docker_cli_daemon_test.go 60 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410141114121413141414151416141714181419142014211422142314241425142614271428142914301431143214331434143514361437143814391440144114421443144414451446144714481449145014511452145314541455145614571458145914601461146214631464146514661467146814691470147114721473147414751476147714781479148014811482148314841485148614871488148914901491149214931494149514961497149814991500150115021503150415051506150715081509151015111512151315141515151615171518151915201521152215231524152515261527152815291530153115321533153415351536153715381539154015411542154315441545154615471548154915501551155215531554155515561557155815591560156115621563156415651566156715681569157015711572157315741575157615771578157915801581158215831584158515861587158815891590159115921593159415951596159715981599160016011602160316041605160616071608160916101611161216131614161516161617161816191620162116221623162416251626162716281629163016311632163316341635163616371638163916401641164216431644164516461647164816491650165116521653165416551656165716581659166016611662166316641665166616671668166916701671167216731674167516761677167816791680168116821683168416851686168716881689169016911692169316941695169616971698169917001701170217031704170517061707170817091710171117121713171417151716171717181719172017211722172317241725172617271728172917301731173217331734173517361737173817391740174117421743174417451746174717481749175017511752175317541755175617571758175917601761176217631764176517661767176817691770177117721773177417751776177717781779178017811782178317841785178617871788178917901791179217931794179517961797179817991800180118021803180418051806180718081809181018111812181318141815181618171818181918201821182218231824182518261827182818291830183118321833183418351836183718381839184018411842184318441845184618471848184918501851185218531854185518561857185818591860186118621863186418651866186718681869
  1. // +build daemon,!windows
  2. package main
  3. import (
  4. "bytes"
  5. "encoding/json"
  6. "fmt"
  7. "io/ioutil"
  8. "net"
  9. "os"
  10. "os/exec"
  11. "path/filepath"
  12. "regexp"
  13. "strconv"
  14. "strings"
  15. "time"
  16. "github.com/docker/docker/pkg/integration/checker"
  17. "github.com/docker/libnetwork/iptables"
  18. "github.com/docker/libtrust"
  19. "github.com/go-check/check"
  20. )
  21. func (s *DockerDaemonSuite) TestDaemonRestartWithRunningContainersPorts(c *check.C) {
  22. if err := s.d.StartWithBusybox(); err != nil {
  23. c.Fatalf("Could not start daemon with busybox: %v", err)
  24. }
  25. if out, err := s.d.Cmd("run", "-d", "--name", "top1", "-p", "1234:80", "--restart", "always", "busybox:latest", "top"); err != nil {
  26. c.Fatalf("Could not run top1: err=%v\n%s", err, out)
  27. }
  28. // --restart=no by default
  29. if out, err := s.d.Cmd("run", "-d", "--name", "top2", "-p", "80", "busybox:latest", "top"); err != nil {
  30. c.Fatalf("Could not run top2: err=%v\n%s", err, out)
  31. }
  32. testRun := func(m map[string]bool, prefix string) {
  33. var format string
  34. for cont, shouldRun := range m {
  35. out, err := s.d.Cmd("ps")
  36. if err != nil {
  37. c.Fatalf("Could not run ps: err=%v\n%q", err, out)
  38. }
  39. if shouldRun {
  40. format = "%scontainer %q is not running"
  41. } else {
  42. format = "%scontainer %q is running"
  43. }
  44. if shouldRun != strings.Contains(out, cont) {
  45. c.Fatalf(format, prefix, cont)
  46. }
  47. }
  48. }
  49. testRun(map[string]bool{"top1": true, "top2": true}, "")
  50. if err := s.d.Restart(); err != nil {
  51. c.Fatalf("Could not restart daemon: %v", err)
  52. }
  53. testRun(map[string]bool{"top1": true, "top2": false}, "After daemon restart: ")
  54. }
  55. func (s *DockerDaemonSuite) TestDaemonRestartWithVolumesRefs(c *check.C) {
  56. if err := s.d.StartWithBusybox(); err != nil {
  57. c.Fatal(err)
  58. }
  59. if out, err := s.d.Cmd("run", "-d", "--name", "volrestarttest1", "-v", "/foo", "busybox"); err != nil {
  60. c.Fatal(err, out)
  61. }
  62. if err := s.d.Restart(); err != nil {
  63. c.Fatal(err)
  64. }
  65. if _, err := s.d.Cmd("run", "-d", "--volumes-from", "volrestarttest1", "--name", "volrestarttest2", "busybox", "top"); err != nil {
  66. c.Fatal(err)
  67. }
  68. if out, err := s.d.Cmd("rm", "-fv", "volrestarttest2"); err != nil {
  69. c.Fatal(err, out)
  70. }
  71. out, err := s.d.Cmd("inspect", "-f", "{{json .Mounts}}", "volrestarttest1")
  72. c.Assert(err, check.IsNil)
  73. if _, err := inspectMountPointJSON(out, "/foo"); err != nil {
  74. c.Fatalf("Expected volume to exist: /foo, error: %v\n", err)
  75. }
  76. }
  77. // #11008
  78. func (s *DockerDaemonSuite) TestDaemonRestartUnlessStopped(c *check.C) {
  79. err := s.d.StartWithBusybox()
  80. c.Assert(err, check.IsNil)
  81. out, err := s.d.Cmd("run", "-d", "--name", "top1", "--restart", "always", "busybox:latest", "top")
  82. c.Assert(err, check.IsNil, check.Commentf("run top1: %v", out))
  83. out, err = s.d.Cmd("run", "-d", "--name", "top2", "--restart", "unless-stopped", "busybox:latest", "top")
  84. c.Assert(err, check.IsNil, check.Commentf("run top2: %v", out))
  85. testRun := func(m map[string]bool, prefix string) {
  86. var format string
  87. for name, shouldRun := range m {
  88. out, err := s.d.Cmd("ps")
  89. c.Assert(err, check.IsNil, check.Commentf("run ps: %v", out))
  90. if shouldRun {
  91. format = "%scontainer %q is not running"
  92. } else {
  93. format = "%scontainer %q is running"
  94. }
  95. c.Assert(strings.Contains(out, name), check.Equals, shouldRun, check.Commentf(format, prefix, name))
  96. }
  97. }
  98. // both running
  99. testRun(map[string]bool{"top1": true, "top2": true}, "")
  100. out, err = s.d.Cmd("stop", "top1")
  101. c.Assert(err, check.IsNil, check.Commentf(out))
  102. out, err = s.d.Cmd("stop", "top2")
  103. c.Assert(err, check.IsNil, check.Commentf(out))
  104. // both stopped
  105. testRun(map[string]bool{"top1": false, "top2": false}, "")
  106. err = s.d.Restart()
  107. c.Assert(err, check.IsNil)
  108. // restart=always running
  109. testRun(map[string]bool{"top1": true, "top2": false}, "After daemon restart: ")
  110. out, err = s.d.Cmd("start", "top2")
  111. c.Assert(err, check.IsNil, check.Commentf("start top2: %v", out))
  112. err = s.d.Restart()
  113. c.Assert(err, check.IsNil)
  114. // both running
  115. testRun(map[string]bool{"top1": true, "top2": true}, "After second daemon restart: ")
  116. }
  117. func (s *DockerDaemonSuite) TestDaemonStartIptablesFalse(c *check.C) {
  118. if err := s.d.Start("--iptables=false"); err != nil {
  119. c.Fatalf("we should have been able to start the daemon with passing iptables=false: %v", err)
  120. }
  121. }
  122. // Issue #8444: If docker0 bridge is modified (intentionally or unintentionally) and
  123. // no longer has an IP associated, we should gracefully handle that case and associate
  124. // an IP with it rather than fail daemon start
  125. func (s *DockerDaemonSuite) TestDaemonStartBridgeWithoutIPAssociation(c *check.C) {
  126. // rather than depending on brctl commands to verify docker0 is created and up
  127. // let's start the daemon and stop it, and then make a modification to run the
  128. // actual test
  129. if err := s.d.Start(); err != nil {
  130. c.Fatalf("Could not start daemon: %v", err)
  131. }
  132. if err := s.d.Stop(); err != nil {
  133. c.Fatalf("Could not stop daemon: %v", err)
  134. }
  135. // now we will remove the ip from docker0 and then try starting the daemon
  136. ipCmd := exec.Command("ip", "addr", "flush", "dev", "docker0")
  137. stdout, stderr, _, err := runCommandWithStdoutStderr(ipCmd)
  138. if err != nil {
  139. c.Fatalf("failed to remove docker0 IP association: %v, stdout: %q, stderr: %q", err, stdout, stderr)
  140. }
  141. if err := s.d.Start(); err != nil {
  142. warning := "**WARNING: Docker bridge network in bad state--delete docker0 bridge interface to fix"
  143. c.Fatalf("Could not start daemon when docker0 has no IP address: %v\n%s", err, warning)
  144. }
  145. }
  146. func (s *DockerDaemonSuite) TestDaemonIptablesClean(c *check.C) {
  147. if err := s.d.StartWithBusybox(); err != nil {
  148. c.Fatalf("Could not start daemon with busybox: %v", err)
  149. }
  150. if out, err := s.d.Cmd("run", "-d", "--name", "top", "-p", "80", "busybox:latest", "top"); err != nil {
  151. c.Fatalf("Could not run top: %s, %v", out, err)
  152. }
  153. // get output from iptables with container running
  154. ipTablesSearchString := "tcp dpt:80"
  155. ipTablesCmd := exec.Command("iptables", "-nvL")
  156. out, _, err := runCommandWithOutput(ipTablesCmd)
  157. if err != nil {
