docker_cli_run_test.go 147 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939194019411942194319441945194619471948194919501951195219531954195519561957195819591960196119621963196419651966196719681969197019711972197319741975197619771978197919801981198219831984198519861987198819891990199119921993199419951996199719981999200020012002200320042005200620072008200920102011201220132014201520162017201820192020202120222023202420252026202720282029203020312032203320342035203620372038203920402041204220432044204520462047204820492050205120522053205420552056205720582059206020612062206320642065206620672068206920702071207220732074207520762077207820792080208120822083208420852086208720882089209020912092209320942095209620972098209921002101210221032104210521062107210821092110211121122113211421152116211721182119212021212122212321242125212621272128212921302131213221332134213521362137213821392140214121422143214421452146214721482149215021512152215321542155215621572158215921602161216221632164216521662167216821692170217121722173217421752176217721782179218021812182218321842185218621872188218921902191219221932194219521962197219821992200220122022203220422052206220722082209221022112212221322142215221622172218221922202221222222232224222522262227222822292230223122322233223422352236223722382239224022412242224322442245224622472248224922502251225222532254225522562257225822592260226122622263226422652266226722682269227022712272227322742275227622772278227922802281228222832284228522862287228822892290229122922293229422952296229722982299230023012302230323042305230623072308230923102311231223132314231523162317231823192320232123222323232423252326232723282329233023312332233323342335233623372338233923402341234223432344234523462347234823492350235123522353235423552356235723582359236023612362236323642365236623672368236923702371237223732374237523762377237823792380238123822383238423852386238723882389239023912392239323942395239623972398239924002401240224032404240524062407240824092410241124122413241424152416241724182419242024212422242324242425242624272428242924302431243224332434243524362437243824392440244124422443244424452446244724482449245024512452245324542455245624572458245924602461246224632464246524662467246824692470247124722473247424752476247724782479248024812482248324842485248624872488248924902491249224932494249524962497249824992500250125022503250425052506250725082509251025112512251325142515251625172518251925202521252225232524252525262527252825292530253125322533253425352536253725382539254025412542254325442545254625472548254925502551255225532554255525562557255825592560256125622563256425652566256725682569257025712572257325742575257625772578257925802581258225832584258525862587258825892590259125922593259425952596259725982599260026012602260326042605260626072608260926102611261226132614261526162617261826192620262126222623262426252626262726282629263026312632263326342635263626372638263926402641264226432644264526462647264826492650265126522653265426552656265726582659266026612662266326642665266626672668266926702671267226732674267526762677267826792680268126822683268426852686268726882689269026912692269326942695269626972698269927002701270227032704270527062707270827092710271127122713271427152716271727182719272027212722272327242725272627272728272927302731273227332734273527362737273827392740274127422743274427452746274727482749275027512752275327542755275627572758275927602761276227632764276527662767276827692770277127722773277427752776277727782779278027812782278327842785278627872788278927902791279227932794279527962797279827992800280128022803280428052806280728082809281028112812281328142815281628172818281928202821282228232824282528262827282828292830283128322833283428352836283728382839284028412842284328442845284628472848284928502851285228532854285528562857285828592860286128622863286428652866286728682869287028712872287328742875287628772878287928802881288228832884288528862887288828892890289128922893289428952896289728982899290029012902290329042905290629072908290929102911291229132914291529162917291829192920292129222923292429252926292729282929293029312932293329342935293629372938293929402941294229432944294529462947294829492950295129522953295429552956295729582959296029612962296329642965296629672968296929702971297229732974297529762977297829792980298129822983298429852986298729882989299029912992299329942995299629972998299930003001300230033004300530063007300830093010301130123013301430153016301730183019302030213022302330243025302630273028302930303031303230333034303530363037303830393040304130423043304430453046304730483049305030513052305330543055305630573058305930603061306230633064306530663067306830693070307130723073307430753076307730783079308030813082308330843085308630873088308930903091309230933094309530963097309830993100310131023103310431053106310731083109311031113112311331143115311631173118311931203121312231233124312531263127312831293130313131323133313431353136313731383139314031413142314331443145314631473148314931503151315231533154315531563157315831593160316131623163316431653166316731683169317031713172317331743175317631773178317931803181318231833184318531863187318831893190319131923193319431953196319731983199320032013202320332043205320632073208320932103211321232133214321532163217321832193220322132223223322432253226322732283229323032313232323332343235323632373238323932403241324232433244324532463247324832493250325132523253325432553256325732583259326032613262326332643265326632673268326932703271327232733274327532763277327832793280328132823283328432853286328732883289329032913292329332943295329632973298329933003301330233033304330533063307330833093310331133123313331433153316331733183319332033213322332333243325332633273328332933303331333233333334333533363337333833393340334133423343334433453346334733483349335033513352335333543355335633573358335933603361336233633364336533663367336833693370337133723373337433753376337733783379338033813382338333843385338633873388338933903391339233933394339533963397339833993400340134023403340434053406340734083409341034113412341334143415341634173418341934203421342234233424342534263427342834293430343134323433343434353436343734383439344034413442344334443445344634473448344934503451345234533454345534563457345834593460346134623463346434653466346734683469347034713472347334743475347634773478347934803481348234833484348534863487348834893490349134923493349434953496349734983499350035013502350335043505350635073508350935103511351235133514351535163517351835193520352135223523352435253526352735283529353035313532353335343535353635373538353935403541354235433544354535463547354835493550355135523553355435553556355735583559356035613562356335643565356635673568356935703571357235733574357535763577357835793580358135823583358435853586358735883589359035913592359335943595359635973598359936003601360236033604360536063607360836093610361136123613361436153616361736183619362036213622362336243625362636273628362936303631363236333634363536363637363836393640364136423643364436453646364736483649365036513652365336543655365636573658365936603661366236633664366536663667366836693670367136723673367436753676367736783679368036813682368336843685368636873688368936903691369236933694369536963697369836993700370137023703370437053706370737083709371037113712371337143715371637173718371937203721372237233724372537263727372837293730373137323733373437353736373737383739374037413742374337443745374637473748374937503751375237533754375537563757375837593760376137623763376437653766376737683769377037713772377337743775377637773778377937803781378237833784378537863787378837893790379137923793379437953796379737983799380038013802380338043805380638073808380938103811381238133814381538163817381838193820382138223823382438253826382738283829383038313832383338343835383638373838383938403841384238433844384538463847384838493850385138523853385438553856385738583859386038613862386338643865386638673868386938703871387238733874387538763877387838793880388138823883388438853886388738883889389038913892389338943895389638973898389939003901390239033904390539063907390839093910391139123913391439153916391739183919392039213922392339243925392639273928392939303931393239333934393539363937393839393940394139423943394439453946394739483949395039513952395339543955395639573958395939603961396239633964396539663967396839693970397139723973397439753976397739783979398039813982398339843985398639873988398939903991399239933994399539963997399839994000400140024003400440054006400740084009401040114012401340144015401640174018401940204021402240234024402540264027402840294030403140324033403440354036403740384039404040414042404340444045404640474048404940504051405240534054405540564057405840594060406140624063406440654066406740684069407040714072407340744075407640774078407940804081408240834084408540864087408840894090409140924093409440954096409740984099410041014102410341044105410641074108410941104111411241134114411541164117411841194120412141224123412441254126412741284129413041314132413341344135413641374138
  1. package main
  2. import (
  3. "bufio"
  4. "bytes"
  5. "fmt"
  6. "io/ioutil"
  7. "net"
  8. "os"
  9. "os/exec"
  10. "path"
  11. "path/filepath"
  12. "reflect"
  13. "regexp"
  14. "sort"
  15. "strconv"
  16. "strings"
  17. "sync"
  18. "time"
  19. "github.com/docker/docker/pkg/integration/checker"
  20. "github.com/docker/docker/pkg/mount"
  21. "github.com/docker/docker/runconfig"
  22. "github.com/docker/go-connections/nat"
  23. "github.com/docker/libnetwork/resolvconf"
  24. "github.com/go-check/check"
  25. )
  26. // "test123" should be printed by docker run
  27. func (s *DockerSuite) TestRunEchoStdout(c *check.C) {
  28. out, _ := dockerCmd(c, "run", "busybox", "echo", "test123")
  29. if out != "test123\n" {
  30. c.Fatalf("container should've printed 'test123', got '%s'", out)
  31. }
  32. }
  33. // "test" should be printed
  34. func (s *DockerSuite) TestRunEchoNamedContainer(c *check.C) {
  35. out, _ := dockerCmd(c, "run", "--name", "testfoonamedcontainer", "busybox", "echo", "test")
  36. if out != "test\n" {
  37. c.Errorf("container should've printed 'test'")
  38. }
  39. }
  40. // docker run should not leak file descriptors. This test relies on Unix
  41. // specific functionality and cannot run on Windows.
  42. func (s *DockerSuite) TestRunLeakyFileDescriptors(c *check.C) {
  43. testRequires(c, DaemonIsLinux)
  44. out, _ := dockerCmd(c, "run", "busybox", "ls", "-C", "/proc/self/fd")
  45. // normally, we should only get 0, 1, and 2, but 3 gets created by "ls" when it does "opendir" on the "fd" directory
  46. if out != "0 1 2 3\n" {
  47. c.Errorf("container should've printed '0 1 2 3', not: %s", out)
  48. }
  49. }
  50. // it should be possible to lookup Google DNS
  51. // this will fail when Internet access is unavailable
  52. func (s *DockerSuite) TestRunLookupGoogleDns(c *check.C) {
  53. testRequires(c, Network, NotArm)
  54. image := DefaultImage
  55. if daemonPlatform == "windows" {
  56. // nslookup isn't present in Windows busybox. Is built-in.
  57. image = WindowsBaseImage
  58. }
  59. dockerCmd(c, "run", image, "nslookup", "google.com")
  60. }
  61. // the exit code should be 0
  62. func (s *DockerSuite) TestRunExitCodeZero(c *check.C) {
  63. dockerCmd(c, "run", "busybox", "true")
  64. }
  65. // the exit code should be 1
  66. func (s *DockerSuite) TestRunExitCodeOne(c *check.C) {
  67. _, exitCode, err := dockerCmdWithError("run", "busybox", "false")
  68. if err != nil && !strings.Contains("exit status 1", fmt.Sprintf("%s", err)) {
  69. c.Fatal(err)
  70. }
  71. if exitCode != 1 {
  72. c.Errorf("container should've exited with exit code 1. Got %d", exitCode)
  73. }
  74. }
  75. // it should be possible to pipe in data via stdin to a process running in a container
  76. func (s *DockerSuite) TestRunStdinPipe(c *check.C) {
  77. // TODO Windows: This needs some work to make compatible.
  78. testRequires(c, DaemonIsLinux)
  79. runCmd := exec.Command(dockerBinary, "run", "-i", "-a", "stdin", "busybox", "cat")
  80. runCmd.Stdin = strings.NewReader("blahblah")
  81. out, _, _, err := runCommandWithStdoutStderr(runCmd)
  82. if err != nil {
  83. c.Fatalf("failed to run container: %v, output: %q", err, out)
  84. }
  85. out = strings.TrimSpace(out)
  86. dockerCmd(c, "wait", out)
  87. logsOut, _ := dockerCmd(c, "logs", out)
  88. containerLogs := strings.TrimSpace(logsOut)
  89. if containerLogs != "blahblah" {
  90. c.Errorf("logs didn't print the container's logs %s", containerLogs)
  91. }
  92. dockerCmd(c, "rm", out)
  93. }
  94. // the container's ID should be printed when starting a container in detached mode
  95. func (s *DockerSuite) TestRunDetachedContainerIDPrinting(c *check.C) {
  96. out, _ := dockerCmd(c, "run", "-d", "busybox", "true")
  97. out = strings.TrimSpace(out)
  98. dockerCmd(c, "wait", out)
  99. rmOut, _ := dockerCmd(c, "rm", out)
  100. rmOut = strings.TrimSpace(rmOut)
  101. if rmOut != out {
  102. c.Errorf("rm didn't print the container ID %s %s", out, rmOut)
  103. }
  104. }
  105. // the working directory should be set correctly
  106. func (s *DockerSuite) TestRunWorkingDirectory(c *check.C) {
  107. // TODO Windows: There's a Windows bug stopping this from working.
  108. testRequires(c, DaemonIsLinux)
  109. dir := "/root"
  110. image := "busybox"
  111. if daemonPlatform == "windows" {
  112. dir = `/windows`
  113. image = WindowsBaseImage
  114. }
  115. // First with -w
  116. out, _ := dockerCmd(c, "run", "-w", dir, image, "pwd")
  117. out = strings.TrimSpace(out)
  118. if out != dir {
  119. c.Errorf("-w failed to set working directory")
  120. }
  121. // Then with --workdir
  122. out, _ = dockerCmd(c, "run", "--workdir", dir, image, "pwd")
  123. out = strings.TrimSpace(out)
  124. if out != dir {
  125. c.Errorf("--workdir failed to set working directory")
  126. }
  127. }
  128. // pinging Google's DNS resolver should fail when we disable the networking
  129. func (s *DockerSuite) TestRunWithoutNetworking(c *check.C) {
  130. count := "-c"
  131. image := "busybox"
  132. if daemonPlatform == "windows" {
  133. count = "-n"
  134. image = WindowsBaseImage
  135. }
  136. // First using the long form --net
  137. out, exitCode, err := dockerCmdWithError("run", "--net=none", image, "ping", count, "1", "8.8.8.8")
  138. if err != nil && exitCode != 1 {
  139. c.Fatal(out, err)
  140. }
  141. if exitCode != 1 {
  142. c.Errorf("--net=none should've disabled the network; the container shouldn't have been able to ping 8.8.8.8")
  143. }
  144. }
  145. //test --link use container name to link target
  146. func (s *DockerSuite) TestRunLinksContainerWithContainerName(c *check.C) {
  147. // TODO Windows: This test cannot run on a Windows daemon as the networking
  148. // settings are not populated back yet on inspect.
  149. testRequires(c, DaemonIsLinux)
  150. dockerCmd(c, "run", "-i", "-t", "-d", "--name", "parent", "busybox")
  151. ip, err := inspectField("parent", "NetworkSettings.Networks.bridge.IPAddress")
  152. c.Assert(err, check.IsNil)
  153. out, _ := dockerCmd(c, "run", "--link", "parent:test", "busybox", "/bin/cat", "/etc/hosts")
  154. if !strings.Contains(out, ip+" test") {
  155. c.Fatalf("use a container name to link target failed")
  156. }
  157. }
  158. //test --link use container id to link target
  159. func (s *DockerSuite) TestRunLinksContainerWithContainerId(c *check.C) {
  160. // TODO Windows: This test cannot run on a Windows daemon as the networking
  161. // settings are not populated back yet on inspect.
  162. testRequires(c, DaemonIsLinux)
  163. cID, _ := dockerCmd(c, "run", "-i", "-t", "-d", "busybox")
  164. cID = strings.TrimSpace(cID)
  165. ip, err := inspectField(cID, "NetworkSettings.Networks.bridge.IPAddress")
  166. c.Assert(err, check.IsNil)
  167. out, _ := dockerCmd(c, "run", "--link", cID+":test", "busybox", "/bin/cat", "/etc/hosts")
  168. if !strings.Contains(out, ip+" test") {
  169. c.Fatalf("use a container id to link target failed")
  170. }
  171. }
  172. func (s *DockerSuite) TestUserDefinedNetworkLinks(c *check.C) {
  173. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  174. dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
  175. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
  176. c.Assert(waitRun("first"), check.IsNil)
  177. // run a container in user-defined network udlinkNet with a link for an existing container
  178. // and a link for a container that doesnt exist
  179. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
  180. "--link=third:bar", "busybox", "top")
  181. c.Assert(waitRun("second"), check.IsNil)
  182. // ping to first and its alias foo must succeed
  183. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  184. c.Assert(err, check.IsNil)
  185. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  186. c.Assert(err, check.IsNil)
  187. // ping to third and its alias must fail
  188. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
  189. c.Assert(err, check.NotNil)
  190. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
  191. c.Assert(err, check.NotNil)
  192. // start third container now
  193. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=third", "busybox", "top")
  194. c.Assert(waitRun("third"), check.IsNil)
  195. // ping to third and its alias must succeed now
  196. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
  197. c.Assert(err, check.IsNil)
  198. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
  199. c.Assert(err, check.IsNil)
  200. }
  201. func (s *DockerSuite) TestUserDefinedNetworkLinksWithRestart(c *check.C) {
  202. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  203. dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
  204. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
  205. c.Assert(waitRun("first"), check.IsNil)
  206. dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
  207. "busybox", "top")
  208. c.Assert(waitRun("second"), check.IsNil)
  209. // ping to first and its alias foo must succeed
  210. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  211. c.Assert(err, check.IsNil)
  212. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  213. c.Assert(err, check.IsNil)
  214. // Restart first container
  215. dockerCmd(c, "restart", "first")
  216. c.Assert(waitRun("first"), check.IsNil)
  217. // ping to first and its alias foo must still succeed
  218. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  219. c.Assert(err, check.IsNil)
  220. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  221. c.Assert(err, check.IsNil)
  222. // Restart second container
  223. dockerCmd(c, "restart", "second")
  224. c.Assert(waitRun("second"), check.IsNil)
  225. // ping to first and its alias foo must still succeed
  226. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  227. c.Assert(err, check.IsNil)
  228. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
  229. c.Assert(err, check.IsNil)
  230. }
  231. func (s *DockerSuite) TestUserDefinedNetworkAlias(c *check.C) {
  232. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  233. dockerCmd(c, "network", "create", "-d", "bridge", "net1")
  234. dockerCmd(c, "run", "-d", "--net=net1", "--name=first", "--net-alias=foo1", "--net-alias=foo2", "busybox", "top")
  235. c.Assert(waitRun("first"), check.IsNil)
  236. dockerCmd(c, "run", "-d", "--net=net1", "--name=second", "busybox", "top")
  237. c.Assert(waitRun("second"), check.IsNil)
  238. // ping to first and its network-scoped aliases
  239. _, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  240. c.Assert(err, check.IsNil)
  241. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
  242. c.Assert(err, check.IsNil)
  243. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
  244. c.Assert(err, check.IsNil)
  245. // Restart first container
  246. dockerCmd(c, "restart", "first")
  247. c.Assert(waitRun("first"), check.IsNil)
  248. // ping to first and its network-scoped aliases must succeed
  249. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
  250. c.Assert(err, check.IsNil)
  251. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
  252. c.Assert(err, check.IsNil)
  253. _, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
  254. c.Assert(err, check.IsNil)
  255. }
  256. // Issue 9677.
