation not permitted', got: %s, %v", out, err)
  2493. } else {
  2494. errChan <- nil
  2495. }
  2496. }()
  2497. go func() {
  2498. name := "cereal"
  2499. out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp=unconfined", "debian:buster", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
  2500. if err == nil ||
  2501. !(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
  2502. strings.Contains(strings.ToLower(out), "permission denied") ||
  2503. strings.Contains(strings.ToLower(out), "operation not permitted")) {
  2504. errChan <- fmt.Errorf("unshare and mount of /proc should have failed with 'mount: cannot mount none' or 'permission denied', got: %s, %v", out, err)
  2505. } else {
  2506. errChan <- nil
  2507. }
  2508. }()
  2509. /* Ensure still fails if running privileged with the default policy */
  2510. go func() {
  2511. name := "crashoverride"
  2512. out, _, err := dockerCmdWithError("run", "--privileged", "--security-opt", "seccomp=unconfined", "--security-opt", "apparmor=docker-default", "--name", name, "debian:buster", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
  2513. if err == nil ||
  2514. !(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
  2515. strings.Contains(strings.ToLower(out), "permission denied") ||
  2516. strings.Contains(strings.ToLower(out), "operation not permitted")) {
  2517. errChan <- fmt.Errorf("privileged unshare with apparmor should have failed with 'mount: cannot mount none' or 'permission denied', got: %s, %v", out, err)
  2518. } else {
  2519. errChan <- nil
  2520. }
  2521. }()
  2522. var retErr error
  2523. for i := 0; i < 3; i++ {
  2524. err := <-errChan
  2525. if retErr == nil && err != nil {
  2526. retErr = err
  2527. }
  2528. }
  2529. if retErr != nil {
  2530. c.Fatal(retErr)
  2531. }
  2532. }
  2533. func (s *DockerSuite) TestRunPublishPort(c *testing.T) {
  2534. // TODO Windows: This may be possible once Windows moves to libnetwork and CNM
  2535. testRequires(c, DaemonIsLinux)
  2536. dockerCmd(c, "run", "-d", "--name", "test", "--expose", "8080", "busybox", "top")
  2537. out, _ := dockerCmd(c, "port", "test")
  2538. out = strings.Trim(out, "\r\n")
  2539. if out != "" {
  2540. c.Fatalf("run without --publish-all should not publish port, out should be nil, but got: %s", out)
  2541. }
  2542. }
  2543. // Issue #10184.
  2544. func (s *DockerSuite) TestDevicePermissions(c *testing.T) {
  2545. // Not applicable on Windows as uses Unix specific functionality
  2546. testRequires(c, DaemonIsLinux)
  2547. const permissions = "crw-rw-rw-"
  2548. out, status := dockerCmd(c, "run", "--device", "/dev/fuse:/dev/fuse:mrw", "busybox:latest", "ls", "-l", "/dev/fuse")
  2549. if status != 0 {
  2550. c.Fatalf("expected status 0, got %d", status)
  2551. }
  2552. if !strings.HasPrefix(out, permissions) {
  2553. c.Fatalf("output should begin with %q, got %q", permissions, out)
  2554. }
  2555. }
  2556. func (s *DockerSuite) TestRunCapAddCHOWN(c *testing.T) {
  2557. // Not applicable on Windows as uses Unix specific functionality
  2558. testRequires(c, DaemonIsLinux)
  2559. out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=CHOWN", "busybox", "sh", "-c", "adduser -D -H newuser && chown newuser /home && echo ok")
  2560. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  2561. c.Fatalf("expected output ok received %s", actual)
  2562. }
  2563. }
  2564. // https://github.com/docker/docker/pull/14498
  2565. func (s *DockerSuite) TestVolumeFromMixedRWOptions(c *testing.T) {
  2566. prefix, slash := getPrefixAndSlashFromDaemonPlatform()
  2567. dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "true")
  2568. dockerCmd(c, "run", "--volumes-from", "parent:ro", "--name", "test-volumes-1", "busybox", "true")
  2569. dockerCmd(c, "run", "--volumes-from", "parent:rw", "--name", "test-volumes-2", "busybox", "true")
  2570. if testEnv.OSType != "windows" {
  2571. mRO, err := inspectMountPoint("test-volumes-1", prefix+slash+"test")
  2572. assert.NilError(c, err, "failed to inspect mount point")
  2573. if mRO.RW {
  2574. c.Fatalf("Expected RO volume was RW")
  2575. }
  2576. }
  2577. mRW, err := inspectMountPoint("test-volumes-2", prefix+slash+"test")
  2578. assert.NilError(c, err, "failed to inspect mount point")
  2579. if !mRW.RW {
  2580. c.Fatalf("Expected RW volume was RO")
  2581. }
  2582. }
  2583. func (s *DockerSuite) TestRunWriteFilteredProc(c *testing.T) {
  2584. // Not applicable on Windows as uses Unix specific functionality
  2585. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2586. testWritePaths := []string{
  2587. /* modprobe and core_pattern should both be denied by generic
  2588. * policy of denials for /proc/sys/kernel. These files have been
  2589. * picked to be checked as they are particularly sensitive to writes */
  2590. "/proc/sys/kernel/modprobe",
  2591. "/proc/sys/kernel/core_pattern",
  2592. "/proc/sysrq-trigger",
  2593. "/proc/kcore",
  2594. }
  2595. for i, filePath := range testWritePaths {
  2596. name := fmt.Sprintf("writeprocsieve-%d", i)
  2597. shellCmd := fmt.Sprintf("exec 3>%s", filePath)
  2598. out, code, err := dockerCmdWithError("run", "--privileged", "--security-opt", "apparmor=docker-default", "--name", name, "busybox", "sh", "-c", shellCmd)
  2599. if code != 0 {
  2600. return
  2601. }
  2602. if err != nil {
  2603. c.Fatalf("Open FD for write should have failed with permission denied, got: %s, %v", out, err)
  2604. }
  2605. }
  2606. }
  2607. func (s *DockerSuite) TestRunNetworkFilesBindMount(c *testing.T) {
  2608. // Not applicable on Windows as uses Unix specific functionality
  2609. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  2610. expected := "test123"
  2611. filename := createTmpFile(c, expected)
  2612. defer os.Remove(filename)
  2613. // for user namespaced test runs, the temp file must be accessible to unprivileged root
  2614. if err := os.Chmod(filename, 0646); err != nil {
  2615. c.Fatalf("error modifying permissions of %s: %v", filename, err)
  2616. }
  2617. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2618. for i := range nwfiles {
  2619. actual, _ := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "busybox", "cat", nwfiles[i])
  2620. if actual != expected {
  2621. c.Fatalf("expected %s be: %q, but was: %q", nwfiles[i], expected, actual)
  2622. }
  2623. }
  2624. }
  2625. func (s *DockerSuite) TestRunNetworkFilesBindMountRO(c *testing.T) {
  2626. // Not applicable on Windows as uses Unix specific functionality
  2627. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux)
  2628. filename := createTmpFile(c, "test123")
  2629. defer os.Remove(filename)
  2630. // for user namespaced test runs, the temp file must be accessible to unprivileged root
  2631. if err := os.Chmod(filename, 0646); err != nil {
  2632. c.Fatalf("error modifying permissions of %s: %v", filename, err)
  2633. }
  2634. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2635. for i := range nwfiles {
  2636. _, exitCode, err := dockerCmdWithError("run", "-v", filename+":"+nwfiles[i]+":ro", "busybox", "touch", nwfiles[i])
  2637. if err == nil || exitCode == 0 {
  2638. c.Fatalf("run should fail because bind mount of %s is ro: exit code %d", nwfiles[i], exitCode)
  2639. }
  2640. }
  2641. }
  2642. func (s *DockerSuite) TestRunNetworkFilesBindMountROFilesystem(c *testing.T) {
  2643. // Not applicable on Windows as uses Unix specific functionality
  2644. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, UserNamespaceROMount)
  2645. filename := createTmpFile(c, "test123")
  2646. defer os.Remove(filename)
  2647. // for user namespaced test runs, the temp file must be accessible to unprivileged root
  2648. if err := os.Chmod(filename, 0646); err != nil {
  2649. c.Fatalf("error modifying permissions of %s: %v", filename, err)
  2650. }
  2651. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2652. for i := range nwfiles {
  2653. _, exitCode := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "--read-only", "busybox", "touch", nwfiles[i])
  2654. if exitCode != 0 {
  2655. c.Fatalf("run should not fail because %s is mounted writable on read-only root filesystem: exit code %d", nwfiles[i], exitCode)
  2656. }
  2657. }
  2658. for i := range nwfiles {
  2659. _, exitCode, err := dockerCmdWithError("run", "-v", filename+":"+nwfiles[i]+":ro", "--read-only", "busybox", "touch", nwfiles[i])
  2660. if err == nil || exitCode == 0 {
  2661. c.Fatalf("run should fail because %s is mounted read-only on read-only root filesystem: exit code %d", nwfiles[i], exitCode)
  2662. }
  2663. }
  2664. }
  2665. func (s *DockerSuite) TestPtraceContainerProcsFromHost(c *testing.T) {
  2666. // Not applicable on Windows as uses Unix specific functionality
  2667. testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon)
  2668. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  2669. id := strings.TrimSpace(out)
  2670. assert.NilError(c, waitRun(id))
  2671. pid1 := inspectField(c, id, "State.Pid")
  2672. _, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
  2673. if err != nil {
  2674. c.Fatal(err)
  2675. }
  2676. }
  2677. func (s *DockerSuite) TestAppArmorDeniesPtrace(c *testing.T) {
  2678. // Not applicable on Windows as uses Unix specific functionality
  2679. testRequires(c, testEnv.IsLocalDaemon, Apparmor, DaemonIsLinux)
  2680. // Run through 'sh' so we are NOT pid 1. Pid 1 may be able to trace
  2681. // itself, but pid>1 should not be able to trace pid1.