  158. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  159. }
  160. if !strings.Contains(out, ipTablesSearchString) {
  161. c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)
  162. }
  163. if err := s.d.Stop(); err != nil {
  164. c.Fatalf("Could not stop daemon: %v", err)
  165. }
  166. // get output from iptables after restart
  167. ipTablesCmd = exec.Command("iptables", "-nvL")
  168. out, _, err = runCommandWithOutput(ipTablesCmd)
  169. if err != nil {
  170. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  171. }
  172. if strings.Contains(out, ipTablesSearchString) {
  173. c.Fatalf("iptables output should not have contained %q, but was %q", ipTablesSearchString, out)
  174. }
  175. }
  176. func (s *DockerDaemonSuite) TestDaemonIptablesCreate(c *check.C) {
  177. if err := s.d.StartWithBusybox(); err != nil {
  178. c.Fatalf("Could not start daemon with busybox: %v", err)
  179. }
  180. if out, err := s.d.Cmd("run", "-d", "--name", "top", "--restart=always", "-p", "80", "busybox:latest", "top"); err != nil {
  181. c.Fatalf("Could not run top: %s, %v", out, err)
  182. }
  183. // get output from iptables with container running
  184. ipTablesSearchString := "tcp dpt:80"
  185. ipTablesCmd := exec.Command("iptables", "-nvL")
  186. out, _, err := runCommandWithOutput(ipTablesCmd)
  187. if err != nil {
  188. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  189. }
  190. if !strings.Contains(out, ipTablesSearchString) {
  191. c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)
  192. }
  193. if err := s.d.Restart(); err != nil {
  194. c.Fatalf("Could not restart daemon: %v", err)
  195. }
  196. // make sure the container is not running
  197. runningOut, err := s.d.Cmd("inspect", "--format='{{.State.Running}}'", "top")
  198. if err != nil {
  199. c.Fatalf("Could not inspect on container: %s, %v", out, err)
  200. }
  201. if strings.TrimSpace(runningOut) != "true" {
  202. c.Fatalf("Container should have been restarted after daemon restart. Status running should have been true but was: %q", strings.TrimSpace(runningOut))
  203. }
  204. // get output from iptables after restart
  205. ipTablesCmd = exec.Command("iptables", "-nvL")
  206. out, _, err = runCommandWithOutput(ipTablesCmd)
  207. if err != nil {
  208. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  209. }
  210. if !strings.Contains(out, ipTablesSearchString) {
  211. c.Fatalf("iptables output after restart should have contained %q, but was %q", ipTablesSearchString, out)
  212. }
  213. }
  214. // TestDaemonIPv6Enabled checks that when the daemon is started with --ipv6=true that the docker0 bridge
  215. // has the fe80::1 address and that a container is assigned a link-local address
  216. func (s *DockerSuite) TestDaemonIPv6Enabled(c *check.C) {
  217. testRequires(c, IPv6)
  218. if err := setupV6(); err != nil {
  219. c.Fatal("Could not set up host for IPv6 tests")
  220. }
  221. d := NewDaemon(c)
  222. if err := d.StartWithBusybox("--ipv6"); err != nil {
  223. c.Fatal(err)
  224. }
  225. defer d.Stop()
  226. iface, err := net.InterfaceByName("docker0")
  227. if err != nil {
  228. c.Fatalf("Error getting docker0 interface: %v", err)
  229. }
  230. addrs, err := iface.Addrs()
  231. if err != nil {
  232. c.Fatalf("Error getting addresses for docker0 interface: %v", err)
  233. }
  234. var found bool
  235. expected := "fe80::1/64"
  236. for i := range addrs {
  237. if addrs[i].String() == expected {
  238. found = true
  239. }
  240. }
  241. if !found {
  242. c.Fatalf("Bridge does not have an IPv6 Address")
  243. }
  244. if out, err := d.Cmd("run", "-itd", "--name=ipv6test", "busybox:latest"); err != nil {
  245. c.Fatalf("Could not run container: %s, %v", out, err)
  246. }
  247. out, err := d.Cmd("inspect", "--format", "'{{.NetworkSettings.Networks.bridge.LinkLocalIPv6Address}}'", "ipv6test")
  248. out = strings.Trim(out, " \r\n'")
  249. if err != nil {
  250. c.Fatalf("Error inspecting container: %s, %v", out, err)
  251. }
  252. if ip := net.ParseIP(out); ip == nil {
  253. c.Fatalf("Container should have a link-local IPv6 address")
  254. }
  255. out, err = d.Cmd("inspect", "--format", "'{{.NetworkSettings.Networks.bridge.GlobalIPv6Address}}'", "ipv6test")
  256. out = strings.Trim(out, " \r\n'")
  257. if err != nil {
  258. c.Fatalf("Error inspecting container: %s, %v", out, err)
  259. }
  260. if ip := net.ParseIP(out); ip != nil {
  261. c.Fatalf("Container should not have a global IPv6 address: %v", out)
  262. }
  263. if err := teardownV6(); err != nil {
  264. c.Fatal("Could not perform teardown for IPv6 tests")
  265. }
  266. }
  267. // TestDaemonIPv6FixedCIDR checks that when the daemon is started with --ipv6=true and a fixed CIDR
  268. // that running containers are given a link-local and global IPv6 address
  269. func (s *DockerSuite) TestDaemonIPv6FixedCIDR(c *check.C) {
  270. if err := setupV6(); err != nil {
  271. c.Fatal("Could not set up host for IPv6 tests")
  272. }
  273. d := NewDaemon(c)
  274. if err := d.StartWithBusybox("--ipv6", "--fixed-cidr-v6='2001:db8:2::/64'", "--default-gateway-v6='2001:db8:2::100'"); err != nil {
  275. c.Fatalf("Could not start daemon with busybox: %v", err)
  276. }
  277. defer d.Stop()
  278. if out, err := d.Cmd("run", "-itd", "--name=ipv6test", "busybox:latest"); err != nil {
  279. c.Fatalf("Could not run container: %s, %v", out, err)
  280. }
  281. out, err := d.Cmd("inspect", "--format", "'{{.NetworkSettings.Networks.bridge.GlobalIPv6Address}}'", "ipv6test")
  282. out = strings.Trim(out, " \r\n'")
  283. if err != nil {
  284. c.Fatalf("Error inspecting container: %s, %v", out, err)
  285. }
  286. if ip := net.ParseIP(out); ip == nil {
  287. c.Fatalf("Container should have a global IPv6 address")
  288. }
  289. // TODO: Check IPv6 def gateway in inspect o/p (once docker/docker 19001 is merged
  290. if err := teardownV6(); err != nil {
  291. c.Fatal("Could not perform teardown for IPv6 tests")
  292. }
  293. }
  294. // TestDaemonIPv6FixedCIDRAndMac checks that when the daemon is started with ipv6 fixed CIDR
  295. // the running containers are given a an IPv6 address derived from the MAC address and the ipv6 fixed CIDR
  296. func (s *DockerSuite) TestDaemonIPv6FixedCIDRAndMac(c *check.C) {
  297. err := setupV6()
  298. c.Assert(err, checker.IsNil)
  299. d := NewDaemon(c)
  300. err = d.StartWithBusybox("--ipv6", "--fixed-cidr-v6='2001:db8:1::/64'")
  301. c.Assert(err, checker.IsNil)
  302. defer d.Stop()
  303. out, err := d.Cmd("run", "-itd", "--name=ipv6test", "--mac-address", "AA:BB:CC:DD:EE:FF", "busybox")
  304. c.Assert(err, checker.IsNil)
  305. out, err = d.Cmd("inspect", "--format", "'{{.NetworkSettings.Networks.bridge.GlobalIPv6Address}}'", "ipv6test")
  306. c.Assert(err, checker.IsNil)
  307. c.Assert(strings.Trim(out, " \r\n'"), checker.Equals, "2001:db8:1::aabb:ccdd:eeff")
  308. err = teardownV6()
  309. c.Assert(err, checker.IsNil)
  310. }
  311. func (s *DockerDaemonSuite) TestDaemonLogLevelWrong(c *check.C) {
  312. c.Assert(s.d.Start("--log-level=bogus"), check.NotNil, check.Commentf("Daemon shouldn't start with wrong log level"))
  313. }
  314. func (s *DockerSuite) TestDaemonStartWithDaemonCommand(c *check.C) {
  315. type kind int
  316. const (
  317. common kind = iota
  318. daemon
  319. )
  320. var flags = []map[kind][]string{
  321. {common: {"-l", "info"}, daemon: {"--selinux-enabled"}},
  322. {common: {"-D"}, daemon: {"--selinux-enabled", "-r"}},
  323. {common: {"-D"}, daemon: {"--restart"}},
  324. {common: {"--debug"}, daemon: {"--log-driver=json-file", "--log-opt=max-size=1k"}},
  325. }
  326. var invalidGlobalFlags = [][]string{
  327. //Invalid because you cannot pass daemon flags as global flags.
  328. {"--selinux-enabled", "-l", "info"},
  329. {"-D", "-r"},
  330. {"--config", "/tmp"},
  331. }
  332. // `docker daemon -l info --selinux-enabled`
  333. // should NOT error out
  334. for _, f := range flags {
  335. d := NewDaemon(c)
  336. args := append(f[common], f[daemon]...)
  337. if err := d.Start(args...); err != nil {
  338. c.Fatalf("Daemon should have started successfully with %v: %v", args, err)
  339. }
  340. d.Stop()
  341. }
  342. // `docker -l info daemon --selinux-enabled`
  343. // should error out
  344. for _, f := range flags {
  345. d := NewDaemon(c)
  346. d.GlobalFlags = f[common]
  347. if err := d.Start(f[daemon]...); err == nil {
  348. d.Stop()
  349. c.Fatalf("Daemon should have failed to start with docker %v daemon %v", d.GlobalFlags, f[daemon])
  350. }
  351. }
  352. for _, f := range invalidGlobalFlags {
  353. cmd := exec.Command(dockerBinary, append(f, "daemon")...)
