ipcmode_linux_test.go 9.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294
  1. package container // import "github.com/docker/docker/integration/container"
  2. import (
  3. "bufio"
  4. "context"
  5. "io/ioutil"
  6. "os"
  7. "regexp"
  8. "strings"
  9. "testing"
  10. "github.com/docker/docker/api/types"
  11. containertypes "github.com/docker/docker/api/types/container"
  12. "github.com/docker/docker/integration/internal/container"
  13. "github.com/docker/docker/internal/test/daemon"
  14. "gotest.tools/assert"
  15. is "gotest.tools/assert/cmp"
  16. "gotest.tools/fs"
  17. "gotest.tools/skip"
  18. )
  19. // testIpcCheckDevExists checks whether a given mount (identified by its
  20. // major:minor pair from /proc/self/mountinfo) exists on the host system.
  21. //
  22. // The format of /proc/self/mountinfo is like:
  23. //
  24. // 29 23 0:24 / /dev/shm rw,nosuid,nodev shared:4 - tmpfs tmpfs rw
  25. // ^^^^\
  26. // - this is the minor:major we look for
  27. func testIpcCheckDevExists(mm string) (bool, error) {
  28. f, err := os.Open("/proc/self/mountinfo")
  29. if err != nil {
  30. return false, err
  31. }
  32. defer f.Close()
  33. s := bufio.NewScanner(f)
  34. for s.Scan() {
  35. fields := strings.Fields(s.Text())
  36. if len(fields) < 7 {
  37. continue
  38. }
  39. if fields[2] == mm {
  40. return true, nil
  41. }
  42. }
  43. return false, s.Err()
  44. }
  45. // testIpcNonePrivateShareable is a helper function to test "none",
  46. // "private" and "shareable" modes.
  47. func testIpcNonePrivateShareable(t *testing.T, mode string, mustBeMounted bool, mustBeShared bool) {
  48. defer setupTest(t)()
  49. cfg := containertypes.Config{
  50. Image: "busybox",
  51. Cmd: []string{"top"},
  52. }
  53. hostCfg := containertypes.HostConfig{
  54. IpcMode: containertypes.IpcMode(mode),
  55. }
  56. client := testEnv.APIClient()
  57. ctx := context.Background()
  58. resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
  59. assert.NilError(t, err)
  60. assert.Check(t, is.Equal(len(resp.Warnings), 0))
  61. err = client.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{})
  62. assert.NilError(t, err)
  63. // get major:minor pair for /dev/shm from container's /proc/self/mountinfo
  64. cmd := "awk '($5 == \"/dev/shm\") {printf $3}' /proc/self/mountinfo"
  65. result, err := container.Exec(ctx, client, resp.ID, []string{"sh", "-c", cmd})
  66. assert.NilError(t, err)
  67. mm := result.Combined()
  68. if !mustBeMounted {
  69. assert.Check(t, is.Equal(mm, ""))
  70. // no more checks to perform
  71. return
  72. }
  73. assert.Check(t, is.Equal(true, regexp.MustCompile("^[0-9]+:[0-9]+$").MatchString(mm)))
  74. shared, err := testIpcCheckDevExists(mm)
  75. assert.NilError(t, err)
  76. t.Logf("[testIpcPrivateShareable] ipcmode: %v, ipcdev: %v, shared: %v, mustBeShared: %v\n", mode, mm, shared, mustBeShared)
  77. assert.Check(t, is.Equal(shared, mustBeShared))
  78. }
  79. // TestIpcModeNone checks the container "none" IPC mode
  80. // (--ipc none) works as expected. It makes sure there is no
  81. // /dev/shm mount inside the container.
  82. func TestIpcModeNone(t *testing.T) {
  83. skip.If(t, testEnv.IsRemoteDaemon)
  84. testIpcNonePrivateShareable(t, "none", false, false)
  85. }
  86. // TestAPIIpcModePrivate checks the container private IPC mode
  87. // (--ipc private) works as expected. It gets the minor:major pair
  88. // of /dev/shm mount from the container, and makes sure there is no
  89. // such pair on the host.