  2682. _, exitCode, _ := dockerCmdWithError("run", "busybox", "sh", "-c", "sh -c readlink /proc/1/ns/net")
  2683. if exitCode == 0 {
  2684. c.Fatal("ptrace was not successfully restricted by AppArmor")
  2685. }
  2686. }
  2687. func (s *DockerSuite) TestAppArmorTraceSelf(c *testing.T) {
  2688. // Not applicable on Windows as uses Unix specific functionality
  2689. testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, Apparmor)
  2690. _, exitCode, _ := dockerCmdWithError("run", "busybox", "readlink", "/proc/1/ns/net")
  2691. if exitCode != 0 {
  2692. c.Fatal("ptrace of self failed.")
  2693. }
  2694. }
  2695. func (s *DockerSuite) TestAppArmorDeniesChmodProc(c *testing.T) {
  2696. // Not applicable on Windows as uses Unix specific functionality
  2697. testRequires(c, testEnv.IsLocalDaemon, Apparmor, DaemonIsLinux, NotUserNamespace)
  2698. _, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "744", "/proc/cpuinfo")
  2699. if exitCode == 0 {
  2700. // If our test failed, attempt to repair the host system...
  2701. _, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "444", "/proc/cpuinfo")
  2702. if exitCode == 0 {
  2703. c.Fatal("AppArmor was unsuccessful in prohibiting chmod of /proc/* files.")
  2704. }
  2705. }
  2706. }
  2707. func (s *DockerSuite) TestRunCapAddSYSTIME(c *testing.T) {
  2708. // Not applicable on Windows as uses Unix specific functionality
  2709. testRequires(c, DaemonIsLinux)
  2710. dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=SYS_TIME", "busybox", "sh", "-c", "grep ^CapEff /proc/self/status | sed 's/^CapEff:\t//' | grep ^0000000002000000$")
  2711. }
  2712. // run create container failed should clean up the container
  2713. func (s *DockerSuite) TestRunCreateContainerFailedCleanUp(c *testing.T) {
  2714. // TODO Windows. This may be possible to enable once link is supported
  2715. testRequires(c, DaemonIsLinux)
  2716. name := "unique_name"
  2717. _, _, err := dockerCmdWithError("run", "--name", name, "--link", "nothing:nothing", "busybox")
  2718. assert.Assert(c, err != nil, "Expected docker run to fail!")
  2719. containerID, err := inspectFieldWithError(name, "Id")
  2720. assert.Assert(c, err != nil, "Expected not to have this container: %s!", containerID)
  2721. assert.Equal(c, containerID, "", fmt.Sprintf("Expected not to have this container: %s!", containerID))
  2722. }
  2723. func (s *DockerSuite) TestRunNamedVolume(c *testing.T) {
  2724. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  2725. testRequires(c, DaemonIsLinux)
  2726. dockerCmd(c, "run", "--name=test", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "echo hello > "+prefix+"/foo/bar")
  2727. out, _ := dockerCmd(c, "run", "--volumes-from", "test", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
  2728. assert.Equal(c, strings.TrimSpace(out), "hello")
  2729. out, _ = dockerCmd(c, "run", "-v", "testing:"+prefix+"/foo", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
  2730. assert.Equal(c, strings.TrimSpace(out), "hello")
  2731. }
  2732. func (s *DockerSuite) TestRunWithUlimits(c *testing.T) {
  2733. // Not applicable on Windows as uses Unix specific functionality
  2734. testRequires(c, DaemonIsLinux)
  2735. out, _ := dockerCmd(c, "run", "--name=testulimits", "--ulimit", "nofile=42", "busybox", "/bin/sh", "-c", "ulimit -n")
  2736. ul := strings.TrimSpace(out)
  2737. if ul != "42" {
  2738. c.Fatalf("expected `ulimit -n` to be 42, got %s", ul)
  2739. }
  2740. }
  2741. func (s *DockerSuite) TestRunContainerWithCgroupParent(c *testing.T) {
  2742. // Not applicable on Windows as uses Unix specific functionality
  2743. testRequires(c, DaemonIsLinux)
  2744. // cgroup-parent relative path
  2745. testRunContainerWithCgroupParent(c, "test", "cgroup-test")
  2746. // cgroup-parent absolute path
  2747. testRunContainerWithCgroupParent(c, "/cgroup-parent/test", "cgroup-test-absolute")
  2748. }
  2749. func testRunContainerWithCgroupParent(c *testing.T, cgroupParent, name string) {
  2750. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2751. if err != nil {
  2752. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", out, err)
  2753. }
  2754. cgroupPaths := ParseCgroupPaths(out)
  2755. if len(cgroupPaths) == 0 {
  2756. c.Fatalf("unexpected output - %q", out)
  2757. }
  2758. id := getIDByName(c, name)
  2759. expectedCgroup := path.Join(cgroupParent, id)
  2760. found := false
  2761. for _, path := range cgroupPaths {
  2762. if strings.HasSuffix(path, expectedCgroup) {
  2763. found = true
  2764. break
  2765. }
  2766. }
  2767. if !found {
  2768. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  2769. }
  2770. }
  2771. // TestRunInvalidCgroupParent checks that a specially-crafted cgroup parent doesn't cause Docker to crash or start modifying /.
  2772. func (s *DockerSuite) TestRunInvalidCgroupParent(c *testing.T) {
  2773. // Not applicable on Windows as uses Unix specific functionality
  2774. testRequires(c, DaemonIsLinux)
  2775. testRunInvalidCgroupParent(c, "../../../../../../../../SHOULD_NOT_EXIST", "SHOULD_NOT_EXIST", "cgroup-invalid-test")
  2776. testRunInvalidCgroupParent(c, "/../../../../../../../../SHOULD_NOT_EXIST", "/SHOULD_NOT_EXIST", "cgroup-absolute-invalid-test")
  2777. }
  2778. func testRunInvalidCgroupParent(c *testing.T, cgroupParent, cleanCgroupParent, name string) {
  2779. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2780. if err != nil {
  2781. // XXX: This may include a daemon crash.
  2782. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", out, err)
  2783. }
  2784. // We expect "/SHOULD_NOT_EXIST" to not exist. If not, we have a security issue.
  2785. if _, err := os.Stat("/SHOULD_NOT_EXIST"); err == nil || !os.IsNotExist(err) {
  2786. c.Fatalf("SECURITY: --cgroup-parent with ../../ relative paths cause files to be created in the host (this is bad) !!")