  354. errch := make(chan error)
  355. var err error
  356. go func() {
  357. errch <- cmd.Run()
  358. }()
  359. select {
  360. case <-time.After(time.Second):
  361. cmd.Process.Kill()
  362. case err = <-errch:
  363. }
  364. if err == nil {
  365. c.Fatalf("Daemon should have failed to start with docker %v daemon", f)
  366. }
  367. }
  368. }
  369. func (s *DockerDaemonSuite) TestDaemonLogLevelDebug(c *check.C) {
  370. if err := s.d.Start("--log-level=debug"); err != nil {
  371. c.Fatal(err)
  372. }
  373. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  374. if !strings.Contains(string(content), `level=debug`) {
  375. c.Fatalf(`Missing level="debug" in log file:\n%s`, string(content))
  376. }
  377. }
  378. func (s *DockerDaemonSuite) TestDaemonLogLevelFatal(c *check.C) {
  379. // we creating new daemons to create new logFile
  380. if err := s.d.Start("--log-level=fatal"); err != nil {
  381. c.Fatal(err)
  382. }
  383. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  384. if strings.Contains(string(content), `level=debug`) {
  385. c.Fatalf(`Should not have level="debug" in log file:\n%s`, string(content))
  386. }
  387. }
  388. func (s *DockerDaemonSuite) TestDaemonFlagD(c *check.C) {
  389. if err := s.d.Start("-D"); err != nil {
  390. c.Fatal(err)
  391. }
  392. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  393. if !strings.Contains(string(content), `level=debug`) {
  394. c.Fatalf(`Should have level="debug" in log file using -D:\n%s`, string(content))
  395. }
  396. }
  397. func (s *DockerDaemonSuite) TestDaemonFlagDebug(c *check.C) {
  398. if err := s.d.Start("--debug"); err != nil {
  399. c.Fatal(err)
  400. }
  401. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  402. if !strings.Contains(string(content), `level=debug`) {
  403. c.Fatalf(`Should have level="debug" in log file using --debug:\n%s`, string(content))
  404. }
  405. }
  406. func (s *DockerDaemonSuite) TestDaemonFlagDebugLogLevelFatal(c *check.C) {
  407. if err := s.d.Start("--debug", "--log-level=fatal"); err != nil {
  408. c.Fatal(err)
  409. }
  410. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  411. if !strings.Contains(string(content), `level=debug`) {
  412. c.Fatalf(`Should have level="debug" in log file when using both --debug and --log-level=fatal:\n%s`, string(content))
  413. }
  414. }
  415. func (s *DockerDaemonSuite) TestDaemonAllocatesListeningPort(c *check.C) {
  416. listeningPorts := [][]string{
  417. {"0.0.0.0", "0.0.0.0", "5678"},
  418. {"127.0.0.1", "127.0.0.1", "1234"},
  419. {"localhost", "127.0.0.1", "1235"},
  420. }
  421. cmdArgs := make([]string, 0, len(listeningPorts)*2)
  422. for _, hostDirective := range listeningPorts {
  423. cmdArgs = append(cmdArgs, "--host", fmt.Sprintf("tcp://%s:%s", hostDirective[0], hostDirective[2]))
  424. }
  425. if err := s.d.StartWithBusybox(cmdArgs...); err != nil {
  426. c.Fatalf("Could not start daemon with busybox: %v", err)
  427. }
  428. for _, hostDirective := range listeningPorts {
  429. output, err := s.d.Cmd("run", "-p", fmt.Sprintf("%s:%s:80", hostDirective[1], hostDirective[2]), "busybox", "true")
  430. if err == nil {
  431. c.Fatalf("Container should not start, expected port already allocated error: %q", output)
  432. } else if !strings.Contains(output, "port is already allocated") {
  433. c.Fatalf("Expected port is already allocated error: %q", output)
  434. }
  435. }
  436. }
  437. func (s *DockerDaemonSuite) TestDaemonKeyGeneration(c *check.C) {
  438. // TODO: skip or update for Windows daemon
  439. os.Remove("/etc/docker/key.json")
  440. if err := s.d.Start(); err != nil {
  441. c.Fatalf("Could not start daemon: %v", err)
  442. }
  443. s.d.Stop()
  444. k, err := libtrust.LoadKeyFile("/etc/docker/key.json")
  445. if err != nil {
  446. c.Fatalf("Error opening key file")
  447. }
  448. kid := k.KeyID()
  449. // Test Key ID is a valid fingerprint (e.g. QQXN:JY5W:TBXI:MK3X:GX6P:PD5D:F56N:NHCS:LVRZ:JA46:R24J:XEFF)
  450. if len(kid) != 59 {
  451. c.Fatalf("Bad key ID: %s", kid)
  452. }
  453. }
  454. func (s *DockerDaemonSuite) TestDaemonKeyMigration(c *check.C) {
  455. // TODO: skip or update for Windows daemon
  456. os.Remove("/etc/docker/key.json")
  457. k1, err := libtrust.GenerateECP256PrivateKey()
  458. if err != nil {
  459. c.Fatalf("Error generating private key: %s", err)
  460. }
  461. if err := os.MkdirAll(filepath.Join(os.Getenv("HOME"), ".docker"), 0755); err != nil {
  462. c.Fatalf("Error creating .docker directory: %s", err)
  463. }
  464. if err := libtrust.SaveKey(filepath.Join(os.Getenv("HOME"), ".docker", "key.json"), k1); err != nil {
  465. c.Fatalf("Error saving private key: %s", err)
  466. }
  467. if err := s.d.Start(); err != nil {
  468. c.Fatalf("Could not start daemon: %v", err)
  469. }
  470. s.d.Stop()
  471. k2, err := libtrust.LoadKeyFile("/etc/docker/key.json")
  472. if err != nil {
  473. c.Fatalf("Error opening key file")
  474. }
  475. if k1.KeyID() != k2.KeyID() {
  476. c.Fatalf("Key not migrated")
  477. }
  478. }
  479. // GH#11320 - verify that the daemon exits on failure properly
  480. // Note that this explicitly tests the conflict of {-b,--bridge} and {--bip} options as the means
  481. // to get a daemon init failure; no other tests for -b/--bip conflict are therefore required
  482. func (s *DockerDaemonSuite) TestDaemonExitOnFailure(c *check.C) {
  483. //attempt to start daemon with incorrect flags (we know -b and --bip conflict)
  484. if err := s.d.Start("--bridge", "nosuchbridge", "--bip", "1.1.1.1"); err != nil {
  485. //verify we got the right error
  486. if !strings.Contains(err.Error(), "Daemon exited and never started") {
  487. c.Fatalf("Expected daemon not to start, got %v", err)
  488. }
  489. // look in the log and make sure we got the message that daemon is shutting down
  490. runCmd := exec.Command("grep", "Error starting daemon", s.d.LogfileName())
  491. if out, _, err := runCommandWithOutput(runCmd); err != nil {
  492. c.Fatalf("Expected 'Error starting daemon' message; but doesn't exist in log: %q, err: %v", out, err)
  493. }
  494. } else {
  495. //if we didn't get an error and the daemon is running, this is a failure
  496. c.Fatal("Conflicting options should cause the daemon to error out with a failure")
  497. }
  498. }
  499. func (s *DockerDaemonSuite) TestDaemonBridgeExternal(c *check.C) {
  500. d := s.d
  501. err := d.Start("--bridge", "nosuchbridge")
  502. c.Assert(err, check.NotNil, check.Commentf("--bridge option with an invalid bridge should cause the daemon to fail"))
  503. defer d.Restart()
  504. bridgeName := "external-bridge"
  505. bridgeIP := "192.169.1.1/24"
  506. _, bridgeIPNet, _ := net.ParseCIDR(bridgeIP)
  507. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  508. c.Assert(err, check.IsNil, check.Commentf(out))
  509. defer deleteInterface(c, bridgeName)
  510. err = d.StartWithBusybox("--bridge", bridgeName)
  511. c.Assert(err, check.IsNil)
  512. ipTablesSearchString := bridgeIPNet.String()
  513. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  514. out, _, err = runCommandWithOutput(ipTablesCmd)
  515. c.Assert(err, check.IsNil)
  516. c.Assert(strings.Contains(out, ipTablesSearchString), check.Equals, true,
  517. check.Commentf("iptables output should have contained %q, but was %q",
  518. ipTablesSearchString, out))
  519. _, err = d.Cmd("run", "-d", "--name", "ExtContainer", "busybox", "top")
  520. c.Assert(err, check.IsNil)
  521. containerIP := d.findContainerIP("ExtContainer")
  522. ip := net.ParseIP(containerIP)
  523. c.Assert(bridgeIPNet.Contains(ip), check.Equals, true,
  524. check.Commentf("Container IP-Address must be in the same subnet range : %s",
  525. containerIP))
  526. }
  527. func createInterface(c *check.C, ifType string, ifName string, ipNet string) (string, error) {
  528. args := []string{"link", "add", "name", ifName, "type", ifType}
  529. ipLinkCmd := exec.Command("ip", args...)