  257. func (s *DockerSuite) TestRunWithDaemonFlags(c *check.C) {
  258. out, _, err := dockerCmdWithError("--exec-opt", "foo=bar", "run", "-i", "busybox", "true")
  259. if err != nil {
  260. if !strings.Contains(out, "flag provided but not defined: --exec-opt") { // no daemon (client-only)
  261. c.Fatal(err, out)
  262. }
  263. }
  264. }
  265. // Regression test for #4979
  266. func (s *DockerSuite) TestRunWithVolumesFromExited(c *check.C) {
  267. var (
  268. out string
  269. exitCode int
  270. )
  271. // Create a file in a volume
  272. if daemonPlatform == "windows" {
  273. out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", `c:\some\dir`, WindowsBaseImage, `cmd /c echo hello > c:\some\dir\file`)
  274. } else {
  275. out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", "/some/dir", "busybox", "touch", "/some/dir/file")
  276. }
  277. if exitCode != 0 {
  278. c.Fatal("1", out, exitCode)
  279. }
  280. // Read the file from another container using --volumes-from to access the volume in the second container
  281. if daemonPlatform == "windows" {
  282. out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", WindowsBaseImage, `cmd /c type c:\some\dir\file`)
  283. } else {
  284. out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", "busybox", "cat", "/some/dir/file")
  285. }
  286. if exitCode != 0 {
  287. c.Fatal("2", out, exitCode)
  288. }
  289. }
  290. // Volume path is a symlink which also exists on the host, and the host side is a file not a dir
  291. // But the volume call is just a normal volume, not a bind mount
  292. func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir(c *check.C) {
  293. var (
  294. dockerFile string
  295. containerPath string
  296. cmd string
  297. )
  298. testRequires(c, SameHostDaemon)
  299. name := "test-volume-symlink"
  300. dir, err := ioutil.TempDir("", name)
  301. if err != nil {
  302. c.Fatal(err)
  303. }
  304. defer os.RemoveAll(dir)
  305. f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_CREATE, 0700)
  306. if err != nil {
  307. c.Fatal(err)
  308. }
  309. f.Close()
  310. if daemonPlatform == "windows" {
  311. dockerFile = fmt.Sprintf("FROM %s\nRUN mkdir %s\nRUN mklink /D c:\\test %s", WindowsBaseImage, dir, dir)
  312. containerPath = `c:\test\test`
  313. cmd = "tasklist"
  314. } else {
  315. dockerFile = fmt.Sprintf("FROM busybox\nRUN mkdir -p %s\nRUN ln -s %s /test", dir, dir)
  316. containerPath = "/test/test"
  317. cmd = "true"
  318. }
  319. if _, err := buildImage(name, dockerFile, false); err != nil {
  320. c.Fatal(err)
  321. }
  322. dockerCmd(c, "run", "-v", containerPath, name, cmd)
  323. }
  324. func (s *DockerSuite) TestRunVolumesMountedAsReadonly(c *check.C) {
  325. // TODO Windows (Post TP4): This test cannot run on a Windows daemon as
  326. // Windows does not support read-only bind mounts.
  327. testRequires(c, DaemonIsLinux)
  328. if _, code, err := dockerCmdWithError("run", "-v", "/test:/test:ro", "busybox", "touch", "/test/somefile"); err == nil || code == 0 {
  329. c.Fatalf("run should fail because volume is ro: exit code %d", code)
  330. }
  331. }
  332. func (s *DockerSuite) TestRunVolumesFromInReadonlyModeFails(c *check.C) {
  333. // TODO Windows (Post TP4): This test cannot run on a Windows daemon as
  334. // Windows does not support read-only bind mounts. Modified for when ro is supported.
  335. testRequires(c, DaemonIsLinux)
  336. var (
  337. volumeDir string
  338. fileInVol string
  339. )
  340. if daemonPlatform == "windows" {
  341. volumeDir = `c:/test` // Forward-slash as using busybox
  342. fileInVol = `c:/test/file`
  343. } else {
  344. testRequires(c, DaemonIsLinux)
  345. volumeDir = "/test"
  346. fileInVol = `/test/file`
  347. }
  348. dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
  349. if _, code, err := dockerCmdWithError("run", "--volumes-from", "parent:ro", "busybox", "touch", fileInVol); err == nil || code == 0 {
  350. c.Fatalf("run should fail because volume is ro: exit code %d", code)
  351. }
  352. }
  353. // Regression test for #1201
  354. func (s *DockerSuite) TestRunVolumesFromInReadWriteMode(c *check.C) {
  355. var (
  356. volumeDir string
  357. fileInVol string
  358. )
  359. if daemonPlatform == "windows" {
  360. volumeDir = `c:/test` // Forward-slash as using busybox
  361. fileInVol = `c:/test/file`
  362. } else {
  363. testRequires(c, DaemonIsLinux)
  364. volumeDir = "/test"
  365. fileInVol = "/test/file"
  366. }
  367. dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
  368. dockerCmd(c, "run", "--volumes-from", "parent:rw", "busybox", "touch", fileInVol)
  369. if out, _, err := dockerCmdWithError("run", "--volumes-from", "parent:bar", "busybox", "touch", fileInVol); err == nil || !strings.Contains(out, `invalid mode: "bar"`) {
  370. c.Fatalf("running --volumes-from parent:bar should have failed with invalid mode: %q", out)
  371. }
  372. dockerCmd(c, "run", "--volumes-from", "parent", "busybox", "touch", fileInVol)
  373. }
  374. func (s *DockerSuite) TestVolumesFromGetsProperMode(c *check.C) {
  375. // TODO Windows: This test cannot yet run on a Windows daemon as Windows does
  376. // not support read-only bind mounts as at TP4
  377. testRequires(c, DaemonIsLinux)
  378. dockerCmd(c, "run", "--name", "parent", "-v", "/test:/test:ro", "busybox", "true")
  379. // Expect this "rw" mode to be be ignored since the inherited volume is "ro"
  380. if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent:rw", "busybox", "touch", "/test/file"); err == nil {
  381. c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `rw`")
  382. }
  383. dockerCmd(c, "run", "--name", "parent2", "-v", "/test:/test:ro", "busybox", "true")
  384. // Expect this to be read-only since both are "ro"
  385. if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent2:ro", "busybox", "touch", "/test/file"); err == nil {
  386. c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `ro`")
  387. }
  388. }
  389. // Test for GH#10618
  390. func (s *DockerSuite) TestRunNoDupVolumes(c *check.C) {
  391. path1 := randomTmpDirPath("test1", daemonPlatform)
  392. path2 := randomTmpDirPath("test2", daemonPlatform)
  393. someplace := ":/someplace"
  394. if daemonPlatform == "windows" {
  395. // Windows requires that the source directory exists before calling HCS
  396. testRequires(c, SameHostDaemon)
  397. someplace = `:c:\someplace`
  398. if err := os.MkdirAll(path1, 0755); err != nil {
  399. c.Fatalf("Failed to create %s: %q", path1, err)
  400. }
  401. defer os.RemoveAll(path1)
  402. if err := os.MkdirAll(path2, 0755); err != nil {
  403. c.Fatalf("Failed to create %s: %q", path1, err)
  404. }
  405. defer os.RemoveAll(path2)
  406. }
  407. mountstr1 := path1 + someplace
  408. mountstr2 := path2 + someplace
  409. if out, _, err := dockerCmdWithError("run", "-v", mountstr1, "-v", mountstr2, "busybox", "true"); err == nil {
  410. c.Fatal("Expected error about duplicate mount definitions")
  411. } else {
  412. if !strings.Contains(out, "Duplicate mount point") {
  413. c.Fatalf("Expected 'duplicate mount point' error, got %v", out)
  414. }
  415. }
  416. }
  417. // Test for #1351
  418. func (s *DockerSuite) TestRunApplyVolumesFromBeforeVolumes(c *check.C) {
  419. prefix := ""
  420. if daemonPlatform == "windows" {
  421. prefix = `c:`
  422. }
  423. dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
  424. dockerCmd(c, "run", "--volumes-from", "parent", "-v", prefix+"/test", "busybox", "cat", prefix+"/test/foo")
  425. }
  426. func (s *DockerSuite) TestRunMultipleVolumesFrom(c *check.C) {
  427. prefix := ""
  428. if daemonPlatform == "windows" {
  429. prefix = `c:`
  430. }
  431. dockerCmd(c, "run", "--name", "parent1", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
  432. dockerCmd(c, "run", "--name", "parent2", "-v", prefix+"/other", "busybox", "touch", prefix+"/other/bar")
  433. dockerCmd(c, "run", "--volumes-from", "parent1", "--volumes-from", "parent2", "busybox", "sh", "-c", "cat /test/foo && cat /other/bar")
  434. }
  435. // this tests verifies the ID format for the container
  436. func (s *DockerSuite) TestRunVerifyContainerID(c *check.C) {
  437. out, exit, err := dockerCmdWithError("run", "-d", "busybox", "true")
  438. if err != nil {
  439. c.Fatal(err)
  440. }
  441. if exit != 0 {
  442. c.Fatalf("expected exit code 0 received %d", exit)
  443. }
  444. match, err := regexp.MatchString("^[0-9a-f]{64}$", strings.TrimSuffix(out, "\n"))
  445. if err != nil {
  446. c.Fatal(err)
  447. }
  448. if !match {
  449. c.Fatalf("Invalid container ID: %s", out)
  450. }
  451. }
  452. // Test that creating a container with a volume doesn't crash. Regression test for #995.
  453. func (s *DockerSuite) TestRunCreateVolume(c *check.C) {
  454. prefix := ""
  455. if daemonPlatform == "windows" {
  456. prefix = `c:`
  457. }
  458. dockerCmd(c, "run", "-v", prefix+"/var/lib/data", "busybox", "true")
  459. }
  460. // Test that creating a volume with a symlink in its path works correctly. Test for #5152.
  461. // Note that this bug happens only with symlinks with a target that starts with '/'.
  462. func (s *DockerSuite) TestRunCreateVolumeWithSymlink(c *check.C) {
  463. // Cannot run on Windows as relies on Linux-specific functionality (sh -c mount...)
  464. testRequires(c, DaemonIsLinux)
  465. image := "docker-test-createvolumewithsymlink"
  466. buildCmd := exec.Command(dockerBinary, "build", "-t", image, "-")
  467. buildCmd.Stdin = strings.NewReader(`FROM busybox
  468. RUN ln -s home /bar`)
  469. buildCmd.Dir = workingDirectory
  470. err := buildCmd.Run()
  471. if err != nil {
  472. c.Fatalf("could not build '%s': %v", image, err)
  473. }
  474. _, exitCode, err := dockerCmdWithError("run", "-v", "/bar/foo", "--name", "test-createvolumewithsymlink", image, "sh", "-c", "mount | grep -q /home/foo")
  475. if err != nil || exitCode != 0 {
  476. c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)
  477. }
  478. volPath, err := inspectMountSourceField("test-createvolumewithsymlink", "/bar/foo")
  479. if err != nil {
  480. c.Fatalf("[inspect] err: %v", err)
  481. }
  482. _, exitCode, err = dockerCmdWithError("rm", "-v", "test-createvolumewithsymlink")
  483. if err != nil || exitCode != 0 {
  484. c.Fatalf("[rm] err: %v, exitcode: %d", err, exitCode)
  485. }
  486. _, err = os.Stat(volPath)
  487. if !os.IsNotExist(err) {
  488. c.Fatalf("[open] (expecting 'file does not exist' error) err: %v, volPath: %s", err, volPath)
  489. }
  490. }
  491. // Tests that a volume path that has a symlink exists in a container mounting it with `--volumes-from`.
  492. func (s *DockerSuite) TestRunVolumesFromSymlinkPath(c *check.C) {
  493. name := "docker-test-volumesfromsymlinkpath"
  494. prefix := ""
  495. dfContents := `FROM busybox
  496. RUN ln -s home /foo
  497. VOLUME ["/foo/bar"]`
  498. if daemonPlatform == "windows" {
  499. prefix = `c:`
  500. dfContents = `FROM ` + WindowsBaseImage + `
  501. RUN mkdir c:\home
  502. RUN mklink /D c:\foo c:\home
  503. VOLUME ["c:/foo/bar"]
  504. ENTRYPOINT c:\windows\system32\cmd.exe`
  505. }
  506. buildCmd := exec.Command(dockerBinary, "build", "-t", name, "-")
  507. buildCmd.Stdin = strings.NewReader(dfContents)
  508. buildCmd.Dir = workingDirectory
  509. err := buildCmd.Run()
  510. if err != nil {
  511. c.Fatalf("could not build 'docker-test-volumesfromsymlinkpath': %v", err)
  512. }
  513. out, exitCode, err := dockerCmdWithError("run", "--name", "test-volumesfromsymlinkpath", name)
  514. if err != nil || exitCode != 0 {
  515. c.Fatalf("[run] (volume) err: %v, exitcode: %d, out: %s", err, exitCode, out)
  516. }
  517. _, exitCode, err = dockerCmdWithError("run", "--volumes-from", "test-volumesfromsymlinkpath", "busybox", "sh", "-c", "ls "+prefix+"/foo | grep -q bar")
  518. if err != nil || exitCode != 0 {
  519. c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)
  520. }
  521. }
  522. func (s *DockerSuite) TestRunExitCode(c *check.C) {
  523. var (
  524. exit int
  525. err error
  526. )
  527. _, exit, err = dockerCmdWithError("run", "busybox", "/bin/sh", "-c", "exit 72")
  528. if err == nil {
  529. c.Fatal("should not have a non nil error")
  530. }
  531. if exit != 72 {
  532. c.Fatalf("expected exit code 72 received %d", exit)
  533. }
  534. }
  535. func (s *DockerSuite) TestRunUserDefaults(c *check.C) {
  536. expected := "uid=0(root) gid=0(root)"
  537. if daemonPlatform == "windows" {
  538. expected = "uid=1000(SYSTEM) gid=1000(SYSTEM)"
  539. }
  540. out, _ := dockerCmd(c, "run", "busybox", "id")
  541. if !strings.Contains(out, expected) {
  542. c.Fatalf("expected '%s' got %s", expected, out)
  543. }
  544. }
  545. func (s *DockerSuite) TestRunUserByName(c *check.C) {
  546. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  547. // not support the use of -u
  548. testRequires(c, DaemonIsLinux)
  549. out, _ := dockerCmd(c, "run", "-u", "root", "busybox", "id")
  550. if !strings.Contains(out, "uid=0(root) gid=0(root)") {
  551. c.Fatalf("expected root user got %s", out)
  552. }
  553. }
  554. func (s *DockerSuite) TestRunUserByID(c *check.C) {
  555. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  556. // not support the use of -u
  557. testRequires(c, DaemonIsLinux)
  558. out, _ := dockerCmd(c, "run", "-u", "1", "busybox", "id")
  559. if !strings.Contains(out, "uid=1(daemon) gid=1(daemon)") {
  560. c.Fatalf("expected daemon user got %s", out)
  561. }
  562. }
  563. func (s *DockerSuite) TestRunUserByIDBig(c *check.C) {
  564. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  565. // not support the use of -u
  566. testRequires(c, DaemonIsLinux, NotArm)
  567. out, _, err := dockerCmdWithError("run", "-u", "2147483648", "busybox", "id")
  568. if err == nil {
  569. c.Fatal("No error, but must be.", out)
  570. }
  571. if !strings.Contains(out, "Uids and gids must be in range") {
  572. c.Fatalf("expected error about uids range, got %s", out)
  573. }
  574. }
  575. func (s *DockerSuite) TestRunUserByIDNegative(c *check.C) {
  576. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  577. // not support the use of -u
  578. testRequires(c, DaemonIsLinux)
  579. out, _, err := dockerCmdWithError("run", "-u", "-1", "busybox", "id")
  580. if err == nil {
  581. c.Fatal("No error, but must be.", out)
  582. }
  583. if !strings.Contains(out, "Uids and gids must be in range") {
  584. c.Fatalf("expected error about uids range, got %s", out)
  585. }
  586. }
  587. func (s *DockerSuite) TestRunUserByIDZero(c *check.C) {
  588. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  589. // not support the use of -u
  590. testRequires(c, DaemonIsLinux)
  591. out, _, err := dockerCmdWithError("run", "-u", "0", "busybox", "id")
  592. if err != nil {
  593. c.Fatal(err, out)
  594. }
  595. if !strings.Contains(out, "uid=0(root) gid=0(root) groups=10(wheel)") {
  596. c.Fatalf("expected daemon user got %s", out)
  597. }
  598. }
  599. func (s *DockerSuite) TestRunUserNotFound(c *check.C) {
  600. // TODO Windows: This test cannot run on a Windows daemon as Windows does
  601. // not support the use of -u
  602. testRequires(c, DaemonIsLinux)
  603. _, _, err := dockerCmdWithError("run", "-u", "notme", "busybox", "id")
  604. if err == nil {
  605. c.Fatal("unknown user should cause container to fail")
  606. }
  607. }
  608. func (s *DockerSuite) TestRunTwoConcurrentContainers(c *check.C) {
  609. // TODO Windows. There are two bugs in TP4 which means this test cannot
  610. // be reliably enabled. The first is a race condition where sometimes
  611. // HCS CreateComputeSystem() will fail "Invalid class string". #4985252 and
  612. // #4493430.
  613. //
  614. // The second, which is seen more readily by increasing the number of concurrent
  615. // containers to 5 or more, is that CSRSS hangs. This may fixed in the TP4 ZDP.
  616. // #4898773.
  617. testRequires(c, DaemonIsLinux)
  618. sleepTime := "2"
  619. if daemonPlatform == "windows" {
  620. sleepTime = "5" // Make more reliable on Windows
  621. }
  622. group := sync.WaitGroup{}
  623. group.Add(2)
  624. errChan := make(chan error, 2)
  625. for i := 0; i < 2; i++ {
  626. go func() {
  627. defer group.Done()
  628. _, _, err := dockerCmdWithError("run", "busybox", "sleep", sleepTime)
  629. errChan <- err
  630. }()
  631. }
  632. group.Wait()
  633. close(errChan)
  634. for err := range errChan {
  635. c.Assert(err, check.IsNil)
  636. }
  637. }
  638. func (s *DockerSuite) TestRunEnvironment(c *check.C) {
  639. // TODO Windows: Environment handling is different between Linux and
  640. // Windows and this test relies currently on unix functionality.
  641. testRequires(c, DaemonIsLinux)
  642. cmd := exec.Command(dockerBinary, "run", "-h", "testing", "-e=FALSE=true", "-e=TRUE", "-e=TRICKY", "-e=HOME=", "busybox", "env")
  643. cmd.Env = append(os.Environ(),
  644. "TRUE=false",
  645. "TRICKY=tri\ncky\n",
  646. )
  647. out, _, err := runCommandWithOutput(cmd)
  648. if err != nil {
  649. c.Fatal(err, out)
  650. }
  651. actualEnv := strings.Split(strings.TrimSpace(out), "\n")
  652. sort.Strings(actualEnv)
  653. goodEnv := []string{
  654. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  655. "HOSTNAME=testing",
  656. "FALSE=true",
  657. "TRUE=false",
  658. "TRICKY=tri",
  659. "cky",
  660. "",
  661. "HOME=/root",
  662. }
  663. sort.Strings(goodEnv)
  664. if len(goodEnv) != len(actualEnv) {
  665. c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))
  666. }
  667. for i := range goodEnv {
  668. if actualEnv[i] != goodEnv[i] {
  669. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  670. }
  671. }
  672. }
  673. func (s *DockerSuite) TestRunEnvironmentErase(c *check.C) {
  674. // TODO Windows: Environment handling is different between Linux and
  675. // Windows and this test relies currently on unix functionality.