  2787. }
  2788. cgroupPaths := ParseCgroupPaths(out)
  2789. if len(cgroupPaths) == 0 {
  2790. c.Fatalf("unexpected output - %q", out)
  2791. }
  2792. id := getIDByName(c, name)
  2793. expectedCgroup := path.Join(cleanCgroupParent, id)
  2794. found := false
  2795. for _, path := range cgroupPaths {
  2796. if strings.HasSuffix(path, expectedCgroup) {
  2797. found = true
  2798. break
  2799. }
  2800. }
  2801. if !found {
  2802. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  2803. }
  2804. }
  2805. func (s *DockerSuite) TestRunContainerWithCgroupMountRO(c *testing.T) {
  2806. // Not applicable on Windows as uses Unix specific functionality
  2807. // --read-only + userns has remount issues
  2808. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2809. filename := "/sys/fs/cgroup/devices/test123"
  2810. out, _, err := dockerCmdWithError("run", "busybox", "touch", filename)
  2811. if err == nil {
  2812. c.Fatal("expected cgroup mount point to be read-only, touch file should fail")
  2813. }
  2814. expected := "Read-only file system"
  2815. if !strings.Contains(out, expected) {
  2816. c.Fatalf("expected output from failure to contain %s but contains %s", expected, out)
  2817. }
  2818. }
  2819. func (s *DockerSuite) TestRunContainerNetworkModeToSelf(c *testing.T) {
  2820. // Not applicable on Windows which does not support --net=container
  2821. testRequires(c, DaemonIsLinux)
  2822. out, _, err := dockerCmdWithError("run", "--name=me", "--net=container:me", "busybox", "true")
  2823. if err == nil || !strings.Contains(out, "cannot join own network") {
  2824. c.Fatalf("using container net mode to self should result in an error\nerr: %q\nout: %s", err, out)
  2825. }
  2826. }
  2827. func (s *DockerSuite) TestRunContainerNetModeWithDNSMacHosts(c *testing.T) {
  2828. // Not applicable on Windows which does not support --net=container
  2829. testRequires(c, DaemonIsLinux)
  2830. out, _, err := dockerCmdWithError("run", "-d", "--name", "parent", "busybox", "top")
  2831. if err != nil {
  2832. c.Fatalf("failed to run container: %v, output: %q", err, out)
  2833. }
  2834. out, _, err = dockerCmdWithError("run", "--dns", "1.2.3.4", "--net=container:parent", "busybox")
  2835. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkAndDNS.Error()) {
  2836. c.Fatalf("run --net=container with --dns should error out")
  2837. }
  2838. out, _, err = dockerCmdWithError("run", "--mac-address", "92:d0:c6:0a:29:33", "--net=container:parent", "busybox")
  2839. if err == nil || !strings.Contains(out, runconfig.ErrConflictContainerNetworkAndMac.Error()) {
  2840. c.Fatalf("run --net=container with --mac-address should error out")
  2841. }
  2842. out, _, err = dockerCmdWithError("run", "--add-host", "test:192.168.2.109", "--net=container:parent", "busybox")
  2843. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkHosts.Error()) {
  2844. c.Fatalf("run --net=container with --add-host should error out")
  2845. }
  2846. }
  2847. func (s *DockerSuite) TestRunContainerNetModeWithExposePort(c *testing.T) {
  2848. // Not applicable on Windows which does not support --net=container
  2849. testRequires(c, DaemonIsLinux)
  2850. dockerCmd(c, "run", "-d", "--name", "parent", "busybox", "top")
  2851. out, _, err := dockerCmdWithError("run", "-p", "5000:5000", "--net=container:parent", "busybox")
  2852. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkPublishPorts.Error()) {
  2853. c.Fatalf("run --net=container with -p should error out")
  2854. }
  2855. out, _, err = dockerCmdWithError("run", "-P", "--net=container:parent", "busybox")
  2856. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkPublishPorts.Error()) {
  2857. c.Fatalf("run --net=container with -P should error out")
  2858. }
  2859. out, _, err = dockerCmdWithError("run", "--expose", "5000", "--net=container:parent", "busybox")
  2860. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkExposePorts.Error()) {
  2861. c.Fatalf("run --net=container with --expose should error out")
  2862. }
  2863. }
  2864. func (s *DockerSuite) TestRunLinkToContainerNetMode(c *testing.T) {
  2865. // Not applicable on Windows which does not support --net=container or --link
  2866. testRequires(c, DaemonIsLinux)
  2867. dockerCmd(c, "run", "--name", "test", "-d", "busybox", "top")
  2868. dockerCmd(c, "run", "--name", "parent", "-d", "--net=container:test", "busybox", "top")
  2869. dockerCmd(c, "run", "-d", "--link=parent:parent", "busybox", "top")
  2870. dockerCmd(c, "run", "--name", "child", "-d", "--net=container:parent", "busybox", "top")
  2871. dockerCmd(c, "run", "-d", "--link=child:child", "busybox", "top")
  2872. }
  2873. func (s *DockerSuite) TestRunLoopbackOnlyExistsWhenNetworkingDisabled(c *testing.T) {
  2874. // TODO Windows: This may be possible to convert.
  2875. testRequires(c, DaemonIsLinux)
  2876. out, _ := dockerCmd(c, "run", "--net=none", "busybox", "ip", "-o", "-4", "a", "show", "up")
  2877. var (
  2878. count = 0
  2879. parts = strings.Split(out, "\n")
  2880. )
  2881. for _, l := range parts {
  2882. if l != "" {
  2883. count++
  2884. }
  2885. }
  2886. if count != 1 {
  2887. c.Fatalf("Wrong interface count in container %d", count)
  2888. }
  2889. if !strings.HasPrefix(out, "1: lo") {
  2890. c.Fatalf("Wrong interface in test container: expected [1: lo], got %s", out)
  2891. }
  2892. }
  2893. // Issue #4681
  2894. func (s *DockerSuite) TestRunLoopbackWhenNetworkDisabled(c *testing.T) {
  2895. if testEnv.OSType == "windows" {
  2896. dockerCmd(c, "run", "--net=none", testEnv.PlatformDefaults.BaseImage, "ping", "-n", "1", "127.0.0.1")
  2897. } else {
  2898. dockerCmd(c, "run", "--net=none", "busybox", "ping", "-c", "1", "127.0.0.1")
  2899. }
  2900. }
  2901. func (s *DockerSuite) TestRunModeNetContainerHostname(c *testing.T) {
  2902. // Windows does not support --net=container
  2903. testRequires(c, DaemonIsLinux)
  2904. dockerCmd(c, "run", "-i", "-d", "--name", "parent", "busybox", "top")
  2905. out, _ := dockerCmd(c, "exec", "parent", "cat", "/etc/hostname")
  2906. out1, _ := dockerCmd(c, "run", "--net=container:parent", "busybox", "cat", "/etc/hostname")
  2907. if out1 != out {
  2908. c.Fatal("containers with shared net namespace should have same hostname")
  2909. }
  2910. }
  2911. func (s *DockerSuite) TestRunNetworkNotInitializedNoneMode(c *testing.T) {
  2912. // TODO Windows: Network settings are not currently propagated. This may
  2913. // be resolved in the future with the move to libnetwork and CNM.
  2914. testRequires(c, DaemonIsLinux)
  2915. out, _ := dockerCmd(c, "run", "-d", "--net=none", "busybox", "top")
  2916. id := strings.TrimSpace(out)
  2917. res := inspectField(c, id, "NetworkSettings.Networks.none.IPAddress")
  2918. if res != "" {
  2919. c.Fatalf("For 'none' mode network must not be initialized, but container got IP: %s", res)
  2920. }
  2921. }
  2922. func (s *DockerSuite) TestTwoContainersInNetHost(c *testing.T) {
  2923. // Not applicable as Windows does not support --net=host
  2924. testRequires(c, DaemonIsLinux, NotUserNamespace, NotUserNamespace)
  2925. dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
  2926. dockerCmd(c, "run", "-d", "--net=host", "--name=second", "busybox", "top")
  2927. dockerCmd(c, "stop", "first")
  2928. dockerCmd(c, "stop", "second")
  2929. }
  2930. func (s *DockerSuite) TestContainersInUserDefinedNetwork(c *testing.T) {
  2931. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  2932. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork")
  2933. dockerCmd(c, "run", "-d", "--net=testnetwork", "--name=first", "busybox", "top")
  2934. assert.Assert(c, waitRun("first") == nil)
  2935. dockerCmd(c, "run", "-t", "--net=testnetwork", "--name=second", "busybox", "ping", "-c", "1", "first")
  2936. }
  2937. func (s *DockerSuite) TestContainersInMultipleNetworks(c *testing.T) {
  2938. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  2939. // Create 2 networks using bridge driver
  2940. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  2941. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  2942. // Run and connect containers to testnetwork1
  2943. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  2944. assert.Assert(c, waitRun("first") == nil)
  2945. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  2946. assert.Assert(c, waitRun("second") == nil)
  2947. // Check connectivity between containers in testnetwork2
  2948. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  2949. // Connect containers to testnetwork2
  2950. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  2951. dockerCmd(c, "network", "connect", "testnetwork2", "second")
  2952. // Check connectivity between containers
  2953. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  2954. }
  2955. func (s *DockerSuite) TestContainersNetworkIsolation(c *testing.T) {
  2956. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  2957. // Create 2 networks using bridge driver
  2958. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  2959. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  2960. // Run 1 container in testnetwork1 and another in testnetwork2
  2961. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  2962. assert.Assert(c, waitRun("first") == nil)
  2963. dockerCmd(c, "run", "-d", "--net=testnetwork2", "--name=second", "busybox", "top")
  2964. assert.Assert(c, waitRun("second") == nil)
  2965. // Check Isolation between containers : ping must fail
  2966. _, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  2967. assert.ErrorContains(c, err, "")
  2968. // Connect first container to testnetwork2
  2969. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  2970. // ping must succeed now
  2971. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  2972. assert.NilError(c, err)
  2973. // Disconnect first container from testnetwork2
  2974. dockerCmd(c, "network", "disconnect", "testnetwork2", "first")
  2975. // ping must fail again
  2976. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  2977. assert.ErrorContains(c, err, "")
  2978. }
  2979. func (s *DockerSuite) TestNetworkRmWithActiveContainers(c *testing.T) {
  2980. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2981. // Create 2 networks using bridge driver
  2982. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  2983. // Run and connect containers to testnetwork1
  2984. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  2985. assert.Assert(c, waitRun("first") == nil)
  2986. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  2987. assert.Assert(c, waitRun("second") == nil)
  2988. // Network delete with active containers must fail