  530. out, _, err := runCommandWithOutput(ipLinkCmd)
  531. if err != nil {
  532. return out, err
  533. }
  534. ifCfgCmd := exec.Command("ifconfig", ifName, ipNet, "up")
  535. out, _, err = runCommandWithOutput(ifCfgCmd)
  536. return out, err
  537. }
  538. func deleteInterface(c *check.C, ifName string) {
  539. ifCmd := exec.Command("ip", "link", "delete", ifName)
  540. out, _, err := runCommandWithOutput(ifCmd)
  541. c.Assert(err, check.IsNil, check.Commentf(out))
  542. flushCmd := exec.Command("iptables", "-t", "nat", "--flush")
  543. out, _, err = runCommandWithOutput(flushCmd)
  544. c.Assert(err, check.IsNil, check.Commentf(out))
  545. flushCmd = exec.Command("iptables", "--flush")
  546. out, _, err = runCommandWithOutput(flushCmd)
  547. c.Assert(err, check.IsNil, check.Commentf(out))
  548. }
  549. func (s *DockerDaemonSuite) TestDaemonBridgeIP(c *check.C) {
  550. // TestDaemonBridgeIP Steps
  551. // 1. Delete the existing docker0 Bridge
  552. // 2. Set --bip daemon configuration and start the new Docker Daemon
  553. // 3. Check if the bip config has taken effect using ifconfig and iptables commands
  554. // 4. Launch a Container and make sure the IP-Address is in the expected subnet
  555. // 5. Delete the docker0 Bridge
  556. // 6. Restart the Docker Daemon (via deferred action)
  557. // This Restart takes care of bringing docker0 interface back to auto-assigned IP
  558. defaultNetworkBridge := "docker0"
  559. deleteInterface(c, defaultNetworkBridge)
  560. d := s.d
  561. bridgeIP := "192.169.1.1/24"
  562. ip, bridgeIPNet, _ := net.ParseCIDR(bridgeIP)
  563. err := d.StartWithBusybox("--bip", bridgeIP)
  564. c.Assert(err, check.IsNil)
  565. defer d.Restart()
  566. ifconfigSearchString := ip.String()
  567. ifconfigCmd := exec.Command("ifconfig", defaultNetworkBridge)
  568. out, _, _, err := runCommandWithStdoutStderr(ifconfigCmd)
  569. c.Assert(err, check.IsNil)
  570. c.Assert(strings.Contains(out, ifconfigSearchString), check.Equals, true,
  571. check.Commentf("ifconfig output should have contained %q, but was %q",
  572. ifconfigSearchString, out))
  573. ipTablesSearchString := bridgeIPNet.String()
  574. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  575. out, _, err = runCommandWithOutput(ipTablesCmd)
  576. c.Assert(err, check.IsNil)
  577. c.Assert(strings.Contains(out, ipTablesSearchString), check.Equals, true,
  578. check.Commentf("iptables output should have contained %q, but was %q",
  579. ipTablesSearchString, out))
  580. out, err = d.Cmd("run", "-d", "--name", "test", "busybox", "top")
  581. c.Assert(err, check.IsNil)
  582. containerIP := d.findContainerIP("test")
  583. ip = net.ParseIP(containerIP)
  584. c.Assert(bridgeIPNet.Contains(ip), check.Equals, true,
  585. check.Commentf("Container IP-Address must be in the same subnet range : %s",
  586. containerIP))
  587. deleteInterface(c, defaultNetworkBridge)
  588. }
  589. func (s *DockerDaemonSuite) TestDaemonRestartWithBridgeIPChange(c *check.C) {
  590. if err := s.d.Start(); err != nil {
  591. c.Fatalf("Could not start daemon: %v", err)
  592. }
  593. defer s.d.Restart()
  594. if err := s.d.Stop(); err != nil {
  595. c.Fatalf("Could not stop daemon: %v", err)
  596. }
  597. // now we will change the docker0's IP and then try starting the daemon
  598. bridgeIP := "192.169.100.1/24"
  599. _, bridgeIPNet, _ := net.ParseCIDR(bridgeIP)
  600. ipCmd := exec.Command("ifconfig", "docker0", bridgeIP)
  601. stdout, stderr, _, err := runCommandWithStdoutStderr(ipCmd)
  602. if err != nil {
  603. c.Fatalf("failed to change docker0's IP association: %v, stdout: %q, stderr: %q", err, stdout, stderr)
  604. }
  605. if err := s.d.Start("--bip", bridgeIP); err != nil {
  606. c.Fatalf("Could not start daemon: %v", err)
  607. }
  608. //check if the iptables contains new bridgeIP MASQUERADE rule
  609. ipTablesSearchString := bridgeIPNet.String()
  610. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  611. out, _, err := runCommandWithOutput(ipTablesCmd)
  612. if err != nil {
  613. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  614. }
  615. if !strings.Contains(out, ipTablesSearchString) {
  616. c.Fatalf("iptables output should have contained new MASQUERADE rule with IP %q, but was %q", ipTablesSearchString, out)
  617. }
  618. }
  619. func (s *DockerDaemonSuite) TestDaemonBridgeFixedCidr(c *check.C) {
  620. d := s.d
  621. bridgeName := "external-bridge"
  622. bridgeIP := "192.169.1.1/24"
  623. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  624. c.Assert(err, check.IsNil, check.Commentf(out))
  625. defer deleteInterface(c, bridgeName)
  626. args := []string{"--bridge", bridgeName, "--fixed-cidr", "192.169.1.0/30"}
  627. err = d.StartWithBusybox(args...)
  628. c.Assert(err, check.IsNil)
  629. defer d.Restart()
  630. for i := 0; i < 4; i++ {
  631. cName := "Container" + strconv.Itoa(i)
  632. out, err := d.Cmd("run", "-d", "--name", cName, "busybox", "top")
  633. if err != nil {
  634. c.Assert(strings.Contains(out, "no available IPv4 addresses"), check.Equals, true,
  635. check.Commentf("Could not run a Container : %s %s", err.Error(), out))
  636. }
  637. }
  638. }
  639. func (s *DockerDaemonSuite) TestDaemonBridgeFixedCidr2(c *check.C) {
  640. d := s.d
  641. bridgeName := "external-bridge"
  642. bridgeIP := "10.2.2.1/16"
  643. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  644. c.Assert(err, check.IsNil, check.Commentf(out))
  645. defer deleteInterface(c, bridgeName)
  646. err = d.StartWithBusybox("--bip", bridgeIP, "--fixed-cidr", "10.2.2.0/24")
  647. c.Assert(err, check.IsNil)
  648. defer s.d.Restart()
  649. out, err = d.Cmd("run", "-d", "--name", "bb", "busybox", "top")
  650. c.Assert(err, checker.IsNil, check.Commentf(out))
  651. defer d.Cmd("stop", "bb")
  652. out, err = d.Cmd("exec", "bb", "/bin/sh", "-c", "ifconfig eth0 | awk '/inet addr/{print substr($2,6)}'")
  653. c.Assert(out, checker.Equals, "10.2.2.0\n")
  654. out, err = d.Cmd("run", "--rm", "busybox", "/bin/sh", "-c", "ifconfig eth0 | awk '/inet addr/{print substr($2,6)}'")
  655. c.Assert(err, checker.IsNil, check.Commentf(out))
  656. c.Assert(out, checker.Equals, "10.2.2.2\n")
  657. }
  658. func (s *DockerDaemonSuite) TestDaemonBridgeFixedCIDREqualBridgeNetwork(c *check.C) {
  659. d := s.d
  660. bridgeName := "external-bridge"
  661. bridgeIP := "172.27.42.1/16"
  662. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  663. c.Assert(err, check.IsNil, check.Commentf(out))
  664. defer deleteInterface(c, bridgeName)
  665. err = d.StartWithBusybox("--bridge", bridgeName, "--fixed-cidr", bridgeIP)
  666. c.Assert(err, check.IsNil)
  667. defer s.d.Restart()
  668. out, err = d.Cmd("run", "-d", "busybox", "top")
  669. c.Assert(err, check.IsNil, check.Commentf(out))
  670. cid1 := strings.TrimSpace(out)
  671. defer d.Cmd("stop", cid1)
  672. }
  673. func (s *DockerDaemonSuite) TestDaemonDefaultGatewayIPv4Implicit(c *check.C) {
  674. defaultNetworkBridge := "docker0"
  675. deleteInterface(c, defaultNetworkBridge)
  676. d := s.d
  677. bridgeIP := "192.169.1.1"
  678. bridgeIPNet := fmt.Sprintf("%s/24", bridgeIP)
  679. err := d.StartWithBusybox("--bip", bridgeIPNet)
  680. c.Assert(err, check.IsNil)
  681. defer d.Restart()
  682. expectedMessage := fmt.Sprintf("default via %s dev", bridgeIP)
  683. out, err := d.Cmd("run", "busybox", "ip", "-4", "route", "list", "0/0")
  684. c.Assert(strings.Contains(out, expectedMessage), check.Equals, true,
  685. check.Commentf("Implicit default gateway should be bridge IP %s, but default route was '%s'",
  686. bridgeIP, strings.TrimSpace(out)))
  687. deleteInterface(c, defaultNetworkBridge)
  688. }
  689. func (s *DockerDaemonSuite) TestDaemonDefaultGatewayIPv4Explicit(c *check.C) {
  690. defaultNetworkBridge := "docker0"
  691. deleteInterface(c, defaultNetworkBridge)
  692. d := s.d
  693. bridgeIP := "192.169.1.1"
  694. bridgeIPNet := fmt.Sprintf("%s/24", bridgeIP)
  695. gatewayIP := "192.169.1.254"
  696. err := d.StartWithBusybox("--bip", bridgeIPNet, "--default-gateway", gatewayIP)
  697. c.Assert(err, check.IsNil)
  698. defer d.Restart()
  699. expectedMessage := fmt.Sprintf("default via %s dev", gatewayIP)
  700. out, err := d.Cmd("run", "busybox", "ip", "-4", "route", "list", "0/0")
  701. c.Assert(strings.Contains(out, expectedMessage), check.Equals, true,
  702. check.Commentf("Explicit default gateway should be %s, but default route was '%s'",
  703. gatewayIP, strings.TrimSpace(out)))
  704. deleteInterface(c, defaultNetworkBridge)
  705. }
  706. func (s *DockerDaemonSuite) TestDaemonDefaultGatewayIPv4ExplicitOutsideContainerSubnet(c *check.C) {
  707. defaultNetworkBridge := "docker0"
  708. deleteInterface(c, defaultNetworkBridge)
  709. // Program a custom default gateway outside of the container subnet, daemon should accept it and start
  710. err := s.d.StartWithBusybox("--bip", "172.16.0.10/16", "--fixed-cidr", "172.16.1.0/24", "--default-gateway", "172.16.0.254")
  711. c.Assert(err, check.IsNil)
  712. deleteInterface(c, defaultNetworkBridge)
  713. s.d.Restart()
  714. }
  715. func (s *DockerDaemonSuite) TestDaemonDefaultNetworkInvalidClusterConfig(c *check.C) {
  716. testRequires(c, DaemonIsLinux, SameHostDaemon)
  717. // Start daemon without docker0 bridge
  718. defaultNetworkBridge := "docker0"
  719. deleteInterface(c, defaultNetworkBridge)
  720. d := NewDaemon(c)
  721. discoveryBackend := "consul://consuladdr:consulport/some/path"
  722. err := d.Start(fmt.Sprintf("--cluster-store=%s", discoveryBackend))
  723. c.Assert(err, checker.IsNil)
  724. // Start daemon with docker0 bridge
  725. ifconfigCmd := exec.Command("ifconfig", defaultNetworkBridge)
  726. _, err = runCommand(ifconfigCmd)
  727. c.Assert(err, check.IsNil)
  728. err = d.Restart(fmt.Sprintf("--cluster-store=%s", discoveryBackend))
  729. c.Assert(err, checker.IsNil)
  730. d.Stop()
  731. }
  732. func (s *DockerDaemonSuite) TestDaemonIP(c *check.C) {
  733. d := s.d
  734. ipStr := "192.170.1.1/24"
  735. ip, _, _ := net.ParseCIDR(ipStr)
  736. args := []string{"--ip", ip.String()}
  737. err := d.StartWithBusybox(args...)