  90. func TestIpcModePrivate(t *testing.T) {
  91. skip.If(t, testEnv.IsRemoteDaemon)
  92. testIpcNonePrivateShareable(t, "private", true, false)
  93. }
  94. // TestAPIIpcModeShareable checks the container shareable IPC mode
  95. // (--ipc shareable) works as expected. It gets the minor:major pair
  96. // of /dev/shm mount from the container, and makes sure such pair
  97. // also exists on the host.
  98. func TestIpcModeShareable(t *testing.T) {
  99. skip.If(t, testEnv.IsRemoteDaemon)
  100. testIpcNonePrivateShareable(t, "shareable", true, true)
  101. }
  102. // testIpcContainer is a helper function to test --ipc container:NNN mode in various scenarios
  103. func testIpcContainer(t *testing.T, donorMode string, mustWork bool) {
  104. t.Helper()
  105. defer setupTest(t)()
  106. cfg := containertypes.Config{
  107. Image: "busybox",
  108. Cmd: []string{"top"},
  109. }
  110. hostCfg := containertypes.HostConfig{
  111. IpcMode: containertypes.IpcMode(donorMode),
  112. }
  113. ctx := context.Background()
  114. client := testEnv.APIClient()
  115. // create and start the "donor" container
  116. resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
  117. assert.NilError(t, err)
  118. assert.Check(t, is.Equal(len(resp.Warnings), 0))
  119. name1 := resp.ID
  120. err = client.ContainerStart(ctx, name1, types.ContainerStartOptions{})
  121. assert.NilError(t, err)
  122. // create and start the second container
  123. hostCfg.IpcMode = containertypes.IpcMode("container:" + name1)
  124. resp, err = client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
  125. assert.NilError(t, err)
  126. assert.Check(t, is.Equal(len(resp.Warnings), 0))
  127. name2 := resp.ID
  128. err = client.ContainerStart(ctx, name2, types.ContainerStartOptions{})
  129. if !mustWork {
  130. // start should fail with a specific error
  131. assert.Check(t, is.ErrorContains(err, "non-shareable IPC"))
  132. // no more checks to perform here
  133. return
  134. }
  135. // start should succeed
  136. assert.NilError(t, err)
  137. // check that IPC is shared
  138. // 1. create a file in the first container
  139. _, err = container.Exec(ctx, client, name1, []string{"sh", "-c", "printf covfefe > /dev/shm/bar"})
  140. assert.NilError(t, err)
  141. // 2. check it's the same file in the second one
  142. result, err := container.Exec(ctx, client, name2, []string{"cat", "/dev/shm/bar"})
  143. assert.NilError(t, err)
  144. out := result.Combined()
  145. assert.Check(t, is.Equal(true, regexp.MustCompile("^covfefe$").MatchString(out)))
  146. }
  147. // TestAPIIpcModeShareableAndPrivate checks that
  148. // 1) a container created with --ipc container:ID can use IPC of another shareable container.
  149. // 2) a container created with --ipc container:ID can NOT use IPC of another private container.
  150. func TestAPIIpcModeShareableAndContainer(t *testing.T) {
  151. skip.If(t, testEnv.IsRemoteDaemon)
  152. testIpcContainer(t, "shareable", true)
  153. testIpcContainer(t, "private", false)
  154. }
  155. /* TestAPIIpcModeHost checks that a container created with --ipc host
  156. * can use IPC of the host system.
  157. */
  158. func TestAPIIpcModeHost(t *testing.T) {
  159. skip.If(t, testEnv.IsRemoteDaemon)
  160. skip.If(t, testEnv.IsUserNamespace)
  161. cfg := containertypes.Config{
  162. Image: "busybox",
  163. Cmd: []string{"top"},
  164. }
  165. hostCfg := containertypes.HostConfig{
  166. IpcMode: containertypes.IpcMode("host"),
  167. }
  168. ctx := context.Background()
  169. client := testEnv.APIClient()
  170. resp, err := client.ContainerCreate(ctx, &cfg, &hostCfg, nil, "")
  171. assert.NilError(t, err)
  172. assert.Check(t, is.Equal(len(resp.Warnings), 0))
  173. name := resp.ID
  174. err = client.ContainerStart(ctx, name, types.ContainerStartOptions{})
  175. assert.NilError(t, err)
  176. // check that IPC is shared
  177. // 1. create a file inside container
  178. _, err = container.Exec(ctx, client, name, []string{"sh", "-c", "printf covfefe > /dev/shm/." + name})
  179. assert.NilError(t, err)
  180. // 2. check it's the same on the host
  181. bytes, err := ioutil.ReadFile("/dev/shm/." + name)
  182. assert.NilError(t, err)
  183. assert.Check(t, is.Equal("covfefe", string(bytes)))
  184. // 3. clean up
  185. _, err = container.Exec(ctx, client, name, []string{"rm", "-f", "/dev/shm/." + name})
  186. assert.NilError(t, err)
  187. }
  188. // testDaemonIpcPrivateShareable is a helper function to test "private" and "shareable" daemon default ipc modes.