  2989. _, _, err := dockerCmdWithError("network", "rm", "testnetwork1")
  2990. assert.ErrorContains(c, err, "")
  2991. dockerCmd(c, "stop", "first")
  2992. _, _, err = dockerCmdWithError("network", "rm", "testnetwork1")
  2993. assert.ErrorContains(c, err, "")
  2994. }
  2995. func (s *DockerSuite) TestContainerRestartInMultipleNetworks(c *testing.T) {
  2996. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  2997. // Create 2 networks using bridge driver
  2998. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  2999. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  3000. // Run and connect containers to testnetwork1
  3001. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  3002. assert.Assert(c, waitRun("first") == nil)
  3003. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3004. assert.Assert(c, waitRun("second") == nil)
  3005. // Check connectivity between containers in testnetwork2
  3006. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3007. // Connect containers to testnetwork2
  3008. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  3009. dockerCmd(c, "network", "connect", "testnetwork2", "second")
  3010. // Check connectivity between containers
  3011. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  3012. // Stop second container and test ping failures on both networks
  3013. dockerCmd(c, "stop", "second")
  3014. _, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3015. assert.ErrorContains(c, err, "")
  3016. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork2")
  3017. assert.ErrorContains(c, err, "")
  3018. // Start second container and connectivity must be restored on both networks
  3019. dockerCmd(c, "start", "second")
  3020. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3021. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  3022. }
  3023. func (s *DockerSuite) TestContainerWithConflictingHostNetworks(c *testing.T) {
  3024. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3025. // Run a container with --net=host
  3026. dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
  3027. assert.Assert(c, waitRun("first") == nil)
  3028. // Create a network using bridge driver
  3029. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3030. // Connecting to the user defined network must fail
  3031. _, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
  3032. assert.ErrorContains(c, err, "")
  3033. }
  3034. func (s *DockerSuite) TestContainerWithConflictingSharedNetwork(c *testing.T) {
  3035. testRequires(c, DaemonIsLinux)
  3036. dockerCmd(c, "run", "-d", "--name=first", "busybox", "top")
  3037. assert.Assert(c, waitRun("first") == nil)
  3038. // Run second container in first container's network namespace
  3039. dockerCmd(c, "run", "-d", "--net=container:first", "--name=second", "busybox", "top")
  3040. assert.Assert(c, waitRun("second") == nil)
  3041. // Create a network using bridge driver
  3042. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3043. // Connecting to the user defined network must fail
  3044. out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "second")
  3045. assert.ErrorContains(c, err, "")
  3046. assert.Assert(c, strings.Contains(out, runconfig.ErrConflictSharedNetwork.Error()))
  3047. }
  3048. func (s *DockerSuite) TestContainerWithConflictingNoneNetwork(c *testing.T) {
  3049. testRequires(c, DaemonIsLinux)
  3050. dockerCmd(c, "run", "-d", "--net=none", "--name=first", "busybox", "top")
  3051. assert.Assert(c, waitRun("first") == nil)
  3052. // Create a network using bridge driver
  3053. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3054. // Connecting to the user defined network must fail
  3055. out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
  3056. assert.ErrorContains(c, err, "")
  3057. assert.Assert(c, strings.Contains(out, runconfig.ErrConflictNoNetwork.Error()))
  3058. // create a container connected to testnetwork1
  3059. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3060. assert.Assert(c, waitRun("second") == nil)
  3061. // Connect second container to none network. it must fail as well
  3062. _, _, err = dockerCmdWithError("network", "connect", "none", "second")
  3063. assert.ErrorContains(c, err, "")
  3064. }
  3065. // #11957 - stdin with no tty does not exit if stdin is not closed even though container exited
  3066. func (s *DockerSuite) TestRunStdinBlockedAfterContainerExit(c *testing.T) {
  3067. cmd := exec.Command(dockerBinary, "run", "-i", "--name=test", "busybox", "true")
  3068. in, err := cmd.StdinPipe()
  3069. assert.NilError(c, err)
  3070. defer in.Close()
  3071. stdout := bytes.NewBuffer(nil)
  3072. cmd.Stdout = stdout
  3073. cmd.Stderr = stdout
  3074. assert.Assert(c, cmd.Start() == nil)
  3075. waitChan := make(chan error, 1)
  3076. go func() {
  3077. waitChan <- cmd.Wait()
  3078. }()
  3079. select {
  3080. case err := <-waitChan:
  3081. assert.Assert(c, err == nil, stdout.String())
  3082. case <-time.After(30 * time.Second):
  3083. c.Fatal("timeout waiting for command to exit")
  3084. }
  3085. }
  3086. func (s *DockerSuite) TestRunWrongCpusetCpusFlagValue(c *testing.T) {
  3087. // TODO Windows: This needs validation (error out) in the daemon.
  3088. testRequires(c, DaemonIsLinux)
  3089. out, exitCode, err := dockerCmdWithError("run", "--cpuset-cpus", "1-10,11--", "busybox", "true")
  3090. assert.ErrorContains(c, err, "")
  3091. expected := "Error response from daemon: Invalid value 1-10,11-- for cpuset cpus.\n"
  3092. if !(strings.Contains(out, expected) || exitCode == 125) {
  3093. c.Fatalf("Expected output to contain %q with exitCode 125, got out: %q exitCode: %v", expected, out, exitCode)
  3094. }
  3095. }
  3096. func (s *DockerSuite) TestRunWrongCpusetMemsFlagValue(c *testing.T) {
  3097. // TODO Windows: This needs validation (error out) in the daemon.
  3098. testRequires(c, DaemonIsLinux)
  3099. out, exitCode, err := dockerCmdWithError("run", "--cpuset-mems", "1-42--", "busybox", "true")
  3100. assert.ErrorContains(c, err, "")
  3101. expected := "Error response from daemon: Invalid value 1-42-- for cpuset mems.\n"
  3102. if !(strings.Contains(out, expected) || exitCode == 125) {
  3103. c.Fatalf("Expected output to contain %q with exitCode 125, got out: %q exitCode: %v", expected, out, exitCode)
  3104. }
  3105. }
  3106. // TestRunNonExecutableCmd checks that 'docker run busybox foo' exits with error code 127'
  3107. func (s *DockerSuite) TestRunNonExecutableCmd(c *testing.T) {
  3108. name := "testNonExecutableCmd"
  3109. icmd.RunCommand(dockerBinary, "run", "--name", name, "busybox", "foo").Assert(c, icmd.Expected{
  3110. ExitCode: 127,
  3111. Error: "exit status 127",
  3112. })
  3113. }
  3114. // TestRunNonExistingCmd checks that 'docker run busybox /bin/foo' exits with code 127.
  3115. func (s *DockerSuite) TestRunNonExistingCmd(c *testing.T) {
  3116. name := "testNonExistingCmd"
  3117. icmd.RunCommand(dockerBinary, "run", "--name", name, "busybox", "/bin/foo").Assert(c, icmd.Expected{
  3118. ExitCode: 127,
  3119. Error: "exit status 127",
  3120. })
  3121. }
  3122. // TestCmdCannotBeInvoked checks that 'docker run busybox /etc' exits with 126, or
  3123. // 127 on Windows. The difference is that in Windows, the container must be started
  3124. // as that's when the check is made (and yes, by its design...)
  3125. func (s *DockerSuite) TestCmdCannotBeInvoked(c *testing.T) {
  3126. expected := 126
  3127. if testEnv.OSType == "windows" {
  3128. expected = 127
  3129. }
  3130. name := "testCmdCannotBeInvoked"
  3131. icmd.RunCommand(dockerBinary, "run", "--name", name, "busybox", "/etc").Assert(c, icmd.Expected{
  3132. ExitCode: expected,
  3133. Error: fmt.Sprintf("exit status %d", expected),
  3134. })
  3135. }
  3136. // TestRunNonExistingImage checks that 'docker run foo' exits with error msg 125 and contains 'Unable to find image'
  3137. // FIXME(vdemeester) should be a unit test
  3138. func (s *DockerSuite) TestRunNonExistingImage(c *testing.T) {
  3139. icmd.RunCommand(dockerBinary, "run", "foo").Assert(c, icmd.Expected{
  3140. ExitCode: 125,
  3141. Err: "Unable to find image",
  3142. })
  3143. }
  3144. // TestDockerFails checks that 'docker run -foo busybox' exits with 125 to signal docker run failed
  3145. // FIXME(vdemeester) should be a unit test
  3146. func (s *DockerSuite) TestDockerFails(c *testing.T) {
  3147. icmd.RunCommand(dockerBinary, "run", "-foo", "busybox").Assert(c, icmd.Expected{
  3148. ExitCode: 125,
  3149. Error: "exit status 125",
  3150. })
  3151. }
  3152. // TestRunInvalidReference invokes docker run with a bad reference.
  3153. func (s *DockerSuite) TestRunInvalidReference(c *testing.T) {
  3154. out, exit, _ := dockerCmdWithError("run", "busybox@foo")
  3155. if exit == 0 {
  3156. c.Fatalf("expected non-zero exist code; received %d", exit)
  3157. }
  3158. if !strings.Contains(out, "invalid reference format") {
  3159. c.Fatalf(`Expected "invalid reference format" in output; got: %s`, out)
  3160. }
  3161. }
  3162. // Test fix for issue #17854
  3163. func (s *DockerSuite) TestRunInitLayerPathOwnership(c *testing.T) {
  3164. // Not applicable on Windows as it does not support Linux uid/gid ownership
  3165. testRequires(c, DaemonIsLinux)
  3166. name := "testetcfileownership"
  3167. buildImageSuccessfully(c, name, build.WithDockerfile(`FROM busybox
  3168. RUN echo 'dockerio:x:1001:1001::/bin:/bin/false' >> /etc/passwd
  3169. RUN echo 'dockerio:x:1001:' >> /etc/group
  3170. RUN chown dockerio:dockerio /etc`))
  3171. // Test that dockerio ownership of /etc is retained at runtime
  3172. out, _ := dockerCmd(c, "run", "--rm", name, "stat", "-c", "%U:%G", "/etc")
  3173. out = strings.TrimSpace(out)
  3174. if out != "dockerio:dockerio" {
  3175. c.Fatalf("Wrong /etc ownership: expected dockerio:dockerio, got %q", out)
  3176. }
  3177. }
  3178. func (s *DockerSuite) TestRunWithOomScoreAdj(c *testing.T) {
  3179. testRequires(c, DaemonIsLinux)
  3180. expected := "642"
  3181. out, _ := dockerCmd(c, "run", "--oom-score-adj", expected, "busybox", "cat", "/proc/self/oom_score_adj")
  3182. oomScoreAdj := strings.TrimSpace(out)
  3183. if oomScoreAdj != "642" {
  3184. c.Fatalf("Expected oom_score_adj set to %q, got %q instead", expected, oomScoreAdj)
  3185. }
  3186. }
  3187. func (s *DockerSuite) TestRunWithOomScoreAdjInvalidRange(c *testing.T) {
  3188. testRequires(c, DaemonIsLinux)
  3189. out, _, err := dockerCmdWithError("run", "--oom-score-adj", "1001", "busybox", "true")
  3190. assert.ErrorContains(c, err, "")
  3191. expected := "Invalid value 1001, range for oom score adj is [-1000, 1000]."