  738. c.Assert(err, check.IsNil)
  739. defer d.Restart()
  740. out, err := d.Cmd("run", "-d", "-p", "8000:8000", "busybox", "top")
  741. c.Assert(err, check.NotNil,
  742. check.Commentf("Running a container must fail with an invalid --ip option"))
  743. c.Assert(strings.Contains(out, "Error starting userland proxy"), check.Equals, true)
  744. ifName := "dummy"
  745. out, err = createInterface(c, "dummy", ifName, ipStr)
  746. c.Assert(err, check.IsNil, check.Commentf(out))
  747. defer deleteInterface(c, ifName)
  748. _, err = d.Cmd("run", "-d", "-p", "8000:8000", "busybox", "top")
  749. c.Assert(err, check.IsNil)
  750. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  751. out, _, err = runCommandWithOutput(ipTablesCmd)
  752. c.Assert(err, check.IsNil)
  753. regex := fmt.Sprintf("DNAT.*%s.*dpt:8000", ip.String())
  754. matched, _ := regexp.MatchString(regex, out)
  755. c.Assert(matched, check.Equals, true,
  756. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  757. }
  758. func (s *DockerDaemonSuite) TestDaemonICCPing(c *check.C) {
  759. d := s.d
  760. bridgeName := "external-bridge"
  761. bridgeIP := "192.169.1.1/24"
  762. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  763. c.Assert(err, check.IsNil, check.Commentf(out))
  764. defer deleteInterface(c, bridgeName)
  765. args := []string{"--bridge", bridgeName, "--icc=false"}
  766. err = d.StartWithBusybox(args...)
  767. c.Assert(err, check.IsNil)
  768. defer d.Restart()
  769. ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")
  770. out, _, err = runCommandWithOutput(ipTablesCmd)
  771. c.Assert(err, check.IsNil)
  772. regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)
  773. matched, _ := regexp.MatchString(regex, out)
  774. c.Assert(matched, check.Equals, true,
  775. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  776. // Pinging another container must fail with --icc=false
  777. pingContainers(c, d, true)
  778. ipStr := "192.171.1.1/24"
  779. ip, _, _ := net.ParseCIDR(ipStr)
  780. ifName := "icc-dummy"
  781. createInterface(c, "dummy", ifName, ipStr)
  782. // But, Pinging external or a Host interface must succeed
  783. pingCmd := fmt.Sprintf("ping -c 1 %s -W 1", ip.String())
  784. runArgs := []string{"--rm", "busybox", "sh", "-c", pingCmd}
  785. _, err = d.Cmd("run", runArgs...)
  786. c.Assert(err, check.IsNil)
  787. }
  788. func (s *DockerDaemonSuite) TestDaemonICCLinkExpose(c *check.C) {
  789. d := s.d
  790. bridgeName := "external-bridge"
  791. bridgeIP := "192.169.1.1/24"
  792. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  793. c.Assert(err, check.IsNil, check.Commentf(out))
  794. defer deleteInterface(c, bridgeName)
  795. args := []string{"--bridge", bridgeName, "--icc=false"}
  796. err = d.StartWithBusybox(args...)
  797. c.Assert(err, check.IsNil)
  798. defer d.Restart()
  799. ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")
  800. out, _, err = runCommandWithOutput(ipTablesCmd)
  801. c.Assert(err, check.IsNil)
  802. regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)
  803. matched, _ := regexp.MatchString(regex, out)
  804. c.Assert(matched, check.Equals, true,
  805. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  806. out, err = d.Cmd("run", "-d", "--expose", "4567", "--name", "icc1", "busybox", "nc", "-l", "-p", "4567")
  807. c.Assert(err, check.IsNil, check.Commentf(out))
  808. out, err = d.Cmd("run", "--link", "icc1:icc1", "busybox", "nc", "icc1", "4567")
  809. c.Assert(err, check.IsNil, check.Commentf(out))
  810. }
  811. func (s *DockerDaemonSuite) TestDaemonLinksIpTablesRulesWhenLinkAndUnlink(c *check.C) {
  812. bridgeName := "external-bridge"
  813. bridgeIP := "192.169.1.1/24"
  814. out, err := createInterface(c, "bridge", bridgeName, bridgeIP)
  815. c.Assert(err, check.IsNil, check.Commentf(out))
  816. defer deleteInterface(c, bridgeName)
  817. err = s.d.StartWithBusybox("--bridge", bridgeName, "--icc=false")
  818. c.Assert(err, check.IsNil)
  819. defer s.d.Restart()
  820. _, err = s.d.Cmd("run", "-d", "--name", "child", "--publish", "8080:80", "busybox", "top")
  821. c.Assert(err, check.IsNil)
  822. _, err = s.d.Cmd("run", "-d", "--name", "parent", "--link", "child:http", "busybox", "top")
  823. c.Assert(err, check.IsNil)
  824. childIP := s.d.findContainerIP("child")
  825. parentIP := s.d.findContainerIP("parent")
  826. sourceRule := []string{"-i", bridgeName, "-o", bridgeName, "-p", "tcp", "-s", childIP, "--sport", "80", "-d", parentIP, "-j", "ACCEPT"}
  827. destinationRule := []string{"-i", bridgeName, "-o", bridgeName, "-p", "tcp", "-s", parentIP, "--dport", "80", "-d", childIP, "-j", "ACCEPT"}
  828. if !iptables.Exists("filter", "DOCKER", sourceRule...) || !iptables.Exists("filter", "DOCKER", destinationRule...) {
  829. c.Fatal("Iptables rules not found")
  830. }
  831. s.d.Cmd("rm", "--link", "parent/http")
  832. if iptables.Exists("filter", "DOCKER", sourceRule...) || iptables.Exists("filter", "DOCKER", destinationRule...) {
  833. c.Fatal("Iptables rules should be removed when unlink")
  834. }
  835. s.d.Cmd("kill", "child")
  836. s.d.Cmd("kill", "parent")
  837. }
  838. func (s *DockerDaemonSuite) TestDaemonUlimitDefaults(c *check.C) {
  839. testRequires(c, DaemonIsLinux)
  840. if err := s.d.StartWithBusybox("--default-ulimit", "nofile=42:42", "--default-ulimit", "nproc=1024:1024"); err != nil {
  841. c.Fatal(err)
  842. }
  843. out, err := s.d.Cmd("run", "--ulimit", "nproc=2048", "--name=test", "busybox", "/bin/sh", "-c", "echo $(ulimit -n); echo $(ulimit -p)")
  844. if err != nil {
  845. c.Fatal(out, err)
  846. }
  847. outArr := strings.Split(out, "\n")
  848. if len(outArr) < 2 {
  849. c.Fatalf("got unexpected output: %s", out)
  850. }
  851. nofile := strings.TrimSpace(outArr[0])
  852. nproc := strings.TrimSpace(outArr[1])
  853. if nofile != "42" {
  854. c.Fatalf("expected `ulimit -n` to be `42`, got: %s", nofile)
  855. }
  856. if nproc != "2048" {
  857. c.Fatalf("exepcted `ulimit -p` to be 2048, got: %s", nproc)
  858. }
  859. // Now restart daemon with a new default
  860. if err := s.d.Restart("--default-ulimit", "nofile=43"); err != nil {
  861. c.Fatal(err)
  862. }
  863. out, err = s.d.Cmd("start", "-a", "test")
  864. if err != nil {
  865. c.Fatal(err)
  866. }
  867. outArr = strings.Split(out, "\n")
  868. if len(outArr) < 2 {
  869. c.Fatalf("got unexpected output: %s", out)
  870. }
  871. nofile = strings.TrimSpace(outArr[0])
  872. nproc = strings.TrimSpace(outArr[1])
  873. if nofile != "43" {
  874. c.Fatalf("expected `ulimit -n` to be `43`, got: %s", nofile)
  875. }
  876. if nproc != "2048" {
  877. c.Fatalf("exepcted `ulimit -p` to be 2048, got: %s", nproc)
  878. }
  879. }
  880. // #11315
  881. func (s *DockerDaemonSuite) TestDaemonRestartRenameContainer(c *check.C) {
  882. if err := s.d.StartWithBusybox(); err != nil {
  883. c.Fatal(err)
  884. }
  885. if out, err := s.d.Cmd("run", "--name=test", "busybox"); err != nil {
  886. c.Fatal(err, out)
  887. }
  888. if out, err := s.d.Cmd("rename", "test", "test2"); err != nil {
  889. c.Fatal(err, out)
  890. }
  891. if err := s.d.Restart(); err != nil {
  892. c.Fatal(err)
  893. }
  894. if out, err := s.d.Cmd("start", "test2"); err != nil {
  895. c.Fatal(err, out)
  896. }
  897. }
  898. func (s *DockerDaemonSuite) TestDaemonLoggingDriverDefault(c *check.C) {
  899. if err := s.d.StartWithBusybox(); err != nil {
  900. c.Fatal(err)
  901. }
  902. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  903. if err != nil {
  904. c.Fatal(out, err)
  905. }
  906. id := strings.TrimSpace(out)
  907. if out, err := s.d.Cmd("wait", id); err != nil {
  908. c.Fatal(out, err)
  909. }
  910. logPath := filepath.Join(s.d.root, "containers", id, id+"-json.log")
  911. if _, err := os.Stat(logPath); err != nil {
  912. c.Fatal(err)
  913. }
  914. f, err := os.Open(logPath)
  915. if err != nil {
  916. c.Fatal(err)
  917. }
  918. var res struct {
  919. Log string `json:"log"`
  920. Stream string `json:"stream"`
  921. Time time.Time `json:"time"`
  922. }
  923. if err := json.NewDecoder(f).Decode(&res); err != nil {
  924. c.Fatal(err)
  925. }
  926. if res.Log != "testline\n" {
  927. c.Fatalf("Unexpected log line: %q, expected: %q", res.Log, "testline\n")
  928. }
  929. if res.Stream != "stdout" {
  930. c.Fatalf("Unexpected stream: %q, expected: %q", res.Stream, "stdout")
  931. }
  932. if !time.Now().After(res.Time) {
  933. c.Fatalf("Log time %v in future", res.Time)
  934. }
  935. }
  936. func (s *DockerDaemonSuite) TestDaemonLoggingDriverDefaultOverride(c *check.C) {
  937. if err := s.d.StartWithBusybox(); err != nil {
  938. c.Fatal(err)
  939. }
  940. out, err := s.d.Cmd("run", "-d", "--log-driver=none", "busybox", "echo", "testline")
  941. if err != nil {
  942. c.Fatal(out, err)
  943. }
  944. id := strings.TrimSpace(out)
  945. if out, err := s.d.Cmd("wait", id); err != nil {
  946. c.Fatal(out, err)
  947. }
  948. logPath := filepath.Join(s.d.root, "containers", id, id+"-json.log")
  949. if _, err := os.Stat(logPath); err == nil || !os.IsNotExist(err) {
  950. c.Fatalf("%s shouldn't exits, error on Stat: %s", logPath, err)