  189. func testDaemonIpcPrivateShareable(t *testing.T, mustBeShared bool, arg ...string) {
  190. defer setupTest(t)()
  191. d := daemon.New(t)
  192. d.StartWithBusybox(t, arg...)
  193. defer d.Stop(t)
  194. c := d.NewClientT(t)
  195. cfg := containertypes.Config{
  196. Image: "busybox",
  197. Cmd: []string{"top"},
  198. }
  199. ctx := context.Background()
  200. resp, err := c.ContainerCreate(ctx, &cfg, &containertypes.HostConfig{}, nil, "")
  201. assert.NilError(t, err)
  202. assert.Check(t, is.Equal(len(resp.Warnings), 0))
  203. err = c.ContainerStart(ctx, resp.ID, types.ContainerStartOptions{})
  204. assert.NilError(t, err)
  205. // get major:minor pair for /dev/shm from container's /proc/self/mountinfo
  206. cmd := "awk '($5 == \"/dev/shm\") {printf $3}' /proc/self/mountinfo"
  207. result, err := container.Exec(ctx, c, resp.ID, []string{"sh", "-c", cmd})
  208. assert.NilError(t, err)
  209. mm := result.Combined()
  210. assert.Check(t, is.Equal(true, regexp.MustCompile("^[0-9]+:[0-9]+$").MatchString(mm)))
  211. shared, err := testIpcCheckDevExists(mm)
  212. assert.NilError(t, err)
  213. t.Logf("[testDaemonIpcPrivateShareable] ipcdev: %v, shared: %v, mustBeShared: %v\n", mm, shared, mustBeShared)
  214. assert.Check(t, is.Equal(shared, mustBeShared))
  215. }
  216. // TestDaemonIpcModeShareable checks that --default-ipc-mode shareable works as intended.
  217. func TestDaemonIpcModeShareable(t *testing.T) {
  218. skip.If(t, testEnv.IsRemoteDaemon)
  219. testDaemonIpcPrivateShareable(t, true, "--default-ipc-mode", "shareable")
  220. }
  221. // TestDaemonIpcModePrivate checks that --default-ipc-mode private works as intended.
  222. func TestDaemonIpcModePrivate(t *testing.T) {
  223. skip.If(t, testEnv.IsRemoteDaemon)
  224. testDaemonIpcPrivateShareable(t, false, "--default-ipc-mode", "private")
  225. }
  226. // used to check if an IpcMode given in config works as intended
  227. func testDaemonIpcFromConfig(t *testing.T, mode string, mustExist bool) {
  228. config := `{"default-ipc-mode": "` + mode + `"}`
  229. file := fs.NewFile(t, "test-daemon-ipc-config", fs.WithContent(config))
  230. defer file.Remove()
  231. testDaemonIpcPrivateShareable(t, mustExist, "--config-file", file.Path())
  232. }
  233. // TestDaemonIpcModePrivateFromConfig checks that "default-ipc-mode: private" config works as intended.
  234. func TestDaemonIpcModePrivateFromConfig(t *testing.T) {
  235. skip.If(t, testEnv.IsRemoteDaemon)
  236. testDaemonIpcFromConfig(t, "private", false)
  237. }
  238. // TestDaemonIpcModeShareableFromConfig checks that "default-ipc-mode: shareable" config works as intended.
  239. func TestDaemonIpcModeShareableFromConfig(t *testing.T) {
  240. skip.If(t, testEnv.IsRemoteDaemon)
  241. testDaemonIpcFromConfig(t, "shareable", true)
  242. }