  676. testRequires(c, DaemonIsLinux)
  677. // Test to make sure that when we use -e on env vars that are
  678. // not set in our local env that they're removed (if present) in
  679. // the container
  680. cmd := exec.Command(dockerBinary, "run", "-e", "FOO", "-e", "HOSTNAME", "busybox", "env")
  681. cmd.Env = appendBaseEnv([]string{})
  682. out, _, err := runCommandWithOutput(cmd)
  683. if err != nil {
  684. c.Fatal(err, out)
  685. }
  686. actualEnv := strings.Split(strings.TrimSpace(out), "\n")
  687. sort.Strings(actualEnv)
  688. goodEnv := []string{
  689. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  690. "HOME=/root",
  691. }
  692. sort.Strings(goodEnv)
  693. if len(goodEnv) != len(actualEnv) {
  694. c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))
  695. }
  696. for i := range goodEnv {
  697. if actualEnv[i] != goodEnv[i] {
  698. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  699. }
  700. }
  701. }
  702. func (s *DockerSuite) TestRunEnvironmentOverride(c *check.C) {
  703. // TODO Windows: Environment handling is different between Linux and
  704. // Windows and this test relies currently on unix functionality.
  705. testRequires(c, DaemonIsLinux)
  706. // Test to make sure that when we use -e on env vars that are
  707. // already in the env that we're overriding them
  708. cmd := exec.Command(dockerBinary, "run", "-e", "HOSTNAME", "-e", "HOME=/root2", "busybox", "env")
  709. cmd.Env = appendBaseEnv([]string{"HOSTNAME=bar"})
  710. out, _, err := runCommandWithOutput(cmd)
  711. if err != nil {
  712. c.Fatal(err, out)
  713. }
  714. actualEnv := strings.Split(strings.TrimSpace(out), "\n")
  715. sort.Strings(actualEnv)
  716. goodEnv := []string{
  717. "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
  718. "HOME=/root2",
  719. "HOSTNAME=bar",
  720. }
  721. sort.Strings(goodEnv)
  722. if len(goodEnv) != len(actualEnv) {
  723. c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))
  724. }
  725. for i := range goodEnv {
  726. if actualEnv[i] != goodEnv[i] {
  727. c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])
  728. }
  729. }
  730. }
  731. func (s *DockerSuite) TestRunContainerNetwork(c *check.C) {
  732. if daemonPlatform == "windows" {
  733. // Windows busybox does not have ping. Use built in ping instead.
  734. dockerCmd(c, "run", WindowsBaseImage, "ping", "-n", "1", "127.0.0.1")
  735. } else {
  736. dockerCmd(c, "run", "busybox", "ping", "-c", "1", "127.0.0.1")
  737. }
  738. }
  739. func (s *DockerSuite) TestRunNetHostNotAllowedWithLinks(c *check.C) {
  740. // TODO Windows: This is Linux specific as --link is not supported and
  741. // this will be deprecated in favor of container networking model.
  742. testRequires(c, DaemonIsLinux, NotUserNamespace)
  743. dockerCmd(c, "run", "--name", "linked", "busybox", "true")
  744. _, _, err := dockerCmdWithError("run", "--net=host", "--link", "linked:linked", "busybox", "true")
  745. if err == nil {
  746. c.Fatal("Expected error")
  747. }
  748. }
  749. // #7851 hostname outside container shows FQDN, inside only shortname
  750. // For testing purposes it is not required to set host's hostname directly
  751. // and use "--net=host" (as the original issue submitter did), as the same
  752. // codepath is executed with "docker run -h <hostname>". Both were manually
  753. // tested, but this testcase takes the simpler path of using "run -h .."
  754. func (s *DockerSuite) TestRunFullHostnameSet(c *check.C) {
  755. // TODO Windows: -h is not yet functional.
  756. testRequires(c, DaemonIsLinux)
  757. out, _ := dockerCmd(c, "run", "-h", "foo.bar.baz", "busybox", "hostname")
  758. if actual := strings.Trim(out, "\r\n"); actual != "foo.bar.baz" {
  759. c.Fatalf("expected hostname 'foo.bar.baz', received %s", actual)
  760. }
  761. }
  762. func (s *DockerSuite) TestRunPrivilegedCanMknod(c *check.C) {
  763. // Not applicable for Windows as Windows daemon does not support
  764. // the concept of --privileged, and mknod is a Unix concept.
  765. testRequires(c, DaemonIsLinux, NotUserNamespace)
  766. out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  767. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  768. c.Fatalf("expected output ok received %s", actual)
  769. }
  770. }
  771. func (s *DockerSuite) TestRunUnprivilegedCanMknod(c *check.C) {
  772. // Not applicable for Windows as Windows daemon does not support
  773. // the concept of --privileged, and mknod is a Unix concept.
  774. testRequires(c, DaemonIsLinux, NotUserNamespace)
  775. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  776. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  777. c.Fatalf("expected output ok received %s", actual)
  778. }
  779. }
  780. func (s *DockerSuite) TestRunCapDropInvalid(c *check.C) {
  781. // Not applicable for Windows as there is no concept of --cap-drop
  782. testRequires(c, DaemonIsLinux)
  783. out, _, err := dockerCmdWithError("run", "--cap-drop=CHPASS", "busybox", "ls")
  784. if err == nil {
  785. c.Fatal(err, out)
  786. }
  787. }
  788. func (s *DockerSuite) TestRunCapDropCannotMknod(c *check.C) {
  789. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  790. testRequires(c, DaemonIsLinux)
  791. out, _, err := dockerCmdWithError("run", "--cap-drop=MKNOD", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  792. if err == nil {
  793. c.Fatal(err, out)
  794. }
  795. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  796. c.Fatalf("expected output not ok received %s", actual)
  797. }
  798. }
  799. func (s *DockerSuite) TestRunCapDropCannotMknodLowerCase(c *check.C) {
  800. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  801. testRequires(c, DaemonIsLinux)
  802. out, _, err := dockerCmdWithError("run", "--cap-drop=mknod", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  803. if err == nil {
  804. c.Fatal(err, out)
  805. }
  806. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  807. c.Fatalf("expected output not ok received %s", actual)
  808. }
  809. }
  810. func (s *DockerSuite) TestRunCapDropALLCannotMknod(c *check.C) {
  811. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  812. testRequires(c, DaemonIsLinux)
  813. out, _, err := dockerCmdWithError("run", "--cap-drop=ALL", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  814. if err == nil {
  815. c.Fatal(err, out)
  816. }
  817. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  818. c.Fatalf("expected output not ok received %s", actual)
  819. }
  820. }
  821. func (s *DockerSuite) TestRunCapDropALLAddMknodCanMknod(c *check.C) {
  822. // Not applicable for Windows as there is no concept of --cap-drop or mknod
  823. testRequires(c, DaemonIsLinux, NotUserNamespace)
  824. out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=MKNOD", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")
  825. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  826. c.Fatalf("expected output ok received %s", actual)
  827. }
  828. }
  829. func (s *DockerSuite) TestRunCapAddInvalid(c *check.C) {
  830. // Not applicable for Windows as there is no concept of --cap-add
  831. testRequires(c, DaemonIsLinux)
  832. out, _, err := dockerCmdWithError("run", "--cap-add=CHPASS", "busybox", "ls")
  833. if err == nil {
  834. c.Fatal(err, out)
  835. }
  836. }
  837. func (s *DockerSuite) TestRunCapAddCanDownInterface(c *check.C) {
  838. // Not applicable for Windows as there is no concept of --cap-add
  839. testRequires(c, DaemonIsLinux)
  840. out, _ := dockerCmd(c, "run", "--cap-add=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  841. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  842. c.Fatalf("expected output ok received %s", actual)
  843. }
  844. }
  845. func (s *DockerSuite) TestRunCapAddALLCanDownInterface(c *check.C) {
  846. // Not applicable for Windows as there is no concept of --cap-add
  847. testRequires(c, DaemonIsLinux)
  848. out, _ := dockerCmd(c, "run", "--cap-add=ALL", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  849. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  850. c.Fatalf("expected output ok received %s", actual)
  851. }
  852. }
  853. func (s *DockerSuite) TestRunCapAddALLDropNetAdminCanDownInterface(c *check.C) {
  854. // Not applicable for Windows as there is no concept of --cap-add
  855. testRequires(c, DaemonIsLinux)
  856. out, _, err := dockerCmdWithError("run", "--cap-add=ALL", "--cap-drop=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")
  857. if err == nil {
  858. c.Fatal(err, out)
  859. }
  860. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  861. c.Fatalf("expected output not ok received %s", actual)
  862. }
  863. }
  864. func (s *DockerSuite) TestRunGroupAdd(c *check.C) {
  865. // Not applicable for Windows as there is no concept of --group-add
  866. testRequires(c, DaemonIsLinux)
  867. out, _ := dockerCmd(c, "run", "--group-add=audio", "--group-add=staff", "--group-add=777", "busybox", "sh", "-c", "id")
  868. groupsList := "uid=0(root) gid=0(root) groups=10(wheel),29(audio),50(staff),777"
  869. if actual := strings.Trim(out, "\r\n"); actual != groupsList {
  870. c.Fatalf("expected output %s received %s", groupsList, actual)
  871. }
  872. }
  873. func (s *DockerSuite) TestRunPrivilegedCanMount(c *check.C) {
  874. // Not applicable for Windows as there is no concept of --privileged
  875. testRequires(c, DaemonIsLinux, NotUserNamespace)
  876. out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")
  877. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  878. c.Fatalf("expected output ok received %s", actual)
  879. }
  880. }
  881. func (s *DockerSuite) TestRunUnprivilegedCannotMount(c *check.C) {
  882. // Not applicable for Windows as there is no concept of unprivileged
  883. testRequires(c, DaemonIsLinux)
  884. out, _, err := dockerCmdWithError("run", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")
  885. if err == nil {
  886. c.Fatal(err, out)
  887. }
  888. if actual := strings.Trim(out, "\r\n"); actual == "ok" {
  889. c.Fatalf("expected output not ok received %s", actual)
  890. }
  891. }
  892. func (s *DockerSuite) TestRunSysNotWritableInNonPrivilegedContainers(c *check.C) {
  893. // Not applicable for Windows as there is no concept of unprivileged
  894. testRequires(c, DaemonIsLinux, NotArm)
  895. if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/sys/kernel/profiling"); err == nil || code == 0 {
  896. c.Fatal("sys should not be writable in a non privileged container")
  897. }
  898. }
  899. func (s *DockerSuite) TestRunSysWritableInPrivilegedContainers(c *check.C) {
  900. // Not applicable for Windows as there is no concept of unprivileged
  901. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  902. if _, code, err := dockerCmdWithError("run", "--privileged", "busybox", "touch", "/sys/kernel/profiling"); err != nil || code != 0 {
  903. c.Fatalf("sys should be writable in privileged container")
  904. }
  905. }
  906. func (s *DockerSuite) TestRunProcNotWritableInNonPrivilegedContainers(c *check.C) {
  907. // Not applicable for Windows as there is no concept of unprivileged
  908. testRequires(c, DaemonIsLinux)
  909. if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/proc/sysrq-trigger"); err == nil || code == 0 {
  910. c.Fatal("proc should not be writable in a non privileged container")
  911. }
  912. }
  913. func (s *DockerSuite) TestRunProcWritableInPrivilegedContainers(c *check.C) {
  914. // Not applicable for Windows as there is no concept of --privileged
  915. testRequires(c, DaemonIsLinux, NotUserNamespace)
  916. if _, code := dockerCmd(c, "run", "--privileged", "busybox", "touch", "/proc/sysrq-trigger"); code != 0 {
  917. c.Fatalf("proc should be writable in privileged container")
  918. }
  919. }
  920. func (s *DockerSuite) TestRunDeviceNumbers(c *check.C) {
  921. // Not applicable on Windows as /dev/ is a Unix specific concept
  922. // TODO: NotUserNamespace could be removed here if "root" "root" is replaced w user
  923. testRequires(c, DaemonIsLinux, NotUserNamespace)
  924. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "ls -l /dev/null")
  925. deviceLineFields := strings.Fields(out)
  926. deviceLineFields[6] = ""
  927. deviceLineFields[7] = ""
  928. deviceLineFields[8] = ""
  929. expected := []string{"crw-rw-rw-", "1", "root", "root", "1,", "3", "", "", "", "/dev/null"}
  930. if !(reflect.DeepEqual(deviceLineFields, expected)) {
  931. c.Fatalf("expected output\ncrw-rw-rw- 1 root root 1, 3 May 24 13:29 /dev/null\n received\n %s\n", out)
  932. }
  933. }
  934. func (s *DockerSuite) TestRunThatCharacterDevicesActLikeCharacterDevices(c *check.C) {
  935. // Not applicable on Windows as /dev/ is a Unix specific concept
  936. testRequires(c, DaemonIsLinux)
  937. out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "dd if=/dev/zero of=/zero bs=1k count=5 2> /dev/null ; du -h /zero")
  938. if actual := strings.Trim(out, "\r\n"); actual[0] == '0' {
  939. c.Fatalf("expected a new file called /zero to be create that is greater than 0 bytes long, but du says: %s", actual)
  940. }
  941. }
  942. func (s *DockerSuite) TestRunUnprivilegedWithChroot(c *check.C) {
  943. // Not applicable on Windows as it does not support chroot
  944. testRequires(c, DaemonIsLinux)
  945. dockerCmd(c, "run", "busybox", "chroot", "/", "true")
  946. }
  947. func (s *DockerSuite) TestRunAddingOptionalDevices(c *check.C) {
  948. // Not applicable on Windows as Windows does not support --device
  949. testRequires(c, DaemonIsLinux, NotUserNamespace)
  950. out, _ := dockerCmd(c, "run", "--device", "/dev/zero:/dev/nulo", "busybox", "sh", "-c", "ls /dev/nulo")
  951. if actual := strings.Trim(out, "\r\n"); actual != "/dev/nulo" {
  952. c.Fatalf("expected output /dev/nulo, received %s", actual)
  953. }
  954. }
  955. func (s *DockerSuite) TestRunAddingOptionalDevicesNoSrc(c *check.C) {
  956. // Not applicable on Windows as Windows does not support --device
  957. testRequires(c, DaemonIsLinux, NotUserNamespace)
  958. out, _ := dockerCmd(c, "run", "--device", "/dev/zero:rw", "busybox", "sh", "-c", "ls /dev/zero")
  959. if actual := strings.Trim(out, "\r\n"); actual != "/dev/zero" {
  960. c.Fatalf("expected output /dev/zero, received %s", actual)
  961. }
  962. }
  963. func (s *DockerSuite) TestRunAddingOptionalDevicesInvalidMode(c *check.C) {
  964. // Not applicable on Windows as Windows does not support --device
  965. testRequires(c, DaemonIsLinux, NotUserNamespace)
  966. _, _, err := dockerCmdWithError("run", "--device", "/dev/zero:ro", "busybox", "sh", "-c", "ls /dev/zero")
  967. if err == nil {
  968. c.Fatalf("run container with device mode ro should fail")
  969. }
  970. }
  971. func (s *DockerSuite) TestRunModeHostname(c *check.C) {
  972. // Not applicable on Windows as Windows does not support -h
  973. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  974. out, _ := dockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname")
  975. if actual := strings.Trim(out, "\r\n"); actual != "testhostname" {
  976. c.Fatalf("expected 'testhostname', but says: %q", actual)
  977. }
  978. out, _ = dockerCmd(c, "run", "--net=host", "busybox", "cat", "/etc/hostname")
  979. hostname, err := os.Hostname()
  980. if err != nil {
  981. c.Fatal(err)
  982. }
  983. if actual := strings.Trim(out, "\r\n"); actual != hostname {
  984. c.Fatalf("expected %q, but says: %q", hostname, actual)
  985. }
  986. }
  987. func (s *DockerSuite) TestRunRootWorkdir(c *check.C) {
  988. out, _ := dockerCmd(c, "run", "--workdir", "/", "busybox", "pwd")
  989. expected := "/\n"
  990. if daemonPlatform == "windows" {
  991. expected = "C:" + expected
  992. }
  993. if out != expected {
  994. c.Fatalf("pwd returned %q (expected %s)", s, expected)
  995. }
  996. }
  997. func (s *DockerSuite) TestRunAllowBindMountingRoot(c *check.C) {
  998. if daemonPlatform == "windows" {
  999. // Windows busybox will fail with Permission Denied on items such as pagefile.sys
  1000. dockerCmd(c, "run", "-v", `c:\:c:\host`, WindowsBaseImage, "cmd", "-c", "dir", `c:\host`)
  1001. } else {
  1002. dockerCmd(c, "run", "-v", "/:/host", "busybox", "ls", "/host")
  1003. }
  1004. }
  1005. func (s *DockerSuite) TestRunDisallowBindMountingRootToRoot(c *check.C) {
  1006. mount := "/:/"
  1007. targetDir := "/host"
  1008. if daemonPlatform == "windows" {
  1009. mount = `c:\:c\`
  1010. targetDir = "c:/host" // Forward slash as using busybox
  1011. }
  1012. out, _, err := dockerCmdWithError("run", "-v", mount, "busybox", "ls", targetDir)
  1013. if err == nil {
  1014. c.Fatal(out, err)
  1015. }
  1016. }
  1017. // Verify that a container gets default DNS when only localhost resolvers exist
  1018. func (s *DockerSuite) TestRunDnsDefaultOptions(c *check.C) {
  1019. // Not applicable on Windows as this is testing Unix specific functionality
  1020. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1021. // preserve original resolv.conf for restoring after test
  1022. origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1023. if os.IsNotExist(err) {
  1024. c.Fatalf("/etc/resolv.conf does not exist")
  1025. }
  1026. // defer restored original conf
  1027. defer func() {
  1028. if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
  1029. c.Fatal(err)
  1030. }
  1031. }()
  1032. // test 3 cases: standard IPv4 localhost, commented out localhost, and IPv6 localhost
  1033. // 2 are removed from the file at container start, and the 3rd (commented out) one is ignored by
  1034. // GetNameservers(), leading to a replacement of nameservers with the default set
  1035. tmpResolvConf := []byte("nameserver 127.0.0.1\n#nameserver 127.0.2.1\nnameserver ::1")
  1036. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1037. c.Fatal(err)
  1038. }
  1039. actual, _ := dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
  1040. // check that the actual defaults are appended to the commented out
  1041. // localhost resolver (which should be preserved)
  1042. // NOTE: if we ever change the defaults from google dns, this will break
  1043. expected := "#nameserver 127.0.2.1\n\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"
  1044. if actual != expected {
  1045. c.Fatalf("expected resolv.conf be: %q, but was: %q", expected, actual)
  1046. }
  1047. }
  1048. func (s *DockerSuite) TestRunDnsOptions(c *check.C) {
  1049. // Not applicable on Windows as Windows does not support --dns*, or
  1050. // the Unix-specific functionality of resolv.conf.