  951. }
  952. }
  953. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNone(c *check.C) {
  954. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  955. c.Fatal(err)
  956. }
  957. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  958. if err != nil {
  959. c.Fatal(out, err)
  960. }
  961. id := strings.TrimSpace(out)
  962. if out, err := s.d.Cmd("wait", id); err != nil {
  963. c.Fatal(out, err)
  964. }
  965. logPath := filepath.Join(s.d.folder, "graph", "containers", id, id+"-json.log")
  966. if _, err := os.Stat(logPath); err == nil || !os.IsNotExist(err) {
  967. c.Fatalf("%s shouldn't exits, error on Stat: %s", logPath, err)
  968. }
  969. }
  970. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNoneOverride(c *check.C) {
  971. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  972. c.Fatal(err)
  973. }
  974. out, err := s.d.Cmd("run", "-d", "--log-driver=json-file", "busybox", "echo", "testline")
  975. if err != nil {
  976. c.Fatal(out, err)
  977. }
  978. id := strings.TrimSpace(out)
  979. if out, err := s.d.Cmd("wait", id); err != nil {
  980. c.Fatal(out, err)
  981. }
  982. logPath := filepath.Join(s.d.root, "containers", id, id+"-json.log")
  983. if _, err := os.Stat(logPath); err != nil {
  984. c.Fatal(err)
  985. }
  986. f, err := os.Open(logPath)
  987. if err != nil {
  988. c.Fatal(err)
  989. }
  990. var res struct {
  991. Log string `json:"log"`
  992. Stream string `json:"stream"`
  993. Time time.Time `json:"time"`
  994. }
  995. if err := json.NewDecoder(f).Decode(&res); err != nil {
  996. c.Fatal(err)
  997. }
  998. if res.Log != "testline\n" {
  999. c.Fatalf("Unexpected log line: %q, expected: %q", res.Log, "testline\n")
  1000. }
  1001. if res.Stream != "stdout" {
  1002. c.Fatalf("Unexpected stream: %q, expected: %q", res.Stream, "stdout")
  1003. }
  1004. if !time.Now().After(res.Time) {
  1005. c.Fatalf("Log time %v in future", res.Time)
  1006. }
  1007. }
  1008. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNoneLogsError(c *check.C) {
  1009. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  1010. c.Fatal(err)
  1011. }
  1012. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  1013. if err != nil {
  1014. c.Fatal(out, err)
  1015. }
  1016. id := strings.TrimSpace(out)
  1017. out, err = s.d.Cmd("logs", id)
  1018. if err == nil {
  1019. c.Fatalf("Logs should fail with 'none' driver")
  1020. }
  1021. if !strings.Contains(out, `"logs" command is supported only for "json-file" and "journald" logging drivers (got: none)`) {
  1022. c.Fatalf("There should be an error about none not being a recognized log driver, got: %s", out)
  1023. }
  1024. }
  1025. func (s *DockerDaemonSuite) TestDaemonDots(c *check.C) {
  1026. if err := s.d.StartWithBusybox(); err != nil {
  1027. c.Fatal(err)
  1028. }
  1029. // Now create 4 containers
  1030. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  1031. c.Fatalf("Error creating container: %q", err)
  1032. }
  1033. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  1034. c.Fatalf("Error creating container: %q", err)
  1035. }
  1036. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  1037. c.Fatalf("Error creating container: %q", err)
  1038. }
  1039. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  1040. c.Fatalf("Error creating container: %q", err)
  1041. }
  1042. s.d.Stop()
  1043. s.d.Start("--log-level=debug")
  1044. s.d.Stop()
  1045. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  1046. if strings.Contains(string(content), "....") {
  1047. c.Fatalf("Debug level should not have ....\n%s", string(content))
  1048. }
  1049. s.d.Start("--log-level=error")
  1050. s.d.Stop()
  1051. content, _ = ioutil.ReadFile(s.d.logFile.Name())
  1052. if strings.Contains(string(content), "....") {
  1053. c.Fatalf("Error level should not have ....\n%s", string(content))
  1054. }
  1055. s.d.Start("--log-level=info")
  1056. s.d.Stop()
  1057. content, _ = ioutil.ReadFile(s.d.logFile.Name())
  1058. if !strings.Contains(string(content), "....") {
  1059. c.Fatalf("Info level should have ....\n%s", string(content))
  1060. }
  1061. }
  1062. func (s *DockerDaemonSuite) TestDaemonUnixSockCleanedUp(c *check.C) {
  1063. dir, err := ioutil.TempDir("", "socket-cleanup-test")
  1064. if err != nil {
  1065. c.Fatal(err)
  1066. }
  1067. defer os.RemoveAll(dir)
  1068. sockPath := filepath.Join(dir, "docker.sock")
  1069. if err := s.d.Start("--host", "unix://"+sockPath); err != nil {
  1070. c.Fatal(err)
  1071. }
  1072. if _, err := os.Stat(sockPath); err != nil {
  1073. c.Fatal("socket does not exist")
  1074. }
  1075. if err := s.d.Stop(); err != nil {
  1076. c.Fatal(err)
  1077. }
  1078. if _, err := os.Stat(sockPath); err == nil || !os.IsNotExist(err) {
  1079. c.Fatal("unix socket is not cleaned up")
  1080. }
  1081. }
  1082. func (s *DockerDaemonSuite) TestDaemonWithWrongkey(c *check.C) {
  1083. type Config struct {
  1084. Crv string `json:"crv"`
  1085. D string `json:"d"`
  1086. Kid string `json:"kid"`
  1087. Kty string `json:"kty"`
  1088. X string `json:"x"`
  1089. Y string `json:"y"`
  1090. }
  1091. os.Remove("/etc/docker/key.json")
  1092. if err := s.d.Start(); err != nil {
  1093. c.Fatalf("Failed to start daemon: %v", err)
  1094. }
  1095. if err := s.d.Stop(); err != nil {
  1096. c.Fatalf("Could not stop daemon: %v", err)
  1097. }
  1098. config := &Config{}
  1099. bytes, err := ioutil.ReadFile("/etc/docker/key.json")
  1100. if err != nil {
  1101. c.Fatalf("Error reading key.json file: %s", err)
  1102. }
  1103. // byte[] to Data-Struct
  1104. if err := json.Unmarshal(bytes, &config); err != nil {
  1105. c.Fatalf("Error Unmarshal: %s", err)
  1106. }
  1107. //replace config.Kid with the fake value
  1108. config.Kid = "VSAJ:FUYR:X3H2:B2VZ:KZ6U:CJD5:K7BX:ZXHY:UZXT:P4FT:MJWG:HRJ4"
  1109. // NEW Data-Struct to byte[]
  1110. newBytes, err := json.Marshal(&config)
  1111. if err != nil {
  1112. c.Fatalf("Error Marshal: %s", err)
  1113. }
  1114. // write back
  1115. if err := ioutil.WriteFile("/etc/docker/key.json", newBytes, 0400); err != nil {
  1116. c.Fatalf("Error ioutil.WriteFile: %s", err)
  1117. }
  1118. defer os.Remove("/etc/docker/key.json")
  1119. if err := s.d.Start(); err == nil {
  1120. c.Fatalf("It should not be successful to start daemon with wrong key: %v", err)
  1121. }
  1122. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  1123. if !strings.Contains(string(content), "Public Key ID does not match") {
  1124. c.Fatal("Missing KeyID message from daemon logs")
  1125. }
  1126. }
  1127. func (s *DockerDaemonSuite) TestDaemonRestartKillWait(c *check.C) {
  1128. if err := s.d.StartWithBusybox(); err != nil {
  1129. c.Fatalf("Could not start daemon with busybox: %v", err)
  1130. }
  1131. out, err := s.d.Cmd("run", "-id", "busybox", "/bin/cat")
  1132. if err != nil {
  1133. c.Fatalf("Could not run /bin/cat: err=%v\n%s", err, out)
  1134. }
  1135. containerID := strings.TrimSpace(out)
  1136. if out, err := s.d.Cmd("kill", containerID); err != nil {
  1137. c.Fatalf("Could not kill %s: err=%v\n%s", containerID, err, out)
  1138. }
  1139. if err := s.d.Restart(); err != nil {
  1140. c.Fatalf("Could not restart daemon: %v", err)
  1141. }
  1142. errchan := make(chan error)
  1143. go func() {
  1144. if out, err := s.d.Cmd("wait", containerID); err != nil {
  1145. errchan <- fmt.Errorf("%v:\n%s", err, out)
  1146. }
  1147. close(errchan)
  1148. }()
  1149. select {
  1150. case <-time.After(5 * time.Second):
  1151. c.Fatal("Waiting on a stopped (killed) container timed out")
  1152. case err := <-errchan:
  1153. if err != nil {
  1154. c.Fatal(err)
  1155. }
  1156. }
  1157. }
  1158. // TestHttpsInfo connects via two-way authenticated HTTPS to the info endpoint
  1159. func (s *DockerDaemonSuite) TestHttpsInfo(c *check.C) {
  1160. const (
  1161. testDaemonHTTPSAddr = "tcp://localhost:4271"
  1162. )
  1163. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-cert.pem",
  1164. "--tlskey", "fixtures/https/server-key.pem", "-H", testDaemonHTTPSAddr); err != nil {
  1165. c.Fatalf("Could not start daemon with busybox: %v", err)
  1166. }
  1167. daemonArgs := []string{"--host", testDaemonHTTPSAddr, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-cert.pem", "--tlskey", "fixtures/https/client-key.pem"}
  1168. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  1169. if err != nil {
  1170. c.Fatalf("Error Occurred: %s and output: %s", err, out)
  1171. }
  1172. }
  1173. // TestTlsVerify verifies that --tlsverify=false turns on tls
  1174. func (s *DockerDaemonSuite) TestTlsVerify(c *check.C) {
  1175. out, err := exec.Command(dockerBinary, "daemon", "--tlsverify=false").CombinedOutput()
  1176. if err == nil || !strings.Contains(string(out), "Could not load X509 key pair") {
  1177. c.Fatalf("Daemon should not have started due to missing certs: %v\n%s", err, string(out))
  1178. }
  1179. }
  1180. // TestHttpsInfoRogueCert connects via two-way authenticated HTTPS to the info endpoint
  1181. // by using a rogue client certificate and checks that it fails with the expected error.