  3192. if !strings.Contains(out, expected) {
  3193. c.Fatalf("Expected output to contain %q, got %q instead", expected, out)
  3194. }
  3195. out, _, err = dockerCmdWithError("run", "--oom-score-adj", "-1001", "busybox", "true")
  3196. assert.ErrorContains(c, err, "")
  3197. expected = "Invalid value -1001, range for oom score adj is [-1000, 1000]."
  3198. if !strings.Contains(out, expected) {
  3199. c.Fatalf("Expected output to contain %q, got %q instead", expected, out)
  3200. }
  3201. }
  3202. func (s *DockerSuite) TestRunNamedVolumesMountedAsShared(c *testing.T) {
  3203. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3204. out, exitCode, _ := dockerCmdWithError("run", "-v", "foo:/test:shared", "busybox", "touch", "/test/somefile")
  3205. assert.Assert(c, exitCode != 0)
  3206. assert.Assert(c, strings.Contains(out, "invalid mount config"))
  3207. }
  3208. func (s *DockerSuite) TestRunNamedVolumeCopyImageData(c *testing.T) {
  3209. testRequires(c, DaemonIsLinux)
  3210. testImg := "testvolumecopy"
  3211. buildImageSuccessfully(c, testImg, build.WithDockerfile(`
  3212. FROM busybox
  3213. RUN mkdir -p /foo && echo hello > /foo/hello
  3214. `))
  3215. dockerCmd(c, "run", "-v", "foo:/foo", testImg)
  3216. out, _ := dockerCmd(c, "run", "-v", "foo:/foo", "busybox", "cat", "/foo/hello")
  3217. assert.Equal(c, strings.TrimSpace(out), "hello")
  3218. }
  3219. func (s *DockerSuite) TestRunNamedVolumeNotRemoved(c *testing.T) {
  3220. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  3221. dockerCmd(c, "volume", "create", "test")
  3222. dockerCmd(c, "run", "--rm", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
  3223. dockerCmd(c, "volume", "inspect", "test")
  3224. out, _ := dockerCmd(c, "volume", "ls", "-q")
  3225. assert.Assert(c, strings.Contains(out, "test"))
  3226. dockerCmd(c, "run", "--name=test", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
  3227. dockerCmd(c, "rm", "-fv", "test")
  3228. dockerCmd(c, "volume", "inspect", "test")
  3229. out, _ = dockerCmd(c, "volume", "ls", "-q")
  3230. assert.Assert(c, strings.Contains(out, "test"))
  3231. }
  3232. func (s *DockerSuite) TestRunNamedVolumesFromNotRemoved(c *testing.T) {
  3233. prefix, _ := getPrefixAndSlashFromDaemonPlatform()
  3234. dockerCmd(c, "volume", "create", "test")
  3235. cid, _ := dockerCmd(c, "run", "-d", "--name=parent", "-v", "test:"+prefix+"/foo", "-v", prefix+"/bar", "busybox", "true")
  3236. dockerCmd(c, "run", "--name=child", "--volumes-from=parent", "busybox", "true")
  3237. cli, err := client.NewClientWithOpts(client.FromEnv)
  3238. assert.NilError(c, err)
  3239. defer cli.Close()
  3240. container, err := cli.ContainerInspect(context.Background(), strings.TrimSpace(cid))
  3241. assert.NilError(c, err)
  3242. var vname string
  3243. for _, v := range container.Mounts {
  3244. if v.Name != "test" {
  3245. vname = v.Name
  3246. }
  3247. }
  3248. assert.Assert(c, vname != "")
  3249. // Remove the parent so there are not other references to the volumes
  3250. dockerCmd(c, "rm", "-f", "parent")
  3251. // now remove the child and ensure the named volume (and only the named volume) still exists
  3252. dockerCmd(c, "rm", "-fv", "child")
  3253. dockerCmd(c, "volume", "inspect", "test")
  3254. out, _ := dockerCmd(c, "volume", "ls", "-q")
  3255. assert.Assert(c, strings.Contains(out, "test"))
  3256. assert.Assert(c, !strings.Contains(strings.TrimSpace(out), vname))
  3257. }
  3258. func (s *DockerSuite) TestRunAttachFailedNoLeak(c *testing.T) {
  3259. nroutines, err := getGoroutineNumber()
  3260. assert.NilError(c, err)
  3261. runSleepingContainer(c, "--name=test", "-p", "8000:8000")
  3262. // Wait until container is fully up and running
  3263. assert.Assert(c, waitRun("test") == nil)
  3264. out, _, err := dockerCmdWithError("run", "--name=fail", "-p", "8000:8000", "busybox", "true")
  3265. // We will need the following `inspect` to diagnose the issue if test fails (#21247)
  3266. out1, err1 := dockerCmd(c, "inspect", "--format", "{{json .State}}", "test")
  3267. out2, err2 := dockerCmd(c, "inspect", "--format", "{{json .State}}", "fail")
  3268. assert.Assert(c, err != nil, "Command should have failed but succeeded with: %s\nContainer 'test' [%+v]: %s\nContainer 'fail' [%+v]: %s", out, err1, out1, err2, out2)
  3269. // check for windows error as well
  3270. // TODO Windows Post TP5. Fix the error message string
  3271. outLowerCase := strings.ToLower(out)
  3272. assert.Assert(c, strings.Contains(outLowerCase, "port is already allocated") ||
  3273. strings.Contains(outLowerCase, "were not connected because a duplicate name exists") ||
  3274. strings.Contains(outLowerCase, "the specified port already exists") ||
  3275. strings.Contains(outLowerCase, "hns failed with error : failed to create endpoint") ||
  3276. strings.Contains(outLowerCase, "hns failed with error : the object already exists"), fmt.Sprintf("Output: %s", out))
  3277. dockerCmd(c, "rm", "-f", "test")
  3278. // NGoroutines is not updated right away, so we need to wait before failing
  3279. assert.Assert(c, waitForGoroutines(nroutines) == nil)
  3280. }
  3281. // Test for one character directory name case (#20122)
  3282. func (s *DockerSuite) TestRunVolumeWithOneCharacter(c *testing.T) {
  3283. testRequires(c, DaemonIsLinux)
  3284. out, _ := dockerCmd(c, "run", "-v", "/tmp/q:/foo", "busybox", "sh", "-c", "find /foo")
  3285. assert.Equal(c, strings.TrimSpace(out), "/foo")
  3286. }
  3287. func (s *DockerSuite) TestRunVolumeCopyFlag(c *testing.T) {
  3288. testRequires(c, DaemonIsLinux) // Windows does not support copying data from image to the volume
  3289. buildImageSuccessfully(c, "volumecopy", build.WithDockerfile(`FROM busybox
  3290. RUN mkdir /foo && echo hello > /foo/bar
  3291. CMD cat /foo/bar`))
  3292. dockerCmd(c, "volume", "create", "test")
  3293. // test with the nocopy flag
  3294. out, _, err := dockerCmdWithError("run", "-v", "test:/foo:nocopy", "volumecopy")
  3295. assert.ErrorContains(c, err, "", out)
  3296. // test default behavior which is to copy for non-binds
  3297. out, _ = dockerCmd(c, "run", "-v", "test:/foo", "volumecopy")
  3298. assert.Equal(c, strings.TrimSpace(out), "hello")
  3299. // error out when the volume is already populated
  3300. out, _, err = dockerCmdWithError("run", "-v", "test:/foo:copy", "volumecopy")
  3301. assert.ErrorContains(c, err, "", out)
  3302. // do not error out when copy isn't explicitly set even though it's already populated
  3303. out, _ = dockerCmd(c, "run", "-v", "test:/foo", "volumecopy")
  3304. assert.Equal(c, strings.TrimSpace(out), "hello")
  3305. // do not allow copy modes on volumes-from
  3306. dockerCmd(c, "run", "--name=test", "-v", "/foo", "busybox", "true")
  3307. out, _, err = dockerCmdWithError("run", "--volumes-from=test:copy", "busybox", "true")
  3308. assert.ErrorContains(c, err, "", out)