  1051. testRequires(c, DaemonIsLinux)
  1052. out, stderr, _ := dockerCmdWithStdoutStderr(c, "run", "--dns=127.0.0.1", "--dns-search=mydomain", "--dns-opt=ndots:9", "busybox", "cat", "/etc/resolv.conf")
  1053. // The client will get a warning on stderr when setting DNS to a localhost address; verify this:
  1054. if !strings.Contains(stderr, "Localhost DNS setting") {
  1055. c.Fatalf("Expected warning on stderr about localhost resolver, but got %q", stderr)
  1056. }
  1057. actual := strings.Replace(strings.Trim(out, "\r\n"), "\n", " ", -1)
  1058. if actual != "search mydomain nameserver 127.0.0.1 options ndots:9" {
  1059. c.Fatalf("expected 'search mydomain nameserver 127.0.0.1 options ndots:9', but says: %q", actual)
  1060. }
  1061. out, stderr, _ = dockerCmdWithStdoutStderr(c, "run", "--dns=127.0.0.1", "--dns-search=.", "--dns-opt=ndots:3", "busybox", "cat", "/etc/resolv.conf")
  1062. actual = strings.Replace(strings.Trim(strings.Trim(out, "\r\n"), " "), "\n", " ", -1)
  1063. if actual != "nameserver 127.0.0.1 options ndots:3" {
  1064. c.Fatalf("expected 'nameserver 127.0.0.1 options ndots:3', but says: %q", actual)
  1065. }
  1066. }
  1067. func (s *DockerSuite) TestRunDnsRepeatOptions(c *check.C) {
  1068. testRequires(c, DaemonIsLinux)
  1069. out, _, _ := dockerCmdWithStdoutStderr(c, "run", "--dns=1.1.1.1", "--dns=2.2.2.2", "--dns-search=mydomain", "--dns-search=mydomain2", "--dns-opt=ndots:9", "--dns-opt=timeout:3", "busybox", "cat", "/etc/resolv.conf")
  1070. actual := strings.Replace(strings.Trim(out, "\r\n"), "\n", " ", -1)
  1071. if actual != "search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3" {
  1072. c.Fatalf("expected 'search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3', but says: %q", actual)
  1073. }
  1074. }
  1075. func (s *DockerSuite) TestRunDnsOptionsBasedOnHostResolvConf(c *check.C) {
  1076. // Not applicable on Windows as testing Unix specific functionality
  1077. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1078. origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1079. if os.IsNotExist(err) {
  1080. c.Fatalf("/etc/resolv.conf does not exist")
  1081. }
  1082. hostNamservers := resolvconf.GetNameservers(origResolvConf)
  1083. hostSearch := resolvconf.GetSearchDomains(origResolvConf)
  1084. var out string
  1085. out, _ = dockerCmd(c, "run", "--dns=127.0.0.1", "busybox", "cat", "/etc/resolv.conf")
  1086. if actualNameservers := resolvconf.GetNameservers([]byte(out)); string(actualNameservers[0]) != "127.0.0.1" {
  1087. c.Fatalf("expected '127.0.0.1', but says: %q", string(actualNameservers[0]))
  1088. }
  1089. actualSearch := resolvconf.GetSearchDomains([]byte(out))
  1090. if len(actualSearch) != len(hostSearch) {
  1091. c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))
  1092. }
  1093. for i := range actualSearch {
  1094. if actualSearch[i] != hostSearch[i] {
  1095. c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])
  1096. }
  1097. }
  1098. out, _ = dockerCmd(c, "run", "--dns-search=mydomain", "busybox", "cat", "/etc/resolv.conf")
  1099. actualNameservers := resolvconf.GetNameservers([]byte(out))
  1100. if len(actualNameservers) != len(hostNamservers) {
  1101. c.Fatalf("expected %q nameserver(s), but it has: %q", len(hostNamservers), len(actualNameservers))
  1102. }
  1103. for i := range actualNameservers {
  1104. if actualNameservers[i] != hostNamservers[i] {
  1105. c.Fatalf("expected %q nameserver, but says: %q", actualNameservers[i], hostNamservers[i])
  1106. }
  1107. }
  1108. if actualSearch = resolvconf.GetSearchDomains([]byte(out)); string(actualSearch[0]) != "mydomain" {
  1109. c.Fatalf("expected 'mydomain', but says: %q", string(actualSearch[0]))
  1110. }
  1111. // test with file
  1112. tmpResolvConf := []byte("search example.com\nnameserver 12.34.56.78\nnameserver 127.0.0.1")
  1113. if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {
  1114. c.Fatal(err)
  1115. }
  1116. // put the old resolvconf back
  1117. defer func() {
  1118. if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {
  1119. c.Fatal(err)
  1120. }
  1121. }()
  1122. resolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
  1123. if os.IsNotExist(err) {
  1124. c.Fatalf("/etc/resolv.conf does not exist")
  1125. }
  1126. hostNamservers = resolvconf.GetNameservers(resolvConf)
  1127. hostSearch = resolvconf.GetSearchDomains(resolvConf)
  1128. out, _ = dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")
  1129. if actualNameservers = resolvconf.GetNameservers([]byte(out)); string(actualNameservers[0]) != "12.34.56.78" || len(actualNameservers) != 1 {
  1130. c.Fatalf("expected '12.34.56.78', but has: %v", actualNameservers)
  1131. }
  1132. actualSearch = resolvconf.GetSearchDomains([]byte(out))
  1133. if len(actualSearch) != len(hostSearch) {
  1134. c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))
  1135. }
  1136. for i := range actualSearch {
  1137. if actualSearch[i] != hostSearch[i] {
  1138. c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])
  1139. }
  1140. }
  1141. }
  1142. // Test to see if a non-root user can resolve a DNS name. Also
  1143. // check if the container resolv.conf file has at least 0644 perm.
  1144. func (s *DockerSuite) TestRunNonRootUserResolvName(c *check.C) {
  1145. // Not applicable on Windows as Windows does not support --user
  1146. testRequires(c, SameHostDaemon, Network, DaemonIsLinux, NotArm)
  1147. dockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "apt.dockerproject.org")
  1148. cID, err := getIDByName("testperm")
  1149. if err != nil {
  1150. c.Fatal(err)
  1151. }
  1152. fmode := (os.FileMode)(0644)
  1153. finfo, err := os.Stat(containerStorageFile(cID, "resolv.conf"))
  1154. if err != nil {
  1155. c.Fatal(err)
  1156. }
  1157. if (finfo.Mode() & fmode) != fmode {
  1158. c.Fatalf("Expected container resolv.conf mode to be at least %s, instead got %s", fmode.String(), finfo.Mode().String())
  1159. }
  1160. }
  1161. // Test if container resolv.conf gets updated the next time it restarts
  1162. // if host /etc/resolv.conf has changed. This only applies if the container
  1163. // uses the host's /etc/resolv.conf and does not have any dns options provided.
  1164. func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {
  1165. // Not applicable on Windows as testing unix specific functionality
  1166. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1167. tmpResolvConf := []byte("search pommesfrites.fr\nnameserver 12.34.56.78\n")
  1168. tmpLocalhostResolvConf := []byte("nameserver 127.0.0.1")
  1169. //take a copy of resolv.conf for restoring after test completes
  1170. resolvConfSystem, err := ioutil.ReadFile("/etc/resolv.conf")
  1171. if err != nil {
  1172. c.Fatal(err)
  1173. }
  1174. // This test case is meant to test monitoring resolv.conf when it is
  1175. // a regular file not a bind mounc. So we unmount resolv.conf and replace
  1176. // it with a file containing the original settings.
  1177. cmd := exec.Command("umount", "/etc/resolv.conf")
  1178. if _, err = runCommand(cmd); err != nil {
  1179. c.Fatal(err)
  1180. }
  1181. //cleanup
  1182. defer func() {
  1183. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1184. c.Fatal(err)
  1185. }
  1186. }()
  1187. //1. test that a restarting container gets an updated resolv.conf
  1188. dockerCmd(c, "run", "--name='first'", "busybox", "true")
  1189. containerID1, err := getIDByName("first")
  1190. if err != nil {
  1191. c.Fatal(err)
  1192. }
  1193. // replace resolv.conf with our temporary copy
  1194. bytesResolvConf := []byte(tmpResolvConf)
  1195. if err := ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {
  1196. c.Fatal(err)
  1197. }
  1198. // start the container again to pickup changes
  1199. dockerCmd(c, "start", "first")
  1200. // check for update in container
  1201. containerResolv, err := readContainerFile(containerID1, "resolv.conf")
  1202. if err != nil {
  1203. c.Fatal(err)
  1204. }
  1205. if !bytes.Equal(containerResolv, bytesResolvConf) {
  1206. c.Fatalf("Restarted container does not have updated resolv.conf; expected %q, got %q", tmpResolvConf, string(containerResolv))
  1207. }
  1208. /* //make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
  1209. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1210. c.Fatal(err)
  1211. } */
  1212. //2. test that a restarting container does not receive resolv.conf updates
  1213. // if it modified the container copy of the starting point resolv.conf
  1214. dockerCmd(c, "run", "--name='second'", "busybox", "sh", "-c", "echo 'search mylittlepony.com' >>/etc/resolv.conf")
  1215. containerID2, err := getIDByName("second")
  1216. if err != nil {
  1217. c.Fatal(err)
  1218. }
  1219. //make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
  1220. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1221. c.Fatal(err)
  1222. }
  1223. // start the container again
  1224. dockerCmd(c, "start", "second")
  1225. // check for update in container
  1226. containerResolv, err = readContainerFile(containerID2, "resolv.conf")
  1227. if err != nil {
  1228. c.Fatal(err)
  1229. }
  1230. if bytes.Equal(containerResolv, resolvConfSystem) {
  1231. c.Fatalf("Container's resolv.conf should not have been updated with host resolv.conf: %q", string(containerResolv))
  1232. }
  1233. //3. test that a running container's resolv.conf is not modified while running
  1234. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  1235. runningContainerID := strings.TrimSpace(out)
  1236. // replace resolv.conf
  1237. if err := ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {
  1238. c.Fatal(err)
  1239. }
  1240. // check for update in container
  1241. containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")
  1242. if err != nil {
  1243. c.Fatal(err)
  1244. }
  1245. if bytes.Equal(containerResolv, bytesResolvConf) {
  1246. c.Fatalf("Running container should not have updated resolv.conf; expected %q, got %q", string(resolvConfSystem), string(containerResolv))
  1247. }
  1248. //4. test that a running container's resolv.conf is updated upon restart
  1249. // (the above container is still running..)
  1250. dockerCmd(c, "restart", runningContainerID)
  1251. // check for update in container
  1252. containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")
  1253. if err != nil {
  1254. c.Fatal(err)
  1255. }
  1256. if !bytes.Equal(containerResolv, bytesResolvConf) {
  1257. c.Fatalf("Restarted container should have updated resolv.conf; expected %q, got %q", string(bytesResolvConf), string(containerResolv))
  1258. }
  1259. //5. test that additions of a localhost resolver are cleaned from
  1260. // host resolv.conf before updating container's resolv.conf copies
  1261. // replace resolv.conf with a localhost-only nameserver copy
  1262. bytesResolvConf = []byte(tmpLocalhostResolvConf)
  1263. if err = ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {
  1264. c.Fatal(err)
  1265. }
  1266. // start the container again to pickup changes
  1267. dockerCmd(c, "start", "first")
  1268. // our first exited container ID should have been updated, but with default DNS
  1269. // after the cleanup of resolv.conf found only a localhost nameserver:
  1270. containerResolv, err = readContainerFile(containerID1, "resolv.conf")
  1271. if err != nil {
  1272. c.Fatal(err)
  1273. }
  1274. expected := "\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"
  1275. if !bytes.Equal(containerResolv, []byte(expected)) {
  1276. c.Fatalf("Container does not have cleaned/replaced DNS in resolv.conf; expected %q, got %q", expected, string(containerResolv))
  1277. }
  1278. //6. Test that replacing (as opposed to modifying) resolv.conf triggers an update
  1279. // of containers' resolv.conf.
  1280. // Restore the original resolv.conf
  1281. if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {
  1282. c.Fatal(err)
  1283. }
  1284. // Run the container so it picks up the old settings
  1285. dockerCmd(c, "run", "--name='third'", "busybox", "true")
  1286. containerID3, err := getIDByName("third")
  1287. if err != nil {
  1288. c.Fatal(err)
  1289. }
  1290. // Create a modified resolv.conf.aside and override resolv.conf with it
  1291. bytesResolvConf = []byte(tmpResolvConf)
  1292. if err := ioutil.WriteFile("/etc/resolv.conf.aside", bytesResolvConf, 0644); err != nil {
  1293. c.Fatal(err)
  1294. }
  1295. err = os.Rename("/etc/resolv.conf.aside", "/etc/resolv.conf")
  1296. if err != nil {
  1297. c.Fatal(err)
  1298. }
  1299. // start the container again to pickup changes
  1300. dockerCmd(c, "start", "third")
  1301. // check for update in container
  1302. containerResolv, err = readContainerFile(containerID3, "resolv.conf")
  1303. if err != nil {
  1304. c.Fatal(err)
  1305. }
  1306. if !bytes.Equal(containerResolv, bytesResolvConf) {
  1307. c.Fatalf("Stopped container does not have updated resolv.conf; expected\n%q\n got\n%q", tmpResolvConf, string(containerResolv))
  1308. }
  1309. //cleanup, restore original resolv.conf happens in defer func()
  1310. }
  1311. func (s *DockerSuite) TestRunAddHost(c *check.C) {
  1312. // Not applicable on Windows as it does not support --add-host
  1313. testRequires(c, DaemonIsLinux)
  1314. out, _ := dockerCmd(c, "run", "--add-host=extra:86.75.30.9", "busybox", "grep", "extra", "/etc/hosts")
  1315. actual := strings.Trim(out, "\r\n")
  1316. if actual != "86.75.30.9\textra" {
  1317. c.Fatalf("expected '86.75.30.9\textra', but says: %q", actual)
  1318. }
  1319. }
  1320. // Regression test for #6983
  1321. func (s *DockerSuite) TestRunAttachStdErrOnlyTTYMode(c *check.C) {
  1322. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stderr", "busybox", "true")
  1323. if exitCode != 0 {
  1324. c.Fatalf("Container should have exited with error code 0")
  1325. }
  1326. }
  1327. // Regression test for #6983
  1328. func (s *DockerSuite) TestRunAttachStdOutOnlyTTYMode(c *check.C) {
  1329. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "busybox", "true")
  1330. if exitCode != 0 {
  1331. c.Fatalf("Container should have exited with error code 0")
  1332. }
  1333. }
  1334. // Regression test for #6983
  1335. func (s *DockerSuite) TestRunAttachStdOutAndErrTTYMode(c *check.C) {
  1336. _, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "-a", "stderr", "busybox", "true")
  1337. if exitCode != 0 {
  1338. c.Fatalf("Container should have exited with error code 0")
  1339. }
  1340. }
  1341. // Test for #10388 - this will run the same test as TestRunAttachStdOutAndErrTTYMode
  1342. // but using --attach instead of -a to make sure we read the flag correctly
  1343. func (s *DockerSuite) TestRunAttachWithDetach(c *check.C) {
  1344. cmd := exec.Command(dockerBinary, "run", "-d", "--attach", "stdout", "busybox", "true")
  1345. _, stderr, _, err := runCommandWithStdoutStderr(cmd)
  1346. if err == nil {
  1347. c.Fatal("Container should have exited with error code different than 0")
  1348. } else if !strings.Contains(stderr, "Conflicting options: -a and -d") {
  1349. c.Fatal("Should have been returned an error with conflicting options -a and -d")
  1350. }
  1351. }
  1352. func (s *DockerSuite) TestRunState(c *check.C) {
  1353. // TODO Windows: This needs some rework as Windows busybox does not support top
  1354. testRequires(c, DaemonIsLinux)
  1355. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  1356. id := strings.TrimSpace(out)
  1357. state, err := inspectField(id, "State.Running")
  1358. c.Assert(err, check.IsNil)
  1359. if state != "true" {
  1360. c.Fatal("Container state is 'not running'")
  1361. }
  1362. pid1, err := inspectField(id, "State.Pid")
  1363. c.Assert(err, check.IsNil)
  1364. if pid1 == "0" {
  1365. c.Fatal("Container state Pid 0")
  1366. }
  1367. dockerCmd(c, "stop", id)
  1368. state, err = inspectField(id, "State.Running")
  1369. c.Assert(err, check.IsNil)
  1370. if state != "false" {
  1371. c.Fatal("Container state is 'running'")
  1372. }
  1373. pid2, err := inspectField(id, "State.Pid")
  1374. c.Assert(err, check.IsNil)
  1375. if pid2 == pid1 {
  1376. c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)
  1377. }
  1378. dockerCmd(c, "start", id)
  1379. state, err = inspectField(id, "State.Running")
  1380. c.Assert(err, check.IsNil)
  1381. if state != "true" {
  1382. c.Fatal("Container state is 'not running'")
  1383. }
  1384. pid3, err := inspectField(id, "State.Pid")
  1385. c.Assert(err, check.IsNil)
  1386. if pid3 == pid1 {
  1387. c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)
  1388. }
  1389. }
  1390. // Test for #1737
  1391. func (s *DockerSuite) TestRunCopyVolumeUidGid(c *check.C) {
  1392. // Not applicable on Windows as it does not support uid or gid in this way
  1393. testRequires(c, DaemonIsLinux)
  1394. name := "testrunvolumesuidgid"
  1395. _, err := buildImage(name,
  1396. `FROM busybox
  1397. RUN echo 'dockerio:x:1001:1001::/bin:/bin/false' >> /etc/passwd
  1398. RUN echo 'dockerio:x:1001:' >> /etc/group
  1399. RUN mkdir -p /hello && touch /hello/test && chown dockerio.dockerio /hello`,
  1400. true)
  1401. if err != nil {
  1402. c.Fatal(err)
  1403. }
  1404. // Test that the uid and gid is copied from the image to the volume
  1405. out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "sh", "-c", "ls -l / | grep hello | awk '{print $3\":\"$4}'")
  1406. out = strings.TrimSpace(out)
  1407. if out != "dockerio:dockerio" {
  1408. c.Fatalf("Wrong /hello ownership: %s, expected dockerio:dockerio", out)
  1409. }
  1410. }
  1411. // Test for #1582
  1412. func (s *DockerSuite) TestRunCopyVolumeContent(c *check.C) {
  1413. // TODO Windows, post TP4. Windows does not yet support volume functionality
  1414. // that copies from the image to the volume.