  1182. func (s *DockerDaemonSuite) TestHttpsInfoRogueCert(c *check.C) {
  1183. const (
  1184. errBadCertificate = "remote error: bad certificate"
  1185. testDaemonHTTPSAddr = "tcp://localhost:4271"
  1186. )
  1187. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-cert.pem",
  1188. "--tlskey", "fixtures/https/server-key.pem", "-H", testDaemonHTTPSAddr); err != nil {
  1189. c.Fatalf("Could not start daemon with busybox: %v", err)
  1190. }
  1191. daemonArgs := []string{"--host", testDaemonHTTPSAddr, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-rogue-cert.pem", "--tlskey", "fixtures/https/client-rogue-key.pem"}
  1192. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  1193. if err == nil || !strings.Contains(out, errBadCertificate) {
  1194. c.Fatalf("Expected err: %s, got instead: %s and output: %s", errBadCertificate, err, out)
  1195. }
  1196. }
  1197. // TestHttpsInfoRogueServerCert connects via two-way authenticated HTTPS to the info endpoint
  1198. // which provides a rogue server certificate and checks that it fails with the expected error
  1199. func (s *DockerDaemonSuite) TestHttpsInfoRogueServerCert(c *check.C) {
  1200. const (
  1201. errCaUnknown = "x509: certificate signed by unknown authority"
  1202. testDaemonRogueHTTPSAddr = "tcp://localhost:4272"
  1203. )
  1204. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-rogue-cert.pem",
  1205. "--tlskey", "fixtures/https/server-rogue-key.pem", "-H", testDaemonRogueHTTPSAddr); err != nil {
  1206. c.Fatalf("Could not start daemon with busybox: %v", err)
  1207. }
  1208. daemonArgs := []string{"--host", testDaemonRogueHTTPSAddr, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-rogue-cert.pem", "--tlskey", "fixtures/https/client-rogue-key.pem"}
  1209. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  1210. if err == nil || !strings.Contains(out, errCaUnknown) {
  1211. c.Fatalf("Expected err: %s, got instead: %s and output: %s", errCaUnknown, err, out)
  1212. }
  1213. }
  1214. func pingContainers(c *check.C, d *Daemon, expectFailure bool) {
  1215. var dargs []string
  1216. if d != nil {
  1217. dargs = []string{"--host", d.sock()}
  1218. }
  1219. args := append(dargs, "run", "-d", "--name", "container1", "busybox", "top")
  1220. dockerCmd(c, args...)
  1221. args = append(dargs, "run", "--rm", "--link", "container1:alias1", "busybox", "sh", "-c")
  1222. pingCmd := "ping -c 1 %s -W 1"
  1223. args = append(args, fmt.Sprintf(pingCmd, "alias1"))
  1224. _, _, err := dockerCmdWithError(args...)
  1225. if expectFailure {
  1226. c.Assert(err, check.NotNil)
  1227. } else {
  1228. c.Assert(err, check.IsNil)
  1229. }
  1230. args = append(dargs, "rm", "-f", "container1")
  1231. dockerCmd(c, args...)
  1232. }
  1233. func (s *DockerDaemonSuite) TestDaemonRestartWithSocketAsVolume(c *check.C) {
  1234. c.Assert(s.d.StartWithBusybox(), check.IsNil)
  1235. socket := filepath.Join(s.d.folder, "docker.sock")
  1236. out, err := s.d.Cmd("run", "-d", "--restart=always", "-v", socket+":/sock", "busybox")
  1237. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1238. c.Assert(s.d.Restart(), check.IsNil)
  1239. }
  1240. func (s *DockerDaemonSuite) TestCleanupMountsAfterCrash(c *check.C) {
  1241. c.Assert(s.d.StartWithBusybox(), check.IsNil)
  1242. out, err := s.d.Cmd("run", "-d", "busybox", "top")
  1243. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1244. id := strings.TrimSpace(out)
  1245. c.Assert(s.d.cmd.Process.Signal(os.Kill), check.IsNil)
  1246. c.Assert(s.d.Start(), check.IsNil)
  1247. mountOut, err := ioutil.ReadFile("/proc/self/mountinfo")
  1248. c.Assert(err, check.IsNil, check.Commentf("Output: %s", mountOut))
  1249. comment := check.Commentf("%s is still mounted from older daemon start:\nDaemon root repository %s\n%s", id, s.d.folder, mountOut)
  1250. c.Assert(strings.Contains(string(mountOut), id), check.Equals, false, comment)
  1251. }
  1252. func (s *DockerDaemonSuite) TestRunContainerWithBridgeNone(c *check.C) {
  1253. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1254. c.Assert(s.d.StartWithBusybox("-b", "none"), check.IsNil)
  1255. out, err := s.d.Cmd("run", "--rm", "busybox", "ip", "l")
  1256. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1257. c.Assert(strings.Contains(out, "eth0"), check.Equals, false,
  1258. check.Commentf("There shouldn't be eth0 in container in default(bridge) mode when bridge network is disabled: %s", out))
  1259. out, err = s.d.Cmd("run", "--rm", "--net=bridge", "busybox", "ip", "l")
  1260. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1261. c.Assert(strings.Contains(out, "eth0"), check.Equals, false,
  1262. check.Commentf("There shouldn't be eth0 in container in bridge mode when bridge network is disabled: %s", out))
  1263. // the extra grep and awk clean up the output of `ip` to only list the number and name of
  1264. // interfaces, allowing for different versions of ip (e.g. inside and outside the container) to
  1265. // be used while still verifying that the interface list is the exact same
  1266. cmd := exec.Command("sh", "-c", "ip l | grep -E '^[0-9]+:' | awk -F: ' { print $1\":\"$2 } '")
  1267. stdout := bytes.NewBuffer(nil)
  1268. cmd.Stdout = stdout
  1269. if err := cmd.Run(); err != nil {
  1270. c.Fatal("Failed to get host network interface")
  1271. }
  1272. out, err = s.d.Cmd("run", "--rm", "--net=host", "busybox", "sh", "-c", "ip l | grep -E '^[0-9]+:' | awk -F: ' { print $1\":\"$2 } '")
  1273. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1274. c.Assert(out, check.Equals, fmt.Sprintf("%s", stdout),
  1275. check.Commentf("The network interfaces in container should be the same with host when --net=host when bridge network is disabled: %s", out))
  1276. }
  1277. func (s *DockerDaemonSuite) TestDaemonRestartWithContainerRunning(t *check.C) {
  1278. if err := s.d.StartWithBusybox(); err != nil {
  1279. t.Fatal(err)
  1280. }
  1281. if out, err := s.d.Cmd("run", "-ti", "-d", "--name", "test", "busybox"); err != nil {
  1282. t.Fatal(out, err)
  1283. }
  1284. if err := s.d.Restart(); err != nil {
  1285. t.Fatal(err)
  1286. }
  1287. // Container 'test' should be removed without error
  1288. if out, err := s.d.Cmd("rm", "test"); err != nil {
  1289. t.Fatal(out, err)
  1290. }
  1291. }
  1292. func (s *DockerDaemonSuite) TestDaemonRestartCleanupNetns(c *check.C) {
  1293. if err := s.d.StartWithBusybox(); err != nil {
  1294. c.Fatal(err)
  1295. }
  1296. out, err := s.d.Cmd("run", "--name", "netns", "-d", "busybox", "top")
  1297. if err != nil {
  1298. c.Fatal(out, err)
  1299. }
  1300. // Get sandbox key via inspect
  1301. out, err = s.d.Cmd("inspect", "--format", "'{{.NetworkSettings.SandboxKey}}'", "netns")
  1302. if err != nil {
  1303. c.Fatalf("Error inspecting container: %s, %v", out, err)
  1304. }
  1305. fileName := strings.Trim(out, " \r\n'")
  1306. if out, err := s.d.Cmd("stop", "netns"); err != nil {
  1307. c.Fatal(out, err)
  1308. }
  1309. // Test if the file still exists
  1310. out, _, err = runCommandWithOutput(exec.Command("stat", "-c", "%n", fileName))
  1311. out = strings.TrimSpace(out)
  1312. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1313. c.Assert(out, check.Equals, fileName, check.Commentf("Output: %s", out))
  1314. // Remove the container and restart the daemon
  1315. if out, err := s.d.Cmd("rm", "netns"); err != nil {
  1316. c.Fatal(out, err)
  1317. }
  1318. if err := s.d.Restart(); err != nil {
  1319. c.Fatal(err)
  1320. }
  1321. // Test again and see now the netns file does not exist
  1322. out, _, err = runCommandWithOutput(exec.Command("stat", "-c", "%n", fileName))
  1323. out = strings.TrimSpace(out)
  1324. c.Assert(err, check.Not(check.IsNil), check.Commentf("Output: %s", out))
  1325. }
  1326. // tests regression detailed in #13964 where DOCKER_TLS_VERIFY env is ignored
  1327. func (s *DockerDaemonSuite) TestDaemonNoTlsCliTlsVerifyWithEnv(c *check.C) {
  1328. host := "tcp://localhost:4271"
  1329. c.Assert(s.d.Start("-H", host), check.IsNil)
  1330. cmd := exec.Command(dockerBinary, "-H", host, "info")
  1331. cmd.Env = []string{"DOCKER_TLS_VERIFY=1", "DOCKER_CERT_PATH=fixtures/https"}
  1332. out, _, err := runCommandWithOutput(cmd)
  1333. c.Assert(err, check.Not(check.IsNil), check.Commentf("%s", out))
  1334. c.Assert(strings.Contains(out, "error occurred trying to connect"), check.Equals, true)
  1335. }
  1336. func setupV6() error {
  1337. // Hack to get the right IPv6 address on docker0, which has already been created
  1338. err := exec.Command("ip", "addr", "add", "fe80::1/64", "dev", "docker0").Run()