  3309. out, _, err = dockerCmdWithError("run", "--volumes-from=test:nocopy", "busybox", "true")
  3310. assert.ErrorContains(c, err, "", out)
  3311. // do not allow copy modes on binds
  3312. out, _, err = dockerCmdWithError("run", "-v", "/foo:/bar:copy", "busybox", "true")
  3313. assert.ErrorContains(c, err, "", out)
  3314. out, _, err = dockerCmdWithError("run", "-v", "/foo:/bar:nocopy", "busybox", "true")
  3315. assert.ErrorContains(c, err, "", out)
  3316. }
  3317. // Test case for #21976
  3318. func (s *DockerSuite) TestRunDNSInHostMode(c *testing.T) {
  3319. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3320. expectedOutput := "nameserver 127.0.0.1"
  3321. expectedWarning := "Localhost DNS setting"
  3322. cli.DockerCmd(c, "run", "--dns=127.0.0.1", "--net=host", "busybox", "cat", "/etc/resolv.conf").Assert(c, icmd.Expected{
  3323. Out: expectedOutput,
  3324. Err: expectedWarning,
  3325. })
  3326. expectedOutput = "nameserver 1.2.3.4"
  3327. cli.DockerCmd(c, "run", "--dns=1.2.3.4", "--net=host", "busybox", "cat", "/etc/resolv.conf").Assert(c, icmd.Expected{
  3328. Out: expectedOutput,
  3329. })
  3330. expectedOutput = "search example.com"
  3331. cli.DockerCmd(c, "run", "--dns-search=example.com", "--net=host", "busybox", "cat", "/etc/resolv.conf").Assert(c, icmd.Expected{
  3332. Out: expectedOutput,
  3333. })
  3334. expectedOutput = "options timeout:3"
  3335. cli.DockerCmd(c, "run", "--dns-opt=timeout:3", "--net=host", "busybox", "cat", "/etc/resolv.conf").Assert(c, icmd.Expected{
  3336. Out: expectedOutput,
  3337. })
  3338. expectedOutput1 := "nameserver 1.2.3.4"
  3339. expectedOutput2 := "search example.com"
  3340. expectedOutput3 := "options timeout:3"
  3341. out := cli.DockerCmd(c, "run", "--dns=1.2.3.4", "--dns-search=example.com", "--dns-opt=timeout:3", "--net=host", "busybox", "cat", "/etc/resolv.conf").Combined()
  3342. assert.Assert(c, strings.Contains(out, expectedOutput1), "Expected '%s', but got %q", expectedOutput1, out)
  3343. assert.Assert(c, strings.Contains(out, expectedOutput2), "Expected '%s', but got %q", expectedOutput2, out)
  3344. assert.Assert(c, strings.Contains(out, expectedOutput3), "Expected '%s', but got %q", expectedOutput3, out)
  3345. }
  3346. // Test case for #21976
  3347. func (s *DockerSuite) TestRunAddHostInHostMode(c *testing.T) {
  3348. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3349. expectedOutput := "1.2.3.4\textra"
  3350. out, _ := dockerCmd(c, "run", "--add-host=extra:1.2.3.4", "--net=host", "busybox", "cat", "/etc/hosts")
  3351. assert.Assert(c, strings.Contains(out, expectedOutput), "Expected '%s', but got %q", expectedOutput, out)
  3352. }
  3353. func (s *DockerSuite) TestRunRmAndWait(c *testing.T) {
  3354. dockerCmd(c, "run", "--name=test", "--rm", "-d", "busybox", "sh", "-c", "sleep 3;exit 2")
  3355. out, code, err := dockerCmdWithError("wait", "test")
  3356. assert.Assert(c, err == nil, "out: %s; exit code: %d", out, code)
  3357. assert.Equal(c, out, "2\n", "exit code: %d", code)
  3358. assert.Equal(c, code, 0)
  3359. }
  3360. // Test that auto-remove is performed by the daemon (API 1.25 and above)
  3361. func (s *DockerSuite) TestRunRm(c *testing.T) {
  3362. name := "miss-me-when-im-gone"
  3363. cli.DockerCmd(c, "run", "--name="+name, "--rm", "busybox")
  3364. cli.Docker(cli.Inspect(name), cli.Format(".name")).Assert(c, icmd.Expected{
  3365. ExitCode: 1,
  3366. Err: "No such object: " + name,
  3367. })
  3368. }
  3369. // Test that auto-remove is performed by the client on API versions that do not support daemon-side api-remove (API < 1.25)
  3370. func (s *DockerSuite) TestRunRmPre125Api(c *testing.T) {
  3371. name := "miss-me-when-im-gone"
  3372. envs := appendBaseEnv(os.Getenv("DOCKER_TLS_VERIFY") != "", "DOCKER_API_VERSION=1.24")
  3373. cli.Docker(cli.Args("run", "--name="+name, "--rm", "busybox"), cli.WithEnvironmentVariables(envs...)).Assert(c, icmd.Success)
  3374. cli.Docker(cli.Inspect(name), cli.Format(".name")).Assert(c, icmd.Expected{
  3375. ExitCode: 1,
  3376. Err: "No such object: " + name,
  3377. })
  3378. }
  3379. // Test case for #23498
  3380. func (s *DockerSuite) TestRunUnsetEntrypoint(c *testing.T) {
  3381. testRequires(c, DaemonIsLinux)
  3382. name := "test-entrypoint"
  3383. dockerfile := `FROM busybox
  3384. ADD entrypoint.sh /entrypoint.sh
  3385. RUN chmod 755 /entrypoint.sh
  3386. ENTRYPOINT ["/entrypoint.sh"]
  3387. CMD echo foobar`
  3388. ctx := fakecontext.New(c, "",
  3389. fakecontext.WithDockerfile(dockerfile),
  3390. fakecontext.WithFiles(map[string]string{
  3391. "entrypoint.sh": `#!/bin/sh
  3392. echo "I am an entrypoint"
  3393. exec "$@"`,
  3394. }))
  3395. defer ctx.Close()
  3396. cli.BuildCmd(c, name, build.WithExternalBuildContext(ctx))
  3397. out := cli.DockerCmd(c, "run", "--entrypoint=", "-t", name, "echo", "foo").Combined()
  3398. assert.Equal(c, strings.TrimSpace(out), "foo")
  3399. // CMD will be reset as well (the same as setting a custom entrypoint)
  3400. cli.Docker(cli.Args("run", "--entrypoint=", "-t", name)).Assert(c, icmd.Expected{
  3401. ExitCode: 125,
  3402. Err: "No command specified",
  3403. })
  3404. }
  3405. func (s *DockerDaemonSuite) TestRunWithUlimitAndDaemonDefault(c *testing.T) {
  3406. s.d.StartWithBusybox(c, "--debug", "--default-ulimit=nofile=65535")
  3407. name := "test-A"
  3408. _, err := s.d.Cmd("run", "--name", name, "-d", "busybox", "top")
  3409. assert.NilError(c, err)
  3410. assert.NilError(c, s.d.WaitRun(name))
  3411. out, err := s.d.Cmd("inspect", "--format", "{{.HostConfig.Ulimits}}", name)
  3412. assert.NilError(c, err)
  3413. assert.Assert(c, strings.Contains(out, "[nofile=65535:65535]"))
  3414. name = "test-B"
  3415. _, err = s.d.Cmd("run", "--name", name, "--ulimit=nofile=42", "-d", "busybox", "top")
  3416. assert.NilError(c, err)
  3417. assert.NilError(c, s.d.WaitRun(name))
  3418. out, err = s.d.Cmd("inspect", "--format", "{{.HostConfig.Ulimits}}", name)
  3419. assert.NilError(c, err)
  3420. assert.Assert(c, strings.Contains(out, "[nofile=42:42]"))
  3421. }
  3422. func (s *DockerSuite) TestRunStoppedLoggingDriverNoLeak(c *testing.T) {
  3423. nroutines, err := getGoroutineNumber()
  3424. assert.NilError(c, err)
  3425. out, _, err := dockerCmdWithError("run", "--name=fail", "--log-driver=splunk", "busybox", "true")
  3426. assert.ErrorContains(c, err, "")
  3427. assert.Assert(c, strings.Contains(out, "failed to initialize logging driver"), "error should be about logging driver, got output %s", out)
  3428. // NGoroutines is not updated right away, so we need to wait before failing
  3429. assert.Assert(c, waitForGoroutines(nroutines) == nil)
  3430. }
  3431. // Handles error conditions for --credentialspec. Validating E2E success cases
  3432. // requires additional infrastructure (AD for example) on CI servers.