  1415. testRequires(c, DaemonIsLinux)
  1416. name := "testruncopyvolumecontent"
  1417. _, err := buildImage(name,
  1418. `FROM busybox
  1419. RUN mkdir -p /hello/local && echo hello > /hello/local/world`,
  1420. true)
  1421. if err != nil {
  1422. c.Fatal(err)
  1423. }
  1424. // Test that the content is copied from the image to the volume
  1425. out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "find", "/hello")
  1426. if !(strings.Contains(out, "/hello/local/world") && strings.Contains(out, "/hello/local")) {
  1427. c.Fatal("Container failed to transfer content to volume")
  1428. }
  1429. }
  1430. func (s *DockerSuite) TestRunCleanupCmdOnEntrypoint(c *check.C) {
  1431. name := "testrunmdcleanuponentrypoint"
  1432. if _, err := buildImage(name,
  1433. `FROM busybox
  1434. ENTRYPOINT ["echo"]
  1435. CMD ["testingpoint"]`,
  1436. true); err != nil {
  1437. c.Fatal(err)
  1438. }
  1439. out, exit := dockerCmd(c, "run", "--entrypoint", "whoami", name)
  1440. if exit != 0 {
  1441. c.Fatalf("expected exit code 0 received %d, out: %q", exit, out)
  1442. }
  1443. out = strings.TrimSpace(out)
  1444. expected := "root"
  1445. if daemonPlatform == "windows" {
  1446. expected = `nt authority\system`
  1447. }
  1448. if out != expected {
  1449. c.Fatalf("Expected output %s, got %q", expected, out)
  1450. }
  1451. }
  1452. // TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected
  1453. func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {
  1454. existingFile := "/bin/cat"
  1455. expected := "Cannot mkdir: /bin/cat is not a directory"
  1456. if daemonPlatform == "windows" {
  1457. existingFile = `\windows\system32\ntdll.dll`
  1458. expected = "The directory name is invalid"
  1459. }
  1460. out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox")
  1461. if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) {
  1462. c.Fatalf("Docker must complains about making dir with exitCode 125 but we got out: %s, exitCode: %d", out, exitCode)
  1463. }
  1464. }
  1465. func (s *DockerSuite) TestRunExitOnStdinClose(c *check.C) {
  1466. name := "testrunexitonstdinclose"
  1467. meow := "/bin/cat"
  1468. delay := 1
  1469. if daemonPlatform == "windows" {
  1470. meow = "cat"
  1471. delay = 5
  1472. }
  1473. runCmd := exec.Command(dockerBinary, "run", "--name", name, "-i", "busybox", meow)
  1474. stdin, err := runCmd.StdinPipe()
  1475. if err != nil {
  1476. c.Fatal(err)
  1477. }
  1478. stdout, err := runCmd.StdoutPipe()
  1479. if err != nil {
  1480. c.Fatal(err)
  1481. }
  1482. if err := runCmd.Start(); err != nil {
  1483. c.Fatal(err)
  1484. }
  1485. if _, err := stdin.Write([]byte("hello\n")); err != nil {
  1486. c.Fatal(err)
  1487. }
  1488. r := bufio.NewReader(stdout)
  1489. line, err := r.ReadString('\n')
  1490. if err != nil {
  1491. c.Fatal(err)
  1492. }
  1493. line = strings.TrimSpace(line)
  1494. if line != "hello" {
  1495. c.Fatalf("Output should be 'hello', got '%q'", line)
  1496. }
  1497. if err := stdin.Close(); err != nil {
  1498. c.Fatal(err)
  1499. }
  1500. finish := make(chan error)
  1501. go func() {
  1502. finish <- runCmd.Wait()
  1503. close(finish)
  1504. }()
  1505. select {
  1506. case err := <-finish:
  1507. c.Assert(err, check.IsNil)
  1508. case <-time.After(time.Duration(delay) * time.Second):
  1509. c.Fatal("docker run failed to exit on stdin close")
  1510. }
  1511. state, err := inspectField(name, "State.Running")
  1512. c.Assert(err, check.IsNil)
  1513. if state != "false" {
  1514. c.Fatal("Container must be stopped after stdin closing")
  1515. }
  1516. }
  1517. // Test for #2267
  1518. func (s *DockerSuite) TestRunWriteHostsFileAndNotCommit(c *check.C) {
  1519. // Cannot run on Windows as Windows does not support diff.
  1520. testRequires(c, DaemonIsLinux)
  1521. name := "writehosts"
  1522. out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/hosts && cat /etc/hosts")
  1523. if !strings.Contains(out, "test2267") {
  1524. c.Fatal("/etc/hosts should contain 'test2267'")
  1525. }
  1526. out, _ = dockerCmd(c, "diff", name)
  1527. if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
  1528. c.Fatal("diff should be empty")
  1529. }
  1530. }
  1531. func eqToBaseDiff(out string, c *check.C) bool {
  1532. out1, _ := dockerCmd(c, "run", "-d", "busybox", "echo", "hello")
  1533. cID := strings.TrimSpace(out1)
  1534. baseDiff, _ := dockerCmd(c, "diff", cID)
  1535. baseArr := strings.Split(baseDiff, "\n")
  1536. sort.Strings(baseArr)
  1537. outArr := strings.Split(out, "\n")
  1538. sort.Strings(outArr)
  1539. return sliceEq(baseArr, outArr)
  1540. }
  1541. func sliceEq(a, b []string) bool {
  1542. if len(a) != len(b) {
  1543. return false
  1544. }
  1545. for i := range a {
  1546. if a[i] != b[i] {
  1547. return false
  1548. }
  1549. }
  1550. return true
  1551. }
  1552. // Test for #2267
  1553. func (s *DockerSuite) TestRunWriteHostnameFileAndNotCommit(c *check.C) {
  1554. // Cannot run on Windows as Windows does not support diff.
  1555. testRequires(c, DaemonIsLinux)
  1556. name := "writehostname"
  1557. out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/hostname && cat /etc/hostname")
  1558. if !strings.Contains(out, "test2267") {
  1559. c.Fatal("/etc/hostname should contain 'test2267'")
  1560. }
  1561. out, _ = dockerCmd(c, "diff", name)
  1562. if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
  1563. c.Fatal("diff should be empty")
  1564. }
  1565. }
  1566. // Test for #2267
  1567. func (s *DockerSuite) TestRunWriteResolvFileAndNotCommit(c *check.C) {
  1568. // Cannot run on Windows as Windows does not support diff.
  1569. testRequires(c, DaemonIsLinux)
  1570. name := "writeresolv"
  1571. out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/resolv.conf && cat /etc/resolv.conf")
  1572. if !strings.Contains(out, "test2267") {
  1573. c.Fatal("/etc/resolv.conf should contain 'test2267'")
  1574. }
  1575. out, _ = dockerCmd(c, "diff", name)
  1576. if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
  1577. c.Fatal("diff should be empty")
  1578. }
  1579. }
  1580. func (s *DockerSuite) TestRunWithBadDevice(c *check.C) {
  1581. // Cannot run on Windows as Windows does not support --device
  1582. testRequires(c, DaemonIsLinux)
  1583. name := "baddevice"
  1584. out, _, err := dockerCmdWithError("run", "--name", name, "--device", "/etc", "busybox", "true")
  1585. if err == nil {
  1586. c.Fatal("Run should fail with bad device")
  1587. }
  1588. expected := `"/etc": not a device node`
  1589. if !strings.Contains(out, expected) {
  1590. c.Fatalf("Output should contain %q, actual out: %q", expected, out)
  1591. }
  1592. }
  1593. func (s *DockerSuite) TestRunEntrypoint(c *check.C) {
  1594. name := "entrypoint"
  1595. // Note Windows does not have an echo.exe built in.
  1596. var out, expected string
  1597. if daemonPlatform == "windows" {
  1598. out, _ = dockerCmd(c, "run", "--name", name, "--entrypoint", "cmd /s /c echo", "busybox", "foobar")
  1599. expected = "foobar\r\n"
  1600. } else {
  1601. out, _ = dockerCmd(c, "run", "--name", name, "--entrypoint", "/bin/echo", "busybox", "-n", "foobar")
  1602. expected = "foobar"
  1603. }
  1604. if out != expected {
  1605. c.Fatalf("Output should be %q, actual out: %q", expected, out)
  1606. }
  1607. }
  1608. func (s *DockerSuite) TestRunBindMounts(c *check.C) {
  1609. testRequires(c, SameHostDaemon)
  1610. if daemonPlatform == "linux" {
  1611. testRequires(c, DaemonIsLinux, NotUserNamespace)
  1612. }
  1613. tmpDir, err := ioutil.TempDir("", "docker-test-container")
  1614. if err != nil {
  1615. c.Fatal(err)
  1616. }
  1617. defer os.RemoveAll(tmpDir)
  1618. writeFile(path.Join(tmpDir, "touch-me"), "", c)
  1619. // TODO Windows Post TP4. Windows does not yet support :ro binds
  1620. if daemonPlatform != "windows" {
  1621. // Test reading from a read-only bind mount
  1622. out, _ := dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox", "ls", "/tmp")
  1623. if !strings.Contains(out, "touch-me") {
  1624. c.Fatal("Container failed to read from bind mount")
  1625. }
  1626. }
  1627. // test writing to bind mount
  1628. if daemonPlatform == "windows" {
  1629. dockerCmd(c, "run", "-v", fmt.Sprintf(`%s:c:\tmp:rw`, tmpDir), "busybox", "touch", "c:/tmp/holla")
  1630. } else {
  1631. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:rw", tmpDir), "busybox", "touch", "/tmp/holla")
  1632. }
  1633. readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
  1634. // test mounting to an illegal destination directory
  1635. _, _, err = dockerCmdWithError("run", "-v", fmt.Sprintf("%s:.", tmpDir), "busybox", "ls", ".")
  1636. if err == nil {
  1637. c.Fatal("Container bind mounted illegal directory")
  1638. }
  1639. // Windows does not (and likely never will) support mounting a single file
  1640. if daemonPlatform != "windows" {
  1641. // test mount a file
  1642. dockerCmd(c, "run", "-v", fmt.Sprintf("%s/holla:/tmp/holla:rw", tmpDir), "busybox", "sh", "-c", "echo -n 'yotta' > /tmp/holla")
  1643. content := readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
  1644. expected := "yotta"
  1645. if content != expected {
  1646. c.Fatalf("Output should be %q, actual out: %q", expected, content)
  1647. }
  1648. }
  1649. }
  1650. // Ensure that CIDFile gets deleted if it's empty
  1651. // Perform this test by making `docker run` fail
  1652. func (s *DockerSuite) TestRunCidFileCleanupIfEmpty(c *check.C) {
  1653. tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
  1654. if err != nil {
  1655. c.Fatal(err)
  1656. }
  1657. defer os.RemoveAll(tmpDir)
  1658. tmpCidFile := path.Join(tmpDir, "cid")
  1659. image := "emptyfs"
  1660. if daemonPlatform == "windows" {
  1661. // Windows can't support an emptyfs image. Just use the regular Windows image
  1662. image = WindowsBaseImage
  1663. }
  1664. out, _, err := dockerCmdWithError("run", "--cidfile", tmpCidFile, image)
  1665. if err == nil {
  1666. c.Fatalf("Run without command must fail. out=%s", out)
  1667. } else if !strings.Contains(out, "No command specified") {
  1668. c.Fatalf("Run without command failed with wrong output. out=%s\nerr=%v", out, err)
  1669. }
  1670. if _, err := os.Stat(tmpCidFile); err == nil {
  1671. c.Fatalf("empty CIDFile %q should've been deleted", tmpCidFile)
  1672. }
  1673. }
  1674. // #2098 - Docker cidFiles only contain short version of the containerId
  1675. //sudo docker run --cidfile /tmp/docker_tesc.cid ubuntu echo "test"
  1676. // TestRunCidFile tests that run --cidfile returns the longid
  1677. func (s *DockerSuite) TestRunCidFileCheckIDLength(c *check.C) {
  1678. tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
  1679. if err != nil {
  1680. c.Fatal(err)
  1681. }
  1682. tmpCidFile := path.Join(tmpDir, "cid")
  1683. defer os.RemoveAll(tmpDir)
  1684. out, _ := dockerCmd(c, "run", "-d", "--cidfile", tmpCidFile, "busybox", "true")
  1685. id := strings.TrimSpace(out)
  1686. buffer, err := ioutil.ReadFile(tmpCidFile)
  1687. if err != nil {
  1688. c.Fatal(err)
  1689. }
  1690. cid := string(buffer)
  1691. if len(cid) != 64 {
  1692. c.Fatalf("--cidfile should be a long id, not %q", id)
  1693. }
  1694. if cid != id {
  1695. c.Fatalf("cid must be equal to %s, got %s", id, cid)
  1696. }
  1697. }
  1698. func (s *DockerSuite) TestRunSetMacAddress(c *check.C) {
  1699. mac := "12:34:56:78:9a:bc"
  1700. var out string
  1701. if daemonPlatform == "windows" {
  1702. out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "sh", "-c", "ipconfig /all | grep 'Physical Address' | awk '{print $12}'")
  1703. mac = strings.Replace(strings.ToUpper(mac), ":", "-", -1) // To Windows-style MACs
  1704. } else {
  1705. out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "/bin/sh", "-c", "ip link show eth0 | tail -1 | awk '{print $2}'")
  1706. }
  1707. actualMac := strings.TrimSpace(out)
  1708. if actualMac != mac {
  1709. c.Fatalf("Set MAC address with --mac-address failed. The container has an incorrect MAC address: %q, expected: %q", actualMac, mac)
  1710. }
  1711. }
  1712. func (s *DockerSuite) TestRunInspectMacAddress(c *check.C) {
  1713. // TODO Windows. Network settings are not propagated back to inspect.
  1714. testRequires(c, DaemonIsLinux)
  1715. mac := "12:34:56:78:9a:bc"
  1716. out, _ := dockerCmd(c, "run", "-d", "--mac-address="+mac, "busybox", "top")
  1717. id := strings.TrimSpace(out)
  1718. inspectedMac, err := inspectField(id, "NetworkSettings.Networks.bridge.MacAddress")
  1719. c.Assert(err, check.IsNil)
  1720. if inspectedMac != mac {
  1721. c.Fatalf("docker inspect outputs wrong MAC address: %q, should be: %q", inspectedMac, mac)
  1722. }
  1723. }
  1724. // test docker run use a invalid mac address
  1725. func (s *DockerSuite) TestRunWithInvalidMacAddress(c *check.C) {
  1726. out, _, err := dockerCmdWithError("run", "--mac-address", "92:d0:c6:0a:29", "busybox")
  1727. //use a invalid mac address should with a error out
  1728. if err == nil || !strings.Contains(out, "is not a valid mac address") {
  1729. c.Fatalf("run with an invalid --mac-address should with error out")
  1730. }
  1731. }
  1732. func (s *DockerSuite) TestRunDeallocatePortOnMissingIptablesRule(c *check.C) {
  1733. // TODO Windows. Network settings are not propagated back to inspect.
  1734. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1735. out, _ := dockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top")
  1736. id := strings.TrimSpace(out)
  1737. ip, err := inspectField(id, "NetworkSettings.Networks.bridge.IPAddress")
  1738. c.Assert(err, check.IsNil)
  1739. iptCmd := exec.Command("iptables", "-D", "DOCKER", "-d", fmt.Sprintf("%s/32", ip),
  1740. "!", "-i", "docker0", "-o", "docker0", "-p", "tcp", "-m", "tcp", "--dport", "23", "-j", "ACCEPT")
  1741. out, _, err = runCommandWithOutput(iptCmd)
  1742. if err != nil {
  1743. c.Fatal(err, out)
  1744. }
  1745. if err := deleteContainer(id); err != nil {
  1746. c.Fatal(err)
  1747. }
  1748. dockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top")
  1749. }
  1750. func (s *DockerSuite) TestRunPortInUse(c *check.C) {
  1751. // TODO Windows. The duplicate NAT message returned by Windows will be
  1752. // changing as is currently completely undecipherable. Does need modifying
  1753. // to run sh rather than top though as top isn't in Windows busybox.
  1754. testRequires(c, SameHostDaemon, DaemonIsLinux)
  1755. port := "1234"
  1756. dockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")
  1757. out, _, err := dockerCmdWithError("run", "-d", "-p", port+":80", "busybox", "top")
  1758. if err == nil {
  1759. c.Fatalf("Binding on used port must fail")
  1760. }
  1761. if !strings.Contains(out, "port is already allocated") {
  1762. c.Fatalf("Out must be about \"port is already allocated\", got %s", out)
  1763. }
  1764. }
  1765. // https://github.com/docker/docker/issues/12148
  1766. func (s *DockerSuite) TestRunAllocatePortInReservedRange(c *check.C) {
  1767. // TODO Windows. -P is not yet supported
  1768. testRequires(c, DaemonIsLinux)
  1769. // allocate a dynamic port to get the most recent
  1770. out, _ := dockerCmd(c, "run", "-d", "-P", "-p", "80", "busybox", "top")
  1771. id := strings.TrimSpace(out)
  1772. out, _ = dockerCmd(c, "port", id, "80")
  1773. strPort := strings.Split(strings.TrimSpace(out), ":")[1]
  1774. port, err := strconv.ParseInt(strPort, 10, 64)
  1775. if err != nil {
  1776. c.Fatalf("invalid port, got: %s, error: %s", strPort, err)
  1777. }
  1778. // allocate a static port and a dynamic port together, with static port
  1779. // takes the next recent port in dynamic port range.
  1780. dockerCmd(c, "run", "-d", "-P", "-p", "80", "-p", fmt.Sprintf("%d:8080", port+1), "busybox", "top")
  1781. }
  1782. // Regression test for #7792
  1783. func (s *DockerSuite) TestRunMountOrdering(c *check.C) {
  1784. // TODO Windows: Post TP4. Updated, but Windows does not support nested mounts currently.
  1785. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  1786. prefix := ""
  1787. if daemonPlatform == "windows" {
  1788. prefix = "c:"
  1789. }
  1790. tmpDir, err := ioutil.TempDir("", "docker_nested_mount_test")
  1791. if err != nil {
  1792. c.Fatal(err)
  1793. }
  1794. defer os.RemoveAll(tmpDir)
  1795. tmpDir2, err := ioutil.TempDir("", "docker_nested_mount_test2")
  1796. if err != nil {
  1797. c.Fatal(err)
  1798. }
  1799. defer os.RemoveAll(tmpDir2)
  1800. // Create a temporary tmpfs mounc.