  1339. if err != nil {
  1340. return err
  1341. }
  1342. return nil
  1343. }
  1344. func teardownV6() error {
  1345. err := exec.Command("ip", "addr", "del", "fe80::1/64", "dev", "docker0").Run()
  1346. if err != nil {
  1347. return err
  1348. }
  1349. return nil
  1350. }
  1351. func (s *DockerDaemonSuite) TestDaemonRestartWithContainerWithRestartPolicyAlways(c *check.C) {
  1352. c.Assert(s.d.StartWithBusybox(), check.IsNil)
  1353. out, err := s.d.Cmd("run", "-d", "--restart", "always", "busybox", "top")
  1354. c.Assert(err, check.IsNil)
  1355. id := strings.TrimSpace(out)
  1356. _, err = s.d.Cmd("stop", id)
  1357. c.Assert(err, check.IsNil)
  1358. _, err = s.d.Cmd("wait", id)
  1359. c.Assert(err, check.IsNil)
  1360. out, err = s.d.Cmd("ps", "-q")
  1361. c.Assert(err, check.IsNil)
  1362. c.Assert(out, check.Equals, "")
  1363. c.Assert(s.d.Restart(), check.IsNil)
  1364. out, err = s.d.Cmd("ps", "-q")
  1365. c.Assert(err, check.IsNil)
  1366. c.Assert(strings.TrimSpace(out), check.Equals, id[:12])
  1367. }
  1368. func (s *DockerDaemonSuite) TestDaemonWideLogConfig(c *check.C) {
  1369. if err := s.d.StartWithBusybox("--log-driver=json-file", "--log-opt=max-size=1k"); err != nil {
  1370. c.Fatal(err)
  1371. }
  1372. out, err := s.d.Cmd("run", "-d", "--name=logtest", "busybox", "top")
  1373. c.Assert(err, check.IsNil, check.Commentf("Output: %s, err: %v", out, err))
  1374. out, err = s.d.Cmd("inspect", "-f", "{{ .HostConfig.LogConfig.Config }}", "logtest")
  1375. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1376. cfg := strings.TrimSpace(out)
  1377. if cfg != "map[max-size:1k]" {
  1378. c.Fatalf("Unexpected log-opt: %s, expected map[max-size:1k]", cfg)
  1379. }
  1380. }
  1381. func (s *DockerDaemonSuite) TestDaemonRestartWithPausedContainer(c *check.C) {
  1382. if err := s.d.StartWithBusybox(); err != nil {
  1383. c.Fatal(err)
  1384. }
  1385. if out, err := s.d.Cmd("run", "-i", "-d", "--name", "test", "busybox", "top"); err != nil {
  1386. c.Fatal(err, out)
  1387. }
  1388. if out, err := s.d.Cmd("pause", "test"); err != nil {
  1389. c.Fatal(err, out)
  1390. }
  1391. if err := s.d.Restart(); err != nil {
  1392. c.Fatal(err)
  1393. }
  1394. errchan := make(chan error)
  1395. go func() {
  1396. out, err := s.d.Cmd("start", "test")
  1397. if err != nil {
  1398. errchan <- fmt.Errorf("%v:\n%s", err, out)
  1399. }
  1400. name := strings.TrimSpace(out)
  1401. if name != "test" {
  1402. errchan <- fmt.Errorf("Paused container start error on docker daemon restart, expected 'test' but got '%s'", name)
  1403. }
  1404. close(errchan)
  1405. }()
  1406. select {
  1407. case <-time.After(5 * time.Second):
  1408. c.Fatal("Waiting on start a container timed out")
  1409. case err := <-errchan:
  1410. if err != nil {
  1411. c.Fatal(err)
  1412. }
  1413. }
  1414. }
  1415. func (s *DockerDaemonSuite) TestDaemonRestartRmVolumeInUse(c *check.C) {
  1416. c.Assert(s.d.StartWithBusybox(), check.IsNil)
  1417. out, err := s.d.Cmd("create", "-v", "test:/foo", "busybox")
  1418. c.Assert(err, check.IsNil, check.Commentf(out))
  1419. c.Assert(s.d.Restart(), check.IsNil)
  1420. out, err = s.d.Cmd("volume", "rm", "test")
  1421. c.Assert(err, check.Not(check.IsNil), check.Commentf("should not be able to remove in use volume after daemon restart"))
  1422. c.Assert(strings.Contains(out, "in use"), check.Equals, true)
  1423. }
  1424. func (s *DockerDaemonSuite) TestDaemonRestartLocalVolumes(c *check.C) {
  1425. c.Assert(s.d.Start(), check.IsNil)
  1426. _, err := s.d.Cmd("volume", "create", "--name", "test")
  1427. c.Assert(err, check.IsNil)
  1428. c.Assert(s.d.Restart(), check.IsNil)
  1429. _, err = s.d.Cmd("volume", "inspect", "test")
  1430. c.Assert(err, check.IsNil)
  1431. }
  1432. func (s *DockerDaemonSuite) TestDaemonCorruptedLogDriverAddress(c *check.C) {
  1433. for _, driver := range []string{
  1434. "syslog",
  1435. "gelf",
  1436. } {
  1437. args := []string{"--log-driver=" + driver, "--log-opt", driver + "-address=corrupted:42"}
  1438. c.Assert(s.d.Start(args...), check.NotNil, check.Commentf(fmt.Sprintf("Expected daemon not to start with invalid %s-address provided", driver)))
  1439. expected := fmt.Sprintf("Failed to set log opts: %s-address should be in form proto://address", driver)
  1440. runCmd := exec.Command("grep", expected, s.d.LogfileName())
  1441. if out, _, err := runCommandWithOutput(runCmd); err != nil {
  1442. c.Fatalf("Expected %q message; but doesn't exist in log: %q, err: %v", expected, out, err)
  1443. }
  1444. }
  1445. }
  1446. func (s *DockerDaemonSuite) TestDaemonCorruptedFluentdAddress(c *check.C) {
  1447. c.Assert(s.d.Start("--log-driver=fluentd", "--log-opt", "fluentd-address=corrupted:c"), check.NotNil)
  1448. expected := "Failed to set log opts: invalid fluentd-address corrupted:c: "
  1449. runCmd := exec.Command("grep", expected, s.d.LogfileName())
  1450. if out, _, err := runCommandWithOutput(runCmd); err != nil {
  1451. c.Fatalf("Expected %q message; but doesn't exist in log: %q, err: %v", expected, out, err)
  1452. }
  1453. }
  1454. func (s *DockerDaemonSuite) TestDaemonStartWithoutHost(c *check.C) {
  1455. s.d.useDefaultHost = true
  1456. defer func() {
  1457. s.d.useDefaultHost = false
  1458. }()
  1459. c.Assert(s.d.Start(), check.IsNil)
  1460. }
  1461. func (s *DockerDaemonSuite) TestDaemonStartWithDefalutTlsHost(c *check.C) {
  1462. s.d.useDefaultTLSHost = true
  1463. defer func() {
  1464. s.d.useDefaultTLSHost = false
  1465. }()
  1466. if err := s.d.Start(
  1467. "--tlsverify",
  1468. "--tlscacert", "fixtures/https/ca.pem",
  1469. "--tlscert", "fixtures/https/server-cert.pem",
  1470. "--tlskey", "fixtures/https/server-key.pem"); err != nil {
  1471. c.Fatalf("Could not start daemon: %v", err)
  1472. }
  1473. // The client with --tlsverify should also use default host localhost:2376
  1474. tmpHost := os.Getenv("DOCKER_HOST")
  1475. defer func() {
  1476. os.Setenv("DOCKER_HOST", tmpHost)
  1477. }()
  1478. os.Setenv("DOCKER_HOST", "")
  1479. out, _ := dockerCmd(
  1480. c,
  1481. "--tlsverify",
  1482. "--tlscacert", "fixtures/https/ca.pem",
  1483. "--tlscert", "fixtures/https/client-cert.pem",
  1484. "--tlskey", "fixtures/https/client-key.pem",
  1485. "version",
  1486. )
  1487. if !strings.Contains(out, "Server") {
  1488. c.Fatalf("docker version should return information of server side")
  1489. }
  1490. }
  1491. func (s *DockerDaemonSuite) TestBridgeIPIsExcludedFromAllocatorPool(c *check.C) {
  1492. defaultNetworkBridge := "docker0"
  1493. deleteInterface(c, defaultNetworkBridge)
  1494. bridgeIP := "192.169.1.1"
  1495. bridgeRange := bridgeIP + "/30"
  1496. err := s.d.StartWithBusybox("--bip", bridgeRange)
  1497. c.Assert(err, check.IsNil)
  1498. defer s.d.Restart()
  1499. var cont int
  1500. for {
  1501. contName := fmt.Sprintf("container%d", cont)
  1502. _, err = s.d.Cmd("run", "--name", contName, "-d", "busybox", "/bin/sleep", "2")
  1503. if err != nil {
  1504. // pool exhausted
  1505. break
  1506. }
  1507. ip, err := s.d.Cmd("inspect", "--format", "'{{.NetworkSettings.IPAddress}}'", contName)
  1508. c.Assert(err, check.IsNil)
  1509. c.Assert(ip, check.Not(check.Equals), bridgeIP)
  1510. cont++
  1511. }
  1512. }
  1513. // Test daemon for no space left on device error
  1514. func (s *DockerDaemonSuite) TestDaemonNoSpaceleftOnDeviceError(c *check.C) {
  1515. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1516. // create a 2MiB image and mount it as graph root
  1517. cmd := exec.Command("dd", "of=/tmp/testfs.img", "bs=1M", "seek=2", "count=0")
  1518. if err := cmd.Run(); err != nil {
  1519. c.Fatalf("dd failed: %v", err)
  1520. }
  1521. cmd = exec.Command("mkfs.ext4", "-F", "/tmp/testfs.img")
  1522. if err := cmd.Run(); err != nil {
  1523. c.Fatalf("mkfs.ext4 failed: %v", err)
  1524. }
  1525. cmd = exec.Command("mkdir", "-p", "/tmp/testfs-mount")
  1526. if err := cmd.Run(); err != nil {
  1527. c.Fatalf("mkdir failed: %v", err)
  1528. }
  1529. cmd = exec.Command("mount", "-t", "ext4", "-no", "loop,rw", "/tmp/testfs.img", "/tmp/testfs-mount")
  1530. if err := cmd.Run(); err != nil {
  1531. c.Fatalf("mount failed: %v", err)
  1532. }
  1533. err := s.d.Start("--graph", "/tmp/testfs-mount")
  1534. c.Assert(err, check.IsNil)
  1535. // pull a repository large enough to fill the mount point
  1536. out, err := s.d.Cmd("pull", "registry:2")
  1537. c.Assert(out, check.Not(check.Equals), 1, check.Commentf("no space left on device"))
  1538. }