  3433. func (s *DockerSuite) TestRunCredentialSpecFailures(c *testing.T) {
  3434. testRequires(c, DaemonIsWindows)
  3435. attempts := []struct{ value, expectedError string }{
  3436. {"rubbish", "invalid credential spec security option - value must be prefixed by 'file://', 'registry://', or 'raw://' followed by a non-empty value"},
  3437. {"rubbish://", "invalid credential spec security option - value must be prefixed by 'file://', 'registry://', or 'raw://' followed by a non-empty value"},
  3438. {"file://", "invalid credential spec security option - value must be prefixed by 'file://', 'registry://', or 'raw://' followed by a non-empty value"},
  3439. {"registry://", "invalid credential spec security option - value must be prefixed by 'file://', 'registry://', or 'raw://' followed by a non-empty value"},
  3440. {`file://c:\blah.txt`, "path cannot be absolute"},
  3441. {`file://doesnotexist.txt`, "The system cannot find the file specified"},
  3442. }
  3443. for _, attempt := range attempts {
  3444. _, _, err := dockerCmdWithError("run", "--security-opt=credentialspec="+attempt.value, "busybox", "true")
  3445. assert.Assert(c, err != nil, "%s expected non-nil err", attempt.value)
  3446. assert.Assert(c, strings.Contains(err.Error(), attempt.expectedError), "%s expected %s got %s", attempt.value, attempt.expectedError, err)
  3447. }
  3448. }
  3449. // Windows specific test to validate credential specs with a well-formed spec.
  3450. func (s *DockerSuite) TestRunCredentialSpecWellFormed(c *testing.T) {
  3451. testRequires(c, DaemonIsWindows, testEnv.IsLocalDaemon)
  3452. validCredSpecs := readFile(`fixtures\credentialspecs\valid.json`, c)
  3453. writeFile(filepath.Join(testEnv.DaemonInfo.DockerRootDir, `credentialspecs\valid.json`), validCredSpecs, c)
  3454. for _, value := range []string{"file://valid.json", "raw://" + validCredSpecs} {
  3455. // `nltest /PARENTDOMAIN` simply reads the local config, and does not require having an AD
  3456. // controller handy
  3457. out, _ := dockerCmd(c, "run", "--rm", "--security-opt=credentialspec="+value, minimalBaseImage(), "nltest", "/PARENTDOMAIN")
  3458. assert.Assert(c, strings.Contains(out, "hyperv.local."))
  3459. assert.Assert(c, strings.Contains(out, "The command completed successfully"))
  3460. }
  3461. }
  3462. func (s *DockerSuite) TestRunDuplicateMount(c *testing.T) {
  3463. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  3464. tmpFile, err := ioutil.TempFile("", "touch-me")
  3465. assert.NilError(c, err)
  3466. defer tmpFile.Close()
  3467. data := "touch-me-foo-bar\n"
  3468. if _, err := tmpFile.Write([]byte(data)); err != nil {
  3469. c.Fatal(err)
  3470. }
  3471. name := "test"
  3472. out, _ := dockerCmd(c, "run", "--name", name, "-v", "/tmp:/tmp", "-v", "/tmp:/tmp", "busybox", "sh", "-c", "cat "+tmpFile.Name()+" && ls /")
  3473. assert.Assert(c, !strings.Contains(out, "tmp:"))
  3474. assert.Assert(c, strings.Contains(out, data))
  3475. out = inspectFieldJSON(c, name, "Config.Volumes")
  3476. assert.Assert(c, strings.Contains(out, "null"))
  3477. }
  3478. func (s *DockerSuite) TestRunWindowsWithCPUCount(c *testing.T) {
  3479. testRequires(c, DaemonIsWindows)
  3480. out, _ := dockerCmd(c, "run", "--cpu-count=1", "--name", "test", "busybox", "echo", "testing")
  3481. assert.Equal(c, strings.TrimSpace(out), "testing")
  3482. out = inspectField(c, "test", "HostConfig.CPUCount")
  3483. assert.Equal(c, out, "1")
  3484. }
  3485. func (s *DockerSuite) TestRunWindowsWithCPUShares(c *testing.T) {
  3486. testRequires(c, DaemonIsWindows)
  3487. out, _ := dockerCmd(c, "run", "--cpu-shares=1000", "--name", "test", "busybox", "echo", "testing")
  3488. assert.Equal(c, strings.TrimSpace(out), "testing")
  3489. out = inspectField(c, "test", "HostConfig.CPUShares")
  3490. assert.Equal(c, out, "1000")
  3491. }
  3492. func (s *DockerSuite) TestRunWindowsWithCPUPercent(c *testing.T) {
  3493. testRequires(c, DaemonIsWindows)
  3494. out, _ := dockerCmd(c, "run", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
  3495. assert.Equal(c, strings.TrimSpace(out), "testing")
  3496. out = inspectField(c, "test", "HostConfig.CPUPercent")
  3497. assert.Equal(c, out, "80")
  3498. }
  3499. func (s *DockerSuite) TestRunProcessIsolationWithCPUCountCPUSharesAndCPUPercent(c *testing.T) {
  3500. testRequires(c, IsolationIsProcess)
  3501. out, _ := dockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
  3502. assert.Assert(c, strings.Contains(strings.TrimSpace(out), "WARNING: Conflicting options: CPU count takes priority over CPU shares on Windows Server Containers. CPU shares discarded"))
  3503. assert.Assert(c, strings.Contains(strings.TrimSpace(out), "WARNING: Conflicting options: CPU count takes priority over CPU percent on Windows Server Containers. CPU percent discarded"))
  3504. assert.Assert(c, strings.Contains(strings.TrimSpace(out), "testing"))
  3505. out = inspectField(c, "test", "HostConfig.CPUCount")
  3506. assert.Equal(c, out, "1")
  3507. out = inspectField(c, "test", "HostConfig.CPUShares")
  3508. assert.Equal(c, out, "0")
  3509. out = inspectField(c, "test", "HostConfig.CPUPercent")
  3510. assert.Equal(c, out, "0")
  3511. }
  3512. func (s *DockerSuite) TestRunHypervIsolationWithCPUCountCPUSharesAndCPUPercent(c *testing.T) {
  3513. testRequires(c, IsolationIsHyperv)
  3514. out, _ := dockerCmd(c, "run", "--cpu-count=1", "--cpu-shares=1000", "--cpu-percent=80", "--name", "test", "busybox", "echo", "testing")
  3515. assert.Assert(c, strings.Contains(strings.TrimSpace(out), "testing"))
  3516. out = inspectField(c, "test", "HostConfig.CPUCount")
  3517. assert.Equal(c, out, "1")
  3518. out = inspectField(c, "test", "HostConfig.CPUShares")
  3519. assert.Equal(c, out, "1000")
  3520. out = inspectField(c, "test", "HostConfig.CPUPercent")
  3521. assert.Equal(c, out, "80")
  3522. }
  3523. // Test for #25099
  3524. func (s *DockerSuite) TestRunEmptyEnv(c *testing.T) {
  3525. testRequires(c, DaemonIsLinux)
  3526. expectedOutput := "invalid environment variable:"
  3527. out, _, err := dockerCmdWithError("run", "-e", "", "busybox", "true")
  3528. assert.ErrorContains(c, err, "")
  3529. assert.Assert(c, strings.Contains(out, expectedOutput))
  3530. out, _, err = dockerCmdWithError("run", "-e", "=", "busybox", "true")
  3531. assert.ErrorContains(c, err, "")
  3532. assert.Assert(c, strings.Contains(out, expectedOutput))
  3533. out, _, err = dockerCmdWithError("run", "-e", "=foo", "busybox", "true")
  3534. assert.ErrorContains(c, err, "")
  3535. assert.Assert(c, strings.Contains(out, expectedOutput))
  3536. }
  3537. // #28658
  3538. func (s *DockerSuite) TestSlowStdinClosing(c *testing.T) {
  3539. name := "testslowstdinclosing"
  3540. repeat := 3 // regression happened 50% of the time
  3541. for i := 0; i < repeat; i++ {
  3542. cmd := icmd.Cmd{
  3543. Command: []string{dockerBinary, "run", "--rm", "--name", name, "-i", "busybox", "cat"},
  3544. Stdin: &delayedReader{},
  3545. }
  3546. done := make(chan error, 1)
  3547. go func() {
  3548. err := icmd.RunCmd(cmd).Error
  3549. done <- err
  3550. }()
  3551. select {
  3552. case <-time.After(30 * time.Second):
  3553. c.Fatal("running container timed out") // cleanup in teardown
  3554. case err := <-done:
  3555. assert.NilError(c, err)
  3556. }
  3557. }
  3558. }
  3559. type delayedReader struct{}
  3560. func (s *delayedReader) Read([]byte) (int, error) {
  3561. time.Sleep(500 * time.Millisecond)
  3562. return 0, io.EOF
  3563. }
  3564. // #28823 (originally #28639)
  3565. func (s *DockerSuite) TestRunMountReadOnlyDevShm(c *testing.T) {
  3566. testRequires(c, testEnv.IsLocalDaemon, DaemonIsLinux, NotUserNamespace)
  3567. emptyDir, err := ioutil.TempDir("", "test-read-only-dev-shm")
  3568. assert.NilError(c, err)
  3569. defer os.RemoveAll(emptyDir)
  3570. out, _, err := dockerCmdWithError("run", "--rm", "--read-only",