  1801. fooDir := filepath.Join(tmpDir, "foo")
  1802. if err := os.MkdirAll(filepath.Join(tmpDir, "foo"), 0755); err != nil {
  1803. c.Fatalf("failed to mkdir at %s - %s", fooDir, err)
  1804. }
  1805. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", fooDir), []byte{}, 0644); err != nil {
  1806. c.Fatal(err)
  1807. }
  1808. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir), []byte{}, 0644); err != nil {
  1809. c.Fatal(err)
  1810. }
  1811. if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir2), []byte{}, 0644); err != nil {
  1812. c.Fatal(err)
  1813. }
  1814. dockerCmd(c, "run",
  1815. "-v", fmt.Sprintf("%s:"+prefix+"/tmp", tmpDir),
  1816. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/foo", fooDir),
  1817. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2", tmpDir2),
  1818. "-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2/foo", fooDir),
  1819. "busybox:latest", "sh", "-c",
  1820. "ls "+prefix+"/tmp/touch-me && ls "+prefix+"/tmp/foo/touch-me && ls "+prefix+"/tmp/tmp2/touch-me && ls "+prefix+"/tmp/tmp2/foo/touch-me")
  1821. }
  1822. // Regression test for https://github.com/docker/docker/issues/8259
  1823. func (s *DockerSuite) TestRunReuseBindVolumeThatIsSymlink(c *check.C) {
  1824. // Not applicable on Windows as Windows does not support volumes
  1825. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  1826. prefix := ""
  1827. if daemonPlatform == "windows" {
  1828. prefix = "c:"
  1829. }
  1830. tmpDir, err := ioutil.TempDir(os.TempDir(), "testlink")
  1831. if err != nil {
  1832. c.Fatal(err)
  1833. }
  1834. defer os.RemoveAll(tmpDir)
  1835. linkPath := os.TempDir() + "/testlink2"
  1836. if err := os.Symlink(tmpDir, linkPath); err != nil {
  1837. c.Fatal(err)
  1838. }
  1839. defer os.RemoveAll(linkPath)
  1840. // Create first container
  1841. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
  1842. // Create second container with same symlinked path
  1843. // This will fail if the referenced issue is hit with a "Volume exists" error
  1844. dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")
  1845. }
  1846. //GH#10604: Test an "/etc" volume doesn't overlay special bind mounts in container
  1847. func (s *DockerSuite) TestRunCreateVolumeEtc(c *check.C) {
  1848. // While Windows supports volumes, it does not support --add-host hence
  1849. // this test is not applicable on Windows.
  1850. testRequires(c, DaemonIsLinux)
  1851. out, _ := dockerCmd(c, "run", "--dns=127.0.0.1", "-v", "/etc", "busybox", "cat", "/etc/resolv.conf")
  1852. if !strings.Contains(out, "nameserver 127.0.0.1") {
  1853. c.Fatal("/etc volume mount hides /etc/resolv.conf")
  1854. }
  1855. out, _ = dockerCmd(c, "run", "-h=test123", "-v", "/etc", "busybox", "cat", "/etc/hostname")
  1856. if !strings.Contains(out, "test123") {
  1857. c.Fatal("/etc volume mount hides /etc/hostname")
  1858. }
  1859. out, _ = dockerCmd(c, "run", "--add-host=test:192.168.0.1", "-v", "/etc", "busybox", "cat", "/etc/hosts")
  1860. out = strings.Replace(out, "\n", " ", -1)
  1861. if !strings.Contains(out, "192.168.0.1\ttest") || !strings.Contains(out, "127.0.0.1\tlocalhost") {
  1862. c.Fatal("/etc volume mount hides /etc/hosts")
  1863. }
  1864. }
  1865. func (s *DockerSuite) TestVolumesNoCopyData(c *check.C) {
  1866. // TODO Windows (Post TP4). Windows does not support volumes which
  1867. // are pre-populated such as is built in the dockerfile used in this test.
  1868. testRequires(c, DaemonIsLinux)
  1869. if _, err := buildImage("dataimage",
  1870. `FROM busybox
  1871. RUN mkdir -p /foo
  1872. RUN touch /foo/bar`,
  1873. true); err != nil {
  1874. c.Fatal(err)
  1875. }
  1876. dockerCmd(c, "run", "--name", "test", "-v", "/foo", "busybox")
  1877. if out, _, err := dockerCmdWithError("run", "--volumes-from", "test", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {
  1878. c.Fatalf("Data was copied on volumes-from but shouldn't be:\n%q", out)
  1879. }
  1880. tmpDir := randomTmpDirPath("docker_test_bind_mount_copy_data", daemonPlatform)
  1881. if out, _, err := dockerCmdWithError("run", "-v", tmpDir+":/foo", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {
  1882. c.Fatalf("Data was copied on bind-mount but shouldn't be:\n%q", out)
  1883. }
  1884. }
  1885. func (s *DockerSuite) TestRunNoOutputFromPullInStdout(c *check.C) {
  1886. // just run with unknown image
  1887. cmd := exec.Command(dockerBinary, "run", "asdfsg")
  1888. stdout := bytes.NewBuffer(nil)
  1889. cmd.Stdout = stdout
  1890. if err := cmd.Run(); err == nil {
  1891. c.Fatal("Run with unknown image should fail")
  1892. }
  1893. if stdout.Len() != 0 {
  1894. c.Fatalf("Stdout contains output from pull: %s", stdout)
  1895. }
  1896. }
  1897. func (s *DockerSuite) TestRunVolumesCleanPaths(c *check.C) {
  1898. testRequires(c, SameHostDaemon)
  1899. prefix := ""
  1900. slash := `/`
  1901. if daemonPlatform == "windows" {
  1902. prefix = "c:"
  1903. slash = `\`
  1904. }
  1905. if _, err := buildImage("run_volumes_clean_paths",
  1906. `FROM busybox
  1907. VOLUME `+prefix+`/foo/`,
  1908. true); err != nil {
  1909. c.Fatal(err)
  1910. }
  1911. dockerCmd(c, "run", "-v", prefix+"/foo", "-v", prefix+"/bar/", "--name", "dark_helmet", "run_volumes_clean_paths")
  1912. out, err := inspectMountSourceField("dark_helmet", prefix+slash+"foo"+slash)
  1913. if err != errMountNotFound {
  1914. c.Fatalf("Found unexpected volume entry for '%s/foo/' in volumes\n%q", prefix, out)
  1915. }
  1916. out, err = inspectMountSourceField("dark_helmet", prefix+slash+`foo`)
  1917. c.Assert(err, check.IsNil)
  1918. if !strings.Contains(strings.ToLower(out), strings.ToLower(volumesConfigPath)) {
  1919. c.Fatalf("Volume was not defined for %s/foo\n%q", prefix, out)
  1920. }
  1921. out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar"+slash)
  1922. if err != errMountNotFound {
  1923. c.Fatalf("Found unexpected volume entry for '%s/bar/' in volumes\n%q", prefix, out)
  1924. }
  1925. out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar")
  1926. c.Assert(err, check.IsNil)
  1927. if !strings.Contains(strings.ToLower(out), strings.ToLower(volumesConfigPath)) {
  1928. c.Fatalf("Volume was not defined for %s/bar\n%q", prefix, out)
  1929. }
  1930. }
  1931. // Regression test for #3631
  1932. func (s *DockerSuite) TestRunSlowStdoutConsumer(c *check.C) {
  1933. // TODO Windows: This should be able to run on Windows if can find an
  1934. // alternate to /dev/zero and /dev/stdout.
  1935. testRequires(c, DaemonIsLinux)
  1936. cont := exec.Command(dockerBinary, "run", "--rm", "busybox", "/bin/sh", "-c", "dd if=/dev/zero of=/dev/stdout bs=1024 count=2000 | catv")
  1937. stdout, err := cont.StdoutPipe()
  1938. if err != nil {
  1939. c.Fatal(err)
  1940. }
  1941. if err := cont.Start(); err != nil {
  1942. c.Fatal(err)
  1943. }
  1944. n, err := consumeWithSpeed(stdout, 10000, 5*time.Millisecond, nil)
  1945. if err != nil {
  1946. c.Fatal(err)
  1947. }
  1948. expected := 2 * 1024 * 2000
  1949. if n != expected {
  1950. c.Fatalf("Expected %d, got %d", expected, n)
  1951. }
  1952. }
  1953. func (s *DockerSuite) TestRunAllowPortRangeThroughExpose(c *check.C) {
  1954. // TODO Windows: -P is not currently supported. Also network
  1955. // settings are not propagated back.
  1956. testRequires(c, DaemonIsLinux)
  1957. out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-P", "busybox", "top")
  1958. id := strings.TrimSpace(out)
  1959. portstr, err := inspectFieldJSON(id, "NetworkSettings.Ports")
  1960. c.Assert(err, check.IsNil)
  1961. var ports nat.PortMap
  1962. if err = unmarshalJSON([]byte(portstr), &ports); err != nil {
  1963. c.Fatal(err)
  1964. }
  1965. for port, binding := range ports {
  1966. portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
  1967. if portnum < 3000 || portnum > 3003 {
  1968. c.Fatalf("Port %d is out of range ", portnum)
  1969. }
  1970. if binding == nil || len(binding) != 1 || len(binding[0].HostPort) == 0 {
  1971. c.Fatalf("Port is not mapped for the port %s", port)
  1972. }
  1973. }
  1974. }
  1975. // test docker run expose a invalid port
  1976. func (s *DockerSuite) TestRunExposePort(c *check.C) {
  1977. out, _, err := dockerCmdWithError("run", "--expose", "80000", "busybox")
  1978. //expose a invalid port should with a error out
  1979. if err == nil || !strings.Contains(out, "Invalid range format for --expose") {
  1980. c.Fatalf("run --expose a invalid port should with error out")
  1981. }
  1982. }
  1983. func (s *DockerSuite) TestRunUnknownCommand(c *check.C) {
  1984. out, _, _ := dockerCmdWithStdoutStderr(c, "create", "busybox", "/bin/nada")
  1985. cID := strings.TrimSpace(out)
  1986. _, _, err := dockerCmdWithError("start", cID)
  1987. // Windows and Linux are different here by architectural design. Linux will
  1988. // fail to start the container, so an error is expected. Windows will
  1989. // successfully start the container, and once started attempt to execute
  1990. // the command which will fail.
  1991. if daemonPlatform == "windows" {
  1992. // Wait for it to exit.
  1993. waitExited(cID, 30*time.Second)
  1994. c.Assert(err, check.IsNil)
  1995. } else {
  1996. c.Assert(err, check.NotNil)
  1997. }
  1998. rc, err := inspectField(cID, "State.ExitCode")
  1999. c.Assert(err, check.IsNil)
  2000. if rc == "0" {
  2001. c.Fatalf("ExitCode(%v) cannot be 0", rc)
  2002. }
  2003. }
  2004. func (s *DockerSuite) TestRunModeIpcHost(c *check.C) {
  2005. // Not applicable on Windows as uses Unix-specific capabilities
  2006. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2007. hostIpc, err := os.Readlink("/proc/1/ns/ipc")
  2008. if err != nil {
  2009. c.Fatal(err)
  2010. }
  2011. out, _ := dockerCmd(c, "run", "--ipc=host", "busybox", "readlink", "/proc/self/ns/ipc")
  2012. out = strings.Trim(out, "\n")
  2013. if hostIpc != out {
  2014. c.Fatalf("IPC different with --ipc=host %s != %s\n", hostIpc, out)
  2015. }
  2016. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/ipc")
  2017. out = strings.Trim(out, "\n")
  2018. if hostIpc == out {
  2019. c.Fatalf("IPC should be different without --ipc=host %s == %s\n", hostIpc, out)
  2020. }
  2021. }
  2022. func (s *DockerSuite) TestRunModeIpcContainer(c *check.C) {
  2023. // Not applicable on Windows as uses Unix-specific capabilities
  2024. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2025. out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && top")
  2026. id := strings.TrimSpace(out)
  2027. state, err := inspectField(id, "State.Running")
  2028. c.Assert(err, check.IsNil)
  2029. if state != "true" {
  2030. c.Fatal("Container state is 'not running'")
  2031. }
  2032. pid1, err := inspectField(id, "State.Pid")
  2033. c.Assert(err, check.IsNil)
  2034. parentContainerIpc, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/ipc", pid1))
  2035. if err != nil {
  2036. c.Fatal(err)
  2037. }
  2038. out, _ = dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "readlink", "/proc/self/ns/ipc")
  2039. out = strings.Trim(out, "\n")
  2040. if parentContainerIpc != out {
  2041. c.Fatalf("IPC different with --ipc=container:%s %s != %s\n", id, parentContainerIpc, out)
  2042. }
  2043. catOutput, _ := dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "cat", "/dev/shm/test")
  2044. if catOutput != "test" {
  2045. c.Fatalf("Output of /dev/shm/test expected test but found: %s", catOutput)
  2046. }
  2047. }
  2048. func (s *DockerSuite) TestRunModeIpcContainerNotExists(c *check.C) {
  2049. // Not applicable on Windows as uses Unix-specific capabilities
  2050. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2051. out, _, err := dockerCmdWithError("run", "-d", "--ipc", "container:abcd1234", "busybox", "top")
  2052. if !strings.Contains(out, "abcd1234") || err == nil {
  2053. c.Fatalf("run IPC from a non exists container should with correct error out")
  2054. }
  2055. }
  2056. func (s *DockerSuite) TestRunModeIpcContainerNotRunning(c *check.C) {
  2057. // Not applicable on Windows as uses Unix-specific capabilities
  2058. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2059. out, _ := dockerCmd(c, "create", "busybox")
  2060. id := strings.TrimSpace(out)
  2061. out, _, err := dockerCmdWithError("run", fmt.Sprintf("--ipc=container:%s", id), "busybox")
  2062. if err == nil {
  2063. c.Fatalf("Run container with ipc mode container should fail with non running container: %s\n%s", out, err)
  2064. }
  2065. }
  2066. func (s *DockerSuite) TestRunMountShmMqueueFromHost(c *check.C) {
  2067. // Not applicable on Windows as uses Unix-specific capabilities
  2068. testRequires(c, SameHostDaemon, DaemonIsLinux)
  2069. dockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && top")
  2070. volPath, err := inspectMountSourceField("shmfromhost", "/dev/shm")
  2071. c.Assert(err, check.IsNil)
  2072. if volPath != "/dev/shm" {
  2073. c.Fatalf("volumePath should have been /dev/shm, was %s", volPath)
  2074. }
  2075. out, _ := dockerCmd(c, "run", "--name", "ipchost", "--ipc", "host", "busybox", "cat", "/dev/shm/test")
  2076. if out != "test" {
  2077. c.Fatalf("Output of /dev/shm/test expected test but found: %s", out)
  2078. }
  2079. }
  2080. func (s *DockerSuite) TestContainerNetworkMode(c *check.C) {
  2081. // Not applicable on Windows as uses Unix-specific capabilities
  2082. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2083. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  2084. id := strings.TrimSpace(out)
  2085. c.Assert(waitRun(id), check.IsNil)
  2086. pid1, err := inspectField(id, "State.Pid")
  2087. c.Assert(err, check.IsNil)
  2088. parentContainerNet, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
  2089. if err != nil {
  2090. c.Fatal(err)
  2091. }
  2092. out, _ = dockerCmd(c, "run", fmt.Sprintf("--net=container:%s", id), "busybox", "readlink", "/proc/self/ns/net")
  2093. out = strings.Trim(out, "\n")
  2094. if parentContainerNet != out {
  2095. c.Fatalf("NET different with --net=container:%s %s != %s\n", id, parentContainerNet, out)
  2096. }
  2097. }
  2098. func (s *DockerSuite) TestRunModePidHost(c *check.C) {
  2099. // Not applicable on Windows as uses Unix-specific capabilities
  2100. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2101. hostPid, err := os.Readlink("/proc/1/ns/pid")
  2102. if err != nil {
  2103. c.Fatal(err)
  2104. }
  2105. out, _ := dockerCmd(c, "run", "--pid=host", "busybox", "readlink", "/proc/self/ns/pid")
  2106. out = strings.Trim(out, "\n")
  2107. if hostPid != out {
  2108. c.Fatalf("PID different with --pid=host %s != %s\n", hostPid, out)
  2109. }
  2110. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/pid")
  2111. out = strings.Trim(out, "\n")
  2112. if hostPid == out {
  2113. c.Fatalf("PID should be different without --pid=host %s == %s\n", hostPid, out)
  2114. }
  2115. }
  2116. func (s *DockerSuite) TestRunModeUTSHost(c *check.C) {
  2117. // Not applicable on Windows as uses Unix-specific capabilities
  2118. testRequires(c, SameHostDaemon, DaemonIsLinux)
  2119. hostUTS, err := os.Readlink("/proc/1/ns/uts")
  2120. if err != nil {
  2121. c.Fatal(err)
  2122. }
  2123. out, _ := dockerCmd(c, "run", "--uts=host", "busybox", "readlink", "/proc/self/ns/uts")
  2124. out = strings.Trim(out, "\n")
  2125. if hostUTS != out {
  2126. c.Fatalf("UTS different with --uts=host %s != %s\n", hostUTS, out)
  2127. }
  2128. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/uts")
  2129. out = strings.Trim(out, "\n")
  2130. if hostUTS == out {
  2131. c.Fatalf("UTS should be different without --uts=host %s == %s\n", hostUTS, out)
  2132. }
  2133. }
  2134. func (s *DockerSuite) TestRunTLSverify(c *check.C) {
  2135. if out, code, err := dockerCmdWithError("ps"); err != nil || code != 0 {
  2136. c.Fatalf("Should have worked: %v:\n%v", err, out)
  2137. }
  2138. // Regardless of whether we specify true or false we need to
  2139. // test to make sure tls is turned on if --tlsverify is specified at all
  2140. out, code, err := dockerCmdWithError("--tlsverify=false", "ps")
  2141. if err == nil || code == 0 || !strings.Contains(out, "trying to connect") {
  2142. c.Fatalf("Should have failed: \net:%v\nout:%v\nerr:%v", code, out, err)
  2143. }
  2144. out, code, err = dockerCmdWithError("--tlsverify=true", "ps")
  2145. if err == nil || code == 0 || !strings.Contains(out, "cert") {
  2146. c.Fatalf("Should have failed: \net:%v\nout:%v\nerr:%v", code, out, err)
  2147. }
  2148. }
  2149. func (s *DockerSuite) TestRunPortFromDockerRangeInUse(c *check.C) {
  2150. // TODO Windows. Once moved to libnetwork/CNM, this may be able to be
  2151. // re-instated.
  2152. testRequires(c, DaemonIsLinux)
  2153. // first find allocator current position
  2154. out, _ := dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
  2155. id := strings.TrimSpace(out)
  2156. out, _ = dockerCmd(c, "port", id)
  2157. out = strings.TrimSpace(out)
  2158. if out == "" {
  2159. c.Fatal("docker port command output is empty")
  2160. }
  2161. out = strings.Split(out, ":")[1]
  2162. lastPort, err := strconv.Atoi(out)
  2163. if err != nil {
  2164. c.Fatal(err)
  2165. }
  2166. port := lastPort + 1
  2167. l, err := net.Listen("tcp", ":"+strconv.Itoa(port))
  2168. if err != nil {
  2169. c.Fatal(err)
  2170. }
  2171. defer l.Close()
  2172. out, _ = dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
  2173. id = strings.TrimSpace(out)
  2174. dockerCmd(c, "port", id)
  2175. }
  2176. func (s *DockerSuite) TestRunTtyWithPipe(c *check.C) {
  2177. errChan := make(chan error)
  2178. go func() {
  2179. defer close(errChan)
  2180. cmd := exec.Command(dockerBinary, "run", "-ti", "busybox", "true")
  2181. if _, err := cmd.StdinPipe(); err != nil {
  2182. errChan <- err
  2183. return
  2184. }
  2185. expected := "cannot enable tty mode"
  2186. if out, _, err := runCommandWithOutput(cmd); err == nil {
  2187. errChan <- fmt.Errorf("run should have failed")
  2188. return
  2189. } else if !strings.Contains(out, expected) {
  2190. errChan <- fmt.Errorf("run failed with error %q: expected %q", out, expected)
  2191. return
  2192. }
  2193. }()
  2194. select {
  2195. case err := <-errChan:
  2196. c.Assert(err, check.IsNil)
  2197. case <-time.After(6 * time.Second):
  2198. c.Fatal("container is running but should have failed")
  2199. }
  2200. }
  2201. func (s *DockerSuite) TestRunNonLocalMacAddress(c *check.C) {
  2202. addr := "00:16:3E:08:00:50"
  2203. cmd := "ifconfig"
  2204. image := "busybox"
  2205. expected := addr
  2206. if daemonPlatform == "windows" {
  2207. cmd = "ipconfig /all"
  2208. image = WindowsBaseImage
  2209. expected = strings.Replace(strings.ToUpper(addr), ":", "-", -1)
  2210. }
  2211. if out, _ := dockerCmd(c, "run", "--mac-address", addr, image, cmd); !strings.Contains(out, expected) {
  2212. c.Fatalf("Output should have contained %q: %s", expected, out)
  2213. }
  2214. }
  2215. func (s *DockerSuite) TestRunNetHost(c *check.C) {
  2216. // Not applicable on Windows as uses Unix-specific capabilities
  2217. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2218. hostNet, err := os.Readlink("/proc/1/ns/net")
  2219. if err != nil {
  2220. c.Fatal(err)
  2221. }
  2222. out, _ := dockerCmd(c, "run", "--net=host", "busybox", "readlink", "/proc/self/ns/net")
  2223. out = strings.Trim(out, "\n")
  2224. if hostNet != out {
  2225. c.Fatalf("Net namespace different with --net=host %s != %s\n", hostNet, out)
  2226. }
  2227. out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/net")
  2228. out = strings.Trim(out, "\n")
  2229. if hostNet == out {
  2230. c.Fatalf("Net namespace should be different without --net=host %s == %s\n", hostNet, out)
  2231. }
  2232. }
  2233. func (s *DockerSuite) TestRunNetHostTwiceSameName(c *check.C) {
  2234. // TODO Windows. As Windows networking evolves and converges towards
  2235. // CNM, this test may be possible to enable on Windows.
  2236. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2237. dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
  2238. dockerCmd(c, "run", "--rm", "--name=thost", "--net=host", "busybox", "true")
  2239. }
  2240. func (s *DockerSuite) TestRunNetContainerWhichHost(c *check.C) {
  2241. // Not applicable on Windows as uses Unix-specific capabilities
  2242. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2243. hostNet, err := os.Readlink("/proc/1/ns/net")
  2244. if err != nil {
  2245. c.Fatal(err)
  2246. }
  2247. dockerCmd(c, "run", "-d", "--net=host", "--name=test", "busybox", "top")
  2248. out, _ := dockerCmd(c, "run", "--net=container:test", "busybox", "readlink", "/proc/self/ns/net")
  2249. out = strings.Trim(out, "\n")
  2250. if hostNet != out {
  2251. c.Fatalf("Container should have host network namespace")
  2252. }
  2253. }
  2254. func (s *DockerSuite) TestRunAllowPortRangeThroughPublish(c *check.C) {
  2255. // TODO Windows. This may be possible to enable in the future. However,
  2256. // Windows does not currently support --expose, or populate the network
  2257. // settings seen through inspect.
  2258. testRequires(c, DaemonIsLinux)
  2259. out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-p", "3000-3003", "busybox", "top")
  2260. id := strings.TrimSpace(out)
  2261. portstr, err := inspectFieldJSON(id, "NetworkSettings.Ports")
  2262. c.Assert(err, check.IsNil)
  2263. var ports nat.PortMap
  2264. err = unmarshalJSON([]byte(portstr), &ports)
  2265. for port, binding := range ports {
  2266. portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
  2267. if portnum < 3000 || portnum > 3003 {
  2268. c.Fatalf("Port %d is out of range ", portnum)
  2269. }
  2270. if binding == nil || len(binding) != 1 || len(binding[0].HostPort) == 0 {
  2271. c.Fatal("Port is not mapped for the port "+port, out)
  2272. }
  2273. }
  2274. }
  2275. func (s *DockerSuite) TestRunSetDefaultRestartPolicy(c *check.C) {
  2276. dockerCmd(c, "run", "-d", "--name", "test", "busybox", "sleep", "30")
  2277. out, err := inspectField("test", "HostConfig.RestartPolicy.Name")
  2278. c.Assert(err, check.IsNil)
  2279. if out != "no" {
  2280. c.Fatalf("Set default restart policy failed")
  2281. }
  2282. }
  2283. func (s *DockerSuite) TestRunRestartMaxRetries(c *check.C) {
  2284. out, _ := dockerCmd(c, "run", "-d", "--restart=on-failure:3", "busybox", "false")
  2285. timeout := 10 * time.Second
  2286. if daemonPlatform == "windows" {
  2287. timeout = 45 * time.Second
  2288. }
  2289. id := strings.TrimSpace(string(out))
  2290. if err := waitInspect(id, "{{ .State.Restarting }} {{ .State.Running }}", "false false", timeout); err != nil {
  2291. c.Fatal(err)
  2292. }
  2293. count, err := inspectField(id, "RestartCount")
  2294. c.Assert(err, check.IsNil)
  2295. if count != "3" {
  2296. c.Fatalf("Container was restarted %s times, expected %d", count, 3)
  2297. }
  2298. MaximumRetryCount, err := inspectField(id, "HostConfig.RestartPolicy.MaximumRetryCount")
  2299. c.Assert(err, check.IsNil)
  2300. if MaximumRetryCount != "3" {
  2301. c.Fatalf("Container Maximum Retry Count is %s, expected %s", MaximumRetryCount, "3")
  2302. }
  2303. }
  2304. func (s *DockerSuite) TestRunContainerWithWritableRootfs(c *check.C) {
  2305. dockerCmd(c, "run", "--rm", "busybox", "touch", "/file")
  2306. }
  2307. func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *check.C) {
  2308. // Not applicable on Windows which does not support --read-only
  2309. testRequires(c, DaemonIsLinux)
  2310. for _, f := range []string{"/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/sys/kernel", "/dev/.dont.touch.me"} {
  2311. testReadOnlyFile(f, c)
  2312. }
  2313. }
  2314. func (s *DockerSuite) TestPermissionsPtsReadonlyRootfs(c *check.C) {
  2315. // Not applicable on Windows due to use of Unix specific functionality, plus
  2316. // the use of --read-only which is not supported.
  2317. // --read-only + userns has remount issues
  2318. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2319. // Ensure we have not broken writing /dev/pts
  2320. out, status := dockerCmd(c, "run", "--read-only", "--rm", "busybox", "mount")
  2321. if status != 0 {
  2322. c.Fatal("Could not obtain mounts when checking /dev/pts mntpnt.")
  2323. }
  2324. expected := "type devpts (rw,"
  2325. if !strings.Contains(string(out), expected) {
  2326. c.Fatalf("expected output to contain %s but contains %s", expected, out)
  2327. }
  2328. }
  2329. func testReadOnlyFile(filename string, c *check.C) {
  2330. // Not applicable on Windows which does not support --read-only
  2331. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2332. out, _, err := dockerCmdWithError("run", "--read-only", "--rm", "busybox", "touch", filename)
  2333. if err == nil {
  2334. c.Fatal("expected container to error on run with read only error")
  2335. }
  2336. expected := "Read-only file system"
  2337. if !strings.Contains(string(out), expected) {
  2338. c.Fatalf("expected output from failure to contain %s but contains %s", expected, out)
  2339. }
  2340. out, _, err = dockerCmdWithError("run", "--read-only", "--privileged", "--rm", "busybox", "touch", filename)
  2341. if err == nil {
  2342. c.Fatal("expected container to error on run with read only error")
  2343. }
  2344. expected = "Read-only file system"
  2345. if !strings.Contains(string(out), expected) {
  2346. c.Fatalf("expected output from failure to contain %s but contains %s", expected, out)
  2347. }
  2348. }
  2349. func (s *DockerSuite) TestRunContainerWithReadonlyEtcHostsAndLinkedContainer(c *check.C) {
  2350. // Not applicable on Windows which does not support --link
  2351. // --read-only + userns has remount issues
  2352. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2353. dockerCmd(c, "run", "-d", "--name", "test-etc-hosts-ro-linked", "busybox", "top")
  2354. out, _ := dockerCmd(c, "run", "--read-only", "--link", "test-etc-hosts-ro-linked:testlinked", "busybox", "cat", "/etc/hosts")
  2355. if !strings.Contains(string(out), "testlinked") {
  2356. c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled")
  2357. }
  2358. }
  2359. func (s *DockerSuite) TestRunContainerWithReadonlyRootfsWithDnsFlag(c *check.C) {
  2360. // Not applicable on Windows which does not support either --read-only or --dns.
  2361. // --read-only + userns has remount issues
  2362. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2363. out, _ := dockerCmd(c, "run", "--read-only", "--dns", "1.1.1.1", "busybox", "/bin/cat", "/etc/resolv.conf")
  2364. if !strings.Contains(string(out), "1.1.1.1") {
  2365. c.Fatal("Expected /etc/resolv.conf to be updated even if --read-only enabled and --dns flag used")
  2366. }
  2367. }
  2368. func (s *DockerSuite) TestRunContainerWithReadonlyRootfsWithAddHostFlag(c *check.C) {
  2369. // Not applicable on Windows which does not support --read-only
  2370. // --read-only + userns has remount issues
  2371. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2372. out, _ := dockerCmd(c, "run", "--read-only", "--add-host", "testreadonly:127.0.0.1", "busybox", "/bin/cat", "/etc/hosts")
  2373. if !strings.Contains(string(out), "testreadonly") {
  2374. c.Fatal("Expected /etc/hosts to be updated even if --read-only enabled and --add-host flag used")
  2375. }
  2376. }
  2377. func (s *DockerSuite) TestRunVolumesFromRestartAfterRemoved(c *check.C) {
  2378. prefix := ""
  2379. if daemonPlatform == "windows" {
  2380. prefix = "c:"
  2381. }
  2382. dockerCmd(c, "run", "-d", "--name", "voltest", "-v", prefix+"/foo", "busybox", "sleep", "60")
  2383. dockerCmd(c, "run", "-d", "--name", "restarter", "--volumes-from", "voltest", "busybox", "sleep", "60")
  2384. // Remove the main volume container and restart the consuming container
  2385. dockerCmd(c, "rm", "-f", "voltest")
  2386. // This should not fail since the volumes-from were already applied
  2387. dockerCmd(c, "restart", "restarter")
  2388. }
  2389. // run container with --rm should remove container if exit code != 0
  2390. func (s *DockerSuite) TestRunContainerWithRmFlagExitCodeNotEqualToZero(c *check.C) {
  2391. name := "flowers"
  2392. out, _, err := dockerCmdWithError("run", "--name", name, "--rm", "busybox", "ls", "/notexists")
  2393. if err == nil {
  2394. c.Fatal("Expected docker run to fail", out, err)
  2395. }
  2396. out, err = getAllContainers()
  2397. if err != nil {
  2398. c.Fatal(out, err)
  2399. }
  2400. if out != "" {
  2401. c.Fatal("Expected not to have containers", out)
  2402. }
  2403. }
  2404. func (s *DockerSuite) TestRunContainerWithRmFlagCannotStartContainer(c *check.C) {
  2405. name := "sparkles"
  2406. out, _, err := dockerCmdWithError("run", "--name", name, "--rm", "busybox", "commandNotFound")
  2407. if err == nil {
  2408. c.Fatal("Expected docker run to fail", out, err)
  2409. }
  2410. out, err = getAllContainers()
  2411. if err != nil {
  2412. c.Fatal(out, err)
  2413. }
  2414. if out != "" {
  2415. c.Fatal("Expected not to have containers", out)
  2416. }
  2417. }
  2418. func (s *DockerSuite) TestRunPidHostWithChildIsKillable(c *check.C) {
  2419. // Not applicable on Windows as uses Unix specific functionality
  2420. testRequires(c, DaemonIsLinux, NotUserNamespace)
  2421. name := "ibuildthecloud"
  2422. dockerCmd(c, "run", "-d", "--pid=host", "--name", name, "busybox", "sh", "-c", "sleep 30; echo hi")
  2423. c.Assert(waitRun(name), check.IsNil)
  2424. errchan := make(chan error)
  2425. go func() {
  2426. if out, _, err := dockerCmdWithError("kill", name); err != nil {
  2427. errchan <- fmt.Errorf("%v:\n%s", err, out)
  2428. }
  2429. close(errchan)
  2430. }()
  2431. select {
  2432. case err := <-errchan:
  2433. c.Assert(err, check.IsNil)
  2434. case <-time.After(5 * time.Second):
  2435. c.Fatal("Kill container timed out")
  2436. }
  2437. }
  2438. func (s *DockerSuite) TestRunWithTooSmallMemoryLimit(c *check.C) {
  2439. // TODO Windows. This may be possible to enable once Windows supports
  2440. // memory limits on containers
  2441. testRequires(c, DaemonIsLinux)
  2442. // this memory limit is 1 byte less than the min, which is 4MB
  2443. // https://github.com/docker/docker/blob/v1.5.0/daemon/create.go#L22
  2444. out, _, err := dockerCmdWithError("run", "-m", "4194303", "busybox")
  2445. if err == nil || !strings.Contains(out, "Minimum memory limit allowed is 4MB") {
  2446. c.Fatalf("expected run to fail when using too low a memory limit: %q", out)
  2447. }
  2448. }
  2449. func (s *DockerSuite) TestRunWriteToProcAsound(c *check.C) {
  2450. // Not applicable on Windows as uses Unix specific functionality
  2451. testRequires(c, DaemonIsLinux)
  2452. _, code, err := dockerCmdWithError("run", "busybox", "sh", "-c", "echo 111 >> /proc/asound/version")
  2453. if err == nil || code == 0 {
  2454. c.Fatal("standard container should not be able to write to /proc/asound")
  2455. }
  2456. }
  2457. func (s *DockerSuite) TestRunReadProcTimer(c *check.C) {
  2458. // Not applicable on Windows as uses Unix specific functionality
  2459. testRequires(c, DaemonIsLinux)
  2460. out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/timer_stats")
  2461. if code != 0 {
  2462. return
  2463. }
  2464. if err != nil {
  2465. c.Fatal(err)
  2466. }
  2467. if strings.Trim(out, "\n ") != "" {
  2468. c.Fatalf("expected to receive no output from /proc/timer_stats but received %q", out)
  2469. }
  2470. }
  2471. func (s *DockerSuite) TestRunReadProcLatency(c *check.C) {
  2472. // Not applicable on Windows as uses Unix specific functionality
  2473. testRequires(c, DaemonIsLinux)
  2474. // some kernels don't have this configured so skip the test if this file is not found
  2475. // on the host running the tests.
  2476. if _, err := os.Stat("/proc/latency_stats"); err != nil {
  2477. c.Skip("kernel doesnt have latency_stats configured")
  2478. return
  2479. }
  2480. out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/latency_stats")
  2481. if code != 0 {
  2482. return
  2483. }
  2484. if err != nil {
  2485. c.Fatal(err)
  2486. }
  2487. if strings.Trim(out, "\n ") != "" {
  2488. c.Fatalf("expected to receive no output from /proc/latency_stats but received %q", out)
  2489. }
  2490. }
  2491. func (s *DockerSuite) TestRunReadFilteredProc(c *check.C) {
  2492. // Not applicable on Windows as uses Unix specific functionality
  2493. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2494. testReadPaths := []string{
  2495. "/proc/latency_stats",
  2496. "/proc/timer_stats",
  2497. "/proc/kcore",
  2498. }
  2499. for i, filePath := range testReadPaths {
  2500. name := fmt.Sprintf("procsieve-%d", i)
  2501. shellCmd := fmt.Sprintf("exec 3<%s", filePath)
  2502. out, exitCode, err := dockerCmdWithError("run", "--privileged", "--security-opt", "apparmor:docker-default", "--name", name, "busybox", "sh", "-c", shellCmd)
  2503. if exitCode != 0 {
  2504. return
  2505. }
  2506. if err != nil {
  2507. c.Fatalf("Open FD for read should have failed with permission denied, got: %s, %v", out, err)
  2508. }
  2509. }
  2510. }
  2511. func (s *DockerSuite) TestMountIntoProc(c *check.C) {
  2512. // Not applicable on Windows as uses Unix specific functionality
  2513. testRequires(c, DaemonIsLinux)
  2514. _, code, err := dockerCmdWithError("run", "-v", "/proc//sys", "busybox", "true")
  2515. if err == nil || code == 0 {
  2516. c.Fatal("container should not be able to mount into /proc")
  2517. }
  2518. }
  2519. func (s *DockerSuite) TestMountIntoSys(c *check.C) {
  2520. // Not applicable on Windows as uses Unix specific functionality
  2521. testRequires(c, DaemonIsLinux)
  2522. testRequires(c, NotUserNamespace)
  2523. dockerCmd(c, "run", "-v", "/sys/fs/cgroup", "busybox", "true")
  2524. }
  2525. func (s *DockerSuite) TestRunUnshareProc(c *check.C) {
  2526. // Not applicable on Windows as uses Unix specific functionality
  2527. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2528. name := "acidburn"
  2529. out, _, err := dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp:unconfined", "debian:jessie", "unshare", "-p", "-m", "-f", "-r", "--mount-proc=/proc", "mount")
  2530. if err == nil ||
  2531. !(strings.Contains(strings.ToLower(out), "permission denied") ||
  2532. strings.Contains(strings.ToLower(out), "operation not permitted")) {
  2533. c.Fatalf("unshare with --mount-proc should have failed with 'permission denied' or 'operation not permitted', got: %s, %v", out, err)
  2534. }
  2535. name = "cereal"
  2536. out, _, err = dockerCmdWithError("run", "--name", name, "--security-opt", "seccomp:unconfined", "debian:jessie", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
  2537. if err == nil ||
  2538. !(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
  2539. strings.Contains(strings.ToLower(out), "permission denied")) {
  2540. c.Fatalf("unshare and mount of /proc should have failed with 'mount: cannot mount none' or 'permission denied', got: %s, %v", out, err)
  2541. }
  2542. /* Ensure still fails if running privileged with the default policy */
  2543. name = "crashoverride"
  2544. out, _, err = dockerCmdWithError("run", "--privileged", "--security-opt", "seccomp:unconfined", "--security-opt", "apparmor:docker-default", "--name", name, "debian:jessie", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc")
  2545. if err == nil ||
  2546. !(strings.Contains(strings.ToLower(out), "mount: cannot mount none") ||
  2547. strings.Contains(strings.ToLower(out), "permission denied")) {
  2548. c.Fatalf("privileged unshare with apparmor should have failed with 'mount: cannot mount none' or 'permission denied', got: %s, %v", out, err)
  2549. }
  2550. }
  2551. func (s *DockerSuite) TestRunPublishPort(c *check.C) {
  2552. // TODO Windows: This may be possible once Windows moves to libnetwork and CNM
  2553. testRequires(c, DaemonIsLinux)
  2554. dockerCmd(c, "run", "-d", "--name", "test", "--expose", "8080", "busybox", "top")
  2555. out, _ := dockerCmd(c, "port", "test")
  2556. out = strings.Trim(out, "\r\n")
  2557. if out != "" {
  2558. c.Fatalf("run without --publish-all should not publish port, out should be nil, but got: %s", out)
  2559. }
  2560. }
  2561. // Issue #10184.