  3571. "-v", fmt.Sprintf("%s:/dev/shm:ro", emptyDir),
  3572. "busybox", "touch", "/dev/shm/foo")
  3573. assert.ErrorContains(c, err, "", out)
  3574. assert.Assert(c, strings.Contains(out, "Read-only file system"))
  3575. }
  3576. func (s *DockerSuite) TestRunMount(c *testing.T) {
  3577. testRequires(c, DaemonIsLinux, testEnv.IsLocalDaemon, NotUserNamespace)
  3578. // mnt1, mnt2, and testCatFooBar are commonly used in multiple test cases
  3579. tmpDir, err := ioutil.TempDir("", "mount")
  3580. if err != nil {
  3581. c.Fatal(err)
  3582. }
  3583. defer os.RemoveAll(tmpDir)
  3584. mnt1, mnt2 := path.Join(tmpDir, "mnt1"), path.Join(tmpDir, "mnt2")
  3585. if err := os.Mkdir(mnt1, 0755); err != nil {
  3586. c.Fatal(err)
  3587. }
  3588. if err := os.Mkdir(mnt2, 0755); err != nil {
  3589. c.Fatal(err)
  3590. }
  3591. if err := ioutil.WriteFile(path.Join(mnt1, "test1"), []byte("test1"), 0644); err != nil {
  3592. c.Fatal(err)
  3593. }
  3594. if err := ioutil.WriteFile(path.Join(mnt2, "test2"), []byte("test2"), 0644); err != nil {
  3595. c.Fatal(err)
  3596. }
  3597. testCatFooBar := func(cName string) error {
  3598. out, _ := dockerCmd(c, "exec", cName, "cat", "/foo/test1")
  3599. if out != "test1" {
  3600. return fmt.Errorf("%s not mounted on /foo", mnt1)
  3601. }
  3602. out, _ = dockerCmd(c, "exec", cName, "cat", "/bar/test2")
  3603. if out != "test2" {
  3604. return fmt.Errorf("%s not mounted on /bar", mnt2)
  3605. }
  3606. return nil
  3607. }
  3608. type testCase struct {
  3609. equivalents [][]string
  3610. valid bool
  3611. // fn should be nil if valid==false
  3612. fn func(cName string) error
  3613. }
  3614. cases := []testCase{
  3615. {
  3616. equivalents: [][]string{
  3617. {
  3618. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3619. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/bar", mnt2),
  3620. },
  3621. {
  3622. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3623. "--mount", fmt.Sprintf("type=bind,src=%s,target=/bar", mnt2),
  3624. },
  3625. {
  3626. "--volume", mnt1 + ":/foo",
  3627. "--mount", fmt.Sprintf("type=bind,src=%s,target=/bar", mnt2),
  3628. },
  3629. },
  3630. valid: true,
  3631. fn: testCatFooBar,
  3632. },
  3633. {
  3634. equivalents: [][]string{
  3635. {
  3636. "--mount", fmt.Sprintf("type=volume,src=%s,dst=/foo", mnt1),
  3637. "--mount", fmt.Sprintf("type=volume,src=%s,dst=/bar", mnt2),
  3638. },
  3639. {
  3640. "--mount", fmt.Sprintf("type=volume,src=%s,dst=/foo", mnt1),
  3641. "--mount", fmt.Sprintf("type=volume,src=%s,target=/bar", mnt2),
  3642. },
  3643. },
  3644. valid: false,
  3645. },
  3646. {
  3647. equivalents: [][]string{
  3648. {
  3649. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3650. "--mount", fmt.Sprintf("type=volume,src=%s,dst=/bar", mnt2),
  3651. },
  3652. {
  3653. "--volume", mnt1 + ":/foo",
  3654. "--mount", fmt.Sprintf("type=volume,src=%s,target=/bar", mnt2),
  3655. },
  3656. },
  3657. valid: false,
  3658. fn: testCatFooBar,
  3659. },
  3660. {
  3661. equivalents: [][]string{
  3662. {
  3663. "--read-only",
  3664. "--mount", "type=volume,dst=/bar",
  3665. },
  3666. },
  3667. valid: true,
  3668. fn: func(cName string) error {
  3669. _, _, err := dockerCmdWithError("exec", cName, "touch", "/bar/icanwritehere")
  3670. return err
  3671. },
  3672. },
  3673. {
  3674. equivalents: [][]string{
  3675. {
  3676. "--read-only",
  3677. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3678. "--mount", "type=volume,dst=/bar",
  3679. },
  3680. {
  3681. "--read-only",
  3682. "--volume", fmt.Sprintf("%s:/foo", mnt1),
  3683. "--mount", "type=volume,dst=/bar",
  3684. },
  3685. },
  3686. valid: true,
  3687. fn: func(cName string) error {
  3688. out, _ := dockerCmd(c, "exec", cName, "cat", "/foo/test1")
  3689. if out != "test1" {
  3690. return fmt.Errorf("%s not mounted on /foo", mnt1)
  3691. }
  3692. _, _, err := dockerCmdWithError("exec", cName, "touch", "/bar/icanwritehere")
  3693. return err
  3694. },
  3695. },
  3696. {
  3697. equivalents: [][]string{
  3698. {
  3699. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3700. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt2),
  3701. },
  3702. {
  3703. "--mount", fmt.Sprintf("type=bind,src=%s,dst=/foo", mnt1),
  3704. "--mount", fmt.Sprintf("type=bind,src=%s,target=/foo", mnt2),
  3705. },
  3706. {
  3707. "--volume", fmt.Sprintf("%s:/foo", mnt1),
  3708. "--mount", fmt.Sprintf("type=bind,src=%s,target=/foo", mnt2),
  3709. },
  3710. },
  3711. valid: false,
  3712. },
  3713. {
  3714. equivalents: [][]string{
  3715. {
  3716. "--volume", fmt.Sprintf("%s:/foo", mnt1),
  3717. "--mount", fmt.Sprintf("type=volume,src=%s,target=/foo", mnt2),
  3718. },
  3719. },
  3720. valid: false,
  3721. },
  3722. {
  3723. equivalents: [][]string{
  3724. {
  3725. "--mount", "type=volume,target=/foo",
  3726. "--mount", "type=volume,target=/foo",
  3727. },
  3728. },
  3729. valid: false,
  3730. },
  3731. }
  3732. for i, testCase := range cases {
  3733. for j, opts := range testCase.equivalents {
  3734. cName := fmt.Sprintf("mount-%d-%d", i, j)
  3735. _, _, err := dockerCmdWithError(append([]string{"run", "-i", "-d", "--name", cName},
  3736. append(opts, []string{"busybox", "top"}...)...)...)
  3737. if testCase.valid {
  3738. assert.Assert(c, err == nil, "got error while creating a container with %v (%s)", opts, cName)
  3739. assert.Assert(c, testCase.fn(cName) == nil, "got error while executing test for %v (%s)", opts, cName)
  3740. dockerCmd(c, "rm", "-f", cName)
  3741. } else {
  3742. assert.Assert(c, err != nil, "got nil while creating a container with %v (%s)", opts, cName)
  3743. }
  3744. }
  3745. }
  3746. }
  3747. // Test that passing a FQDN as hostname properly sets hostname, and
  3748. // /etc/hostname. Test case for 29100
  3749. func (s *DockerSuite) TestRunHostnameFQDN(c *testing.T) {
  3750. testRequires(c, DaemonIsLinux)
  3751. expectedOutput := "foobar.example.com\nfoobar.example.com\nfoobar\nexample.com\nfoobar.example.com"
  3752. out, _ := dockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hostname && hostname && hostname -s && hostname -d && hostname -f`)
  3753. assert.Equal(c, strings.TrimSpace(out), expectedOutput)
  3754. out, _ = dockerCmd(c, "run", "--hostname=foobar.example.com", "busybox", "sh", "-c", `cat /etc/hosts`)
  3755. expectedOutput = "foobar.example.com foobar"
  3756. assert.Assert(c, strings.Contains(strings.TrimSpace(out), expectedOutput))
  3757. }
  3758. // Test case for 29129
  3759. func (s *DockerSuite) TestRunHostnameInHostMode(c *testing.T) {
  3760. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3761. expectedOutput := "foobar\nfoobar"
  3762. out, _ := dockerCmd(c, "run", "--net=host", "--hostname=foobar", "busybox", "sh", "-c", `echo $HOSTNAME && hostname`)
  3763. assert.Equal(c, strings.TrimSpace(out), expectedOutput)
  3764. }
  3765. func (s *DockerSuite) TestRunAddDeviceCgroupRule(c *testing.T) {
  3766. testRequires(c, DaemonIsLinux)
  3767. deviceRule := "c 7:128 rwm"
  3768. out, _ := dockerCmd(c, "run", "--rm", "busybox", "cat", "/sys/fs/cgroup/devices/devices.list")
  3769. if strings.Contains(out, deviceRule) {
  3770. c.Fatalf("%s shouldn't been in the device.list", deviceRule)
  3771. }
  3772. out, _ = dockerCmd(c, "run", "--rm", fmt.Sprintf("--device-cgroup-rule=%s", deviceRule), "busybox", "grep", deviceRule, "/sys/fs/cgroup/devices/devices.list")
  3773. assert.Equal(c, strings.TrimSpace(out), deviceRule)
  3774. }
  3775. // Verifies that running as local system is operating correctly on Windows
  3776. func (s *DockerSuite) TestWindowsRunAsSystem(c *testing.T) {
  3777. testRequires(c, DaemonIsWindowsAtLeastBuild(osversion.RS3))
  3778. out, _ := dockerCmd(c, "run", "--net=none", `--user=nt authority\system`, "--hostname=XYZZY", minimalBaseImage(), "cmd", "/c", `@echo %USERNAME%`)
  3779. assert.Equal(c, strings.TrimSpace(out), "XYZZY$")
  3780. }