  2562. func (s *DockerSuite) TestDevicePermissions(c *check.C) {
  2563. // Not applicable on Windows as uses Unix specific functionality
  2564. testRequires(c, DaemonIsLinux)
  2565. const permissions = "crw-rw-rw-"
  2566. out, status := dockerCmd(c, "run", "--device", "/dev/fuse:/dev/fuse:mrw", "busybox:latest", "ls", "-l", "/dev/fuse")
  2567. if status != 0 {
  2568. c.Fatalf("expected status 0, got %d", status)
  2569. }
  2570. if !strings.HasPrefix(out, permissions) {
  2571. c.Fatalf("output should begin with %q, got %q", permissions, out)
  2572. }
  2573. }
  2574. func (s *DockerSuite) TestRunCapAddCHOWN(c *check.C) {
  2575. // Not applicable on Windows as uses Unix specific functionality
  2576. testRequires(c, DaemonIsLinux)
  2577. out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=CHOWN", "busybox", "sh", "-c", "adduser -D -H newuser && chown newuser /home && echo ok")
  2578. if actual := strings.Trim(out, "\r\n"); actual != "ok" {
  2579. c.Fatalf("expected output ok received %s", actual)
  2580. }
  2581. }
  2582. // https://github.com/docker/docker/pull/14498
  2583. func (s *DockerSuite) TestVolumeFromMixedRWOptions(c *check.C) {
  2584. // TODO Windows post TP4. Enable the read-only bits once they are
  2585. // supported on the platform.
  2586. prefix := ""
  2587. slash := `/`
  2588. if daemonPlatform == "windows" {
  2589. prefix = "c:"
  2590. slash = `\`
  2591. }
  2592. dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "true")
  2593. if daemonPlatform != "windows" {
  2594. dockerCmd(c, "run", "--volumes-from", "parent:ro", "--name", "test-volumes-1", "busybox", "true")
  2595. }
  2596. dockerCmd(c, "run", "--volumes-from", "parent:rw", "--name", "test-volumes-2", "busybox", "true")
  2597. if daemonPlatform != "windows" {
  2598. mRO, err := inspectMountPoint("test-volumes-1", prefix+slash+"test")
  2599. c.Assert(err, check.IsNil)
  2600. if mRO.RW {
  2601. c.Fatalf("Expected RO volume was RW")
  2602. }
  2603. }
  2604. mRW, err := inspectMountPoint("test-volumes-2", prefix+slash+"test")
  2605. c.Assert(err, check.IsNil)
  2606. if !mRW.RW {
  2607. c.Fatalf("Expected RW volume was RO")
  2608. }
  2609. }
  2610. func (s *DockerSuite) TestRunWriteFilteredProc(c *check.C) {
  2611. // Not applicable on Windows as uses Unix specific functionality
  2612. testRequires(c, Apparmor, DaemonIsLinux, NotUserNamespace)
  2613. testWritePaths := []string{
  2614. /* modprobe and core_pattern should both be denied by generic
  2615. * policy of denials for /proc/sys/kernel. These files have been
  2616. * picked to be checked as they are particularly sensitive to writes */
  2617. "/proc/sys/kernel/modprobe",
  2618. "/proc/sys/kernel/core_pattern",
  2619. "/proc/sysrq-trigger",
  2620. "/proc/kcore",
  2621. }
  2622. for i, filePath := range testWritePaths {
  2623. name := fmt.Sprintf("writeprocsieve-%d", i)
  2624. shellCmd := fmt.Sprintf("exec 3>%s", filePath)
  2625. out, code, err := dockerCmdWithError("run", "--privileged", "--security-opt", "apparmor:docker-default", "--name", name, "busybox", "sh", "-c", shellCmd)
  2626. if code != 0 {
  2627. return
  2628. }
  2629. if err != nil {
  2630. c.Fatalf("Open FD for write should have failed with permission denied, got: %s, %v", out, err)
  2631. }
  2632. }
  2633. }
  2634. func (s *DockerSuite) TestRunNetworkFilesBindMount(c *check.C) {
  2635. // Not applicable on Windows as uses Unix specific functionality
  2636. testRequires(c, SameHostDaemon, DaemonIsLinux)
  2637. expected := "test123"
  2638. filename := createTmpFile(c, expected)
  2639. defer os.Remove(filename)
  2640. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2641. for i := range nwfiles {
  2642. actual, _ := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "busybox", "cat", nwfiles[i])
  2643. if actual != expected {
  2644. c.Fatalf("expected %s be: %q, but was: %q", nwfiles[i], expected, actual)
  2645. }
  2646. }
  2647. }
  2648. func (s *DockerSuite) TestRunNetworkFilesBindMountRO(c *check.C) {
  2649. // Not applicable on Windows as uses Unix specific functionality
  2650. testRequires(c, SameHostDaemon, DaemonIsLinux)
  2651. filename := createTmpFile(c, "test123")
  2652. defer os.Remove(filename)
  2653. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2654. for i := range nwfiles {
  2655. _, exitCode, err := dockerCmdWithError("run", "-v", filename+":"+nwfiles[i]+":ro", "busybox", "touch", nwfiles[i])
  2656. if err == nil || exitCode == 0 {
  2657. c.Fatalf("run should fail because bind mount of %s is ro: exit code %d", nwfiles[i], exitCode)
  2658. }
  2659. }
  2660. }
  2661. func (s *DockerSuite) TestRunNetworkFilesBindMountROFilesystem(c *check.C) {
  2662. // Not applicable on Windows as uses Unix specific functionality
  2663. // --read-only + userns has remount issues
  2664. testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)
  2665. filename := createTmpFile(c, "test123")
  2666. defer os.Remove(filename)
  2667. nwfiles := []string{"/etc/resolv.conf", "/etc/hosts", "/etc/hostname"}
  2668. for i := range nwfiles {
  2669. _, exitCode := dockerCmd(c, "run", "-v", filename+":"+nwfiles[i], "--read-only", "busybox", "touch", nwfiles[i])
  2670. if exitCode != 0 {
  2671. c.Fatalf("run should not fail because %s is mounted writable on read-only root filesystem: exit code %d", nwfiles[i], exitCode)
  2672. }
  2673. }
  2674. for i := range nwfiles {
  2675. _, exitCode, err := dockerCmdWithError("run", "-v", filename+":"+nwfiles[i]+":ro", "--read-only", "busybox", "touch", nwfiles[i])
  2676. if err == nil || exitCode == 0 {
  2677. c.Fatalf("run should fail because %s is mounted read-only on read-only root filesystem: exit code %d", nwfiles[i], exitCode)
  2678. }
  2679. }
  2680. }
  2681. func (s *DockerTrustSuite) TestTrustedRun(c *check.C) {
  2682. // Windows does not support this functionality
  2683. testRequires(c, DaemonIsLinux)
  2684. repoName := s.setupTrustedImage(c, "trusted-run")
  2685. // Try run
  2686. runCmd := exec.Command(dockerBinary, "run", repoName)
  2687. s.trustedCmd(runCmd)
  2688. out, _, err := runCommandWithOutput(runCmd)
  2689. if err != nil {
  2690. c.Fatalf("Error running trusted run: %s\n%s\n", err, out)
  2691. }
  2692. if !strings.Contains(string(out), "Tagging") {
  2693. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  2694. }
  2695. dockerCmd(c, "rmi", repoName)
  2696. // Try untrusted run to ensure we pushed the tag to the registry
  2697. runCmd = exec.Command(dockerBinary, "run", "--disable-content-trust=true", repoName)
  2698. s.trustedCmd(runCmd)
  2699. out, _, err = runCommandWithOutput(runCmd)
  2700. if err != nil {
  2701. c.Fatalf("Error running trusted run: %s\n%s", err, out)
  2702. }
  2703. if !strings.Contains(string(out), "Status: Downloaded") {
  2704. c.Fatalf("Missing expected output on trusted run with --disable-content-trust:\n%s", out)
  2705. }
  2706. }
  2707. func (s *DockerTrustSuite) TestUntrustedRun(c *check.C) {
  2708. // Windows does not support this functionality
  2709. testRequires(c, DaemonIsLinux)
  2710. repoName := fmt.Sprintf("%v/dockercli/trusted:latest", privateRegistryURL)
  2711. // tag the image and upload it to the private registry
  2712. dockerCmd(c, "tag", "busybox", repoName)
  2713. dockerCmd(c, "push", repoName)
  2714. dockerCmd(c, "rmi", repoName)
  2715. // Try trusted run on untrusted tag
  2716. runCmd := exec.Command(dockerBinary, "run", repoName)
  2717. s.trustedCmd(runCmd)
  2718. out, _, err := runCommandWithOutput(runCmd)
  2719. if err == nil {
  2720. c.Fatalf("Error expected when running trusted run with:\n%s", out)
  2721. }
  2722. if !strings.Contains(string(out), "does not have trust data for") {
  2723. c.Fatalf("Missing expected output on trusted run:\n%s", out)
  2724. }
  2725. }
  2726. func (s *DockerTrustSuite) TestRunWhenCertExpired(c *check.C) {
  2727. // Windows does not support this functionality
  2728. testRequires(c, DaemonIsLinux)
  2729. c.Skip("Currently changes system time, causing instability")
  2730. repoName := s.setupTrustedImage(c, "trusted-run-expired")
  2731. // Certificates have 10 years of expiration
  2732. elevenYearsFromNow := time.Now().Add(time.Hour * 24 * 365 * 11)
  2733. runAtDifferentDate(elevenYearsFromNow, func() {
  2734. // Try run
  2735. runCmd := exec.Command(dockerBinary, "run", repoName)
  2736. s.trustedCmd(runCmd)
  2737. out, _, err := runCommandWithOutput(runCmd)
  2738. if err == nil {
  2739. c.Fatalf("Error running trusted run in the distant future: %s\n%s", err, out)
  2740. }
  2741. if !strings.Contains(string(out), "could not validate the path to a trusted root") {
  2742. c.Fatalf("Missing expected output on trusted run in the distant future:\n%s", out)
  2743. }
  2744. })
  2745. runAtDifferentDate(elevenYearsFromNow, func() {
  2746. // Try run
  2747. runCmd := exec.Command(dockerBinary, "run", "--disable-content-trust", repoName)
  2748. s.trustedCmd(runCmd)
  2749. out, _, err := runCommandWithOutput(runCmd)
  2750. if err != nil {
  2751. c.Fatalf("Error running untrusted run in the distant future: %s\n%s", err, out)
  2752. }
  2753. if !strings.Contains(string(out), "Status: Downloaded") {
  2754. c.Fatalf("Missing expected output on untrusted run in the distant future:\n%s", out)
  2755. }
  2756. })
  2757. }
  2758. func (s *DockerTrustSuite) TestTrustedRunFromBadTrustServer(c *check.C) {
  2759. // Windows does not support this functionality
  2760. testRequires(c, DaemonIsLinux)
  2761. repoName := fmt.Sprintf("%v/dockerclievilrun/trusted:latest", privateRegistryURL)
  2762. evilLocalConfigDir, err := ioutil.TempDir("", "evil-local-config-dir")
  2763. if err != nil {
  2764. c.Fatalf("Failed to create local temp dir")
  2765. }
  2766. // tag the image and upload it to the private registry
  2767. dockerCmd(c, "tag", "busybox", repoName)
  2768. pushCmd := exec.Command(dockerBinary, "push", repoName)
  2769. s.trustedCmd(pushCmd)
  2770. out, _, err := runCommandWithOutput(pushCmd)
  2771. if err != nil {
  2772. c.Fatalf("Error running trusted push: %s\n%s", err, out)
  2773. }
  2774. if !strings.Contains(string(out), "Signing and pushing trust metadata") {
  2775. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  2776. }
  2777. dockerCmd(c, "rmi", repoName)
  2778. // Try run
  2779. runCmd := exec.Command(dockerBinary, "run", repoName)
  2780. s.trustedCmd(runCmd)
  2781. out, _, err = runCommandWithOutput(runCmd)
  2782. if err != nil {
  2783. c.Fatalf("Error running trusted run: %s\n%s", err, out)
  2784. }
  2785. if !strings.Contains(string(out), "Tagging") {
  2786. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  2787. }
  2788. dockerCmd(c, "rmi", repoName)
  2789. // Kill the notary server, start a new "evil" one.
  2790. s.not.Close()
  2791. s.not, err = newTestNotary(c)
  2792. if err != nil {
  2793. c.Fatalf("Restarting notary server failed.")
  2794. }
  2795. // In order to make an evil server, lets re-init a client (with a different trust dir) and push new data.
  2796. // tag an image and upload it to the private registry
  2797. dockerCmd(c, "--config", evilLocalConfigDir, "tag", "busybox", repoName)
  2798. // Push up to the new server
  2799. pushCmd = exec.Command(dockerBinary, "--config", evilLocalConfigDir, "push", repoName)
  2800. s.trustedCmd(pushCmd)
  2801. out, _, err = runCommandWithOutput(pushCmd)
  2802. if err != nil {
  2803. c.Fatalf("Error running trusted push: %s\n%s", err, out)
  2804. }
  2805. if !strings.Contains(string(out), "Signing and pushing trust metadata") {
  2806. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  2807. }
  2808. // Now, try running with the original client from this new trust server. This should fail.
  2809. runCmd = exec.Command(dockerBinary, "run", repoName)
  2810. s.trustedCmd(runCmd)
  2811. out, _, err = runCommandWithOutput(runCmd)
  2812. if err == nil {
  2813. c.Fatalf("Expected to fail on this run due to different remote data: %s\n%s", err, out)
  2814. }
  2815. if !strings.Contains(string(out), "valid signatures did not meet threshold") {
  2816. c.Fatalf("Missing expected output on trusted push:\n%s", out)
  2817. }
  2818. }
  2819. func (s *DockerSuite) TestPtraceContainerProcsFromHost(c *check.C) {
  2820. // Not applicable on Windows as uses Unix specific functionality
  2821. testRequires(c, DaemonIsLinux, SameHostDaemon)
  2822. out, _ := dockerCmd(c, "run", "-d", "busybox", "top")
  2823. id := strings.TrimSpace(out)
  2824. c.Assert(waitRun(id), check.IsNil)
  2825. pid1, err := inspectField(id, "State.Pid")
  2826. c.Assert(err, check.IsNil)
  2827. _, err = os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
  2828. if err != nil {
  2829. c.Fatal(err)
  2830. }
  2831. }
  2832. func (s *DockerSuite) TestAppArmorDeniesPtrace(c *check.C) {
  2833. // Not applicable on Windows as uses Unix specific functionality
  2834. testRequires(c, SameHostDaemon, Apparmor, DaemonIsLinux, NotGCCGO)
  2835. // Run through 'sh' so we are NOT pid 1. Pid 1 may be able to trace
  2836. // itself, but pid>1 should not be able to trace pid1.
  2837. _, exitCode, _ := dockerCmdWithError("run", "busybox", "sh", "-c", "sh -c readlink /proc/1/ns/net")
  2838. if exitCode == 0 {
  2839. c.Fatal("ptrace was not successfully restricted by AppArmor")
  2840. }
  2841. }
  2842. func (s *DockerSuite) TestAppArmorTraceSelf(c *check.C) {
  2843. // Not applicable on Windows as uses Unix specific functionality
  2844. testRequires(c, DaemonIsLinux, SameHostDaemon, Apparmor)
  2845. _, exitCode, _ := dockerCmdWithError("run", "busybox", "readlink", "/proc/1/ns/net")
  2846. if exitCode != 0 {
  2847. c.Fatal("ptrace of self failed.")
  2848. }
  2849. }
  2850. func (s *DockerSuite) TestAppArmorDeniesChmodProc(c *check.C) {
  2851. // Not applicable on Windows as uses Unix specific functionality
  2852. testRequires(c, SameHostDaemon, Apparmor, DaemonIsLinux, NotUserNamespace)
  2853. _, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "744", "/proc/cpuinfo")
  2854. if exitCode == 0 {
  2855. // If our test failed, attempt to repair the host system...
  2856. _, exitCode, _ := dockerCmdWithError("run", "busybox", "chmod", "444", "/proc/cpuinfo")
  2857. if exitCode == 0 {
  2858. c.Fatal("AppArmor was unsuccessful in prohibiting chmod of /proc/* files.")
  2859. }
  2860. }
  2861. }
  2862. func (s *DockerSuite) TestRunCapAddSYSTIME(c *check.C) {
  2863. // Not applicable on Windows as uses Unix specific functionality
  2864. testRequires(c, DaemonIsLinux)
  2865. dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=SYS_TIME", "busybox", "sh", "-c", "grep ^CapEff /proc/self/status | sed 's/^CapEff:\t//' | grep ^0000000002000000$")
  2866. }
  2867. // run create container failed should clean up the container
  2868. func (s *DockerSuite) TestRunCreateContainerFailedCleanUp(c *check.C) {
  2869. // TODO Windows. This may be possible to enable once link is supported
  2870. testRequires(c, DaemonIsLinux)
  2871. name := "unique_name"
  2872. _, _, err := dockerCmdWithError("run", "--name", name, "--link", "nothing:nothing", "busybox")
  2873. c.Assert(err, check.NotNil, check.Commentf("Expected docker run to fail!"))
  2874. containerID, err := inspectField(name, "Id")
  2875. c.Assert(containerID, check.Equals, "", check.Commentf("Expected not to have this container: %s!", containerID))
  2876. }
  2877. func (s *DockerSuite) TestRunNamedVolume(c *check.C) {
  2878. prefix := ""
  2879. slash := `/`
  2880. if daemonPlatform == "windows" {
  2881. prefix = "c:"
  2882. slash = `\`
  2883. }
  2884. testRequires(c, DaemonIsLinux)
  2885. dockerCmd(c, "run", "--name=test", "-v", "testing:"+prefix+slash+"foo", "busybox", "sh", "-c", "echo hello > "+prefix+"/foo/bar")
  2886. out, _ := dockerCmd(c, "run", "--volumes-from", "test", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
  2887. c.Assert(strings.TrimSpace(out), check.Equals, "hello")
  2888. out, _ = dockerCmd(c, "run", "-v", "testing:"+prefix+slash+"foo", "busybox", "sh", "-c", "cat "+prefix+"/foo/bar")
  2889. c.Assert(strings.TrimSpace(out), check.Equals, "hello")
  2890. }
  2891. func (s *DockerSuite) TestRunWithUlimits(c *check.C) {
  2892. // Not applicable on Windows as uses Unix specific functionality
  2893. testRequires(c, DaemonIsLinux)
  2894. out, _ := dockerCmd(c, "run", "--name=testulimits", "--ulimit", "nofile=42", "busybox", "/bin/sh", "-c", "ulimit -n")
  2895. ul := strings.TrimSpace(out)
  2896. if ul != "42" {
  2897. c.Fatalf("expected `ulimit -n` to be 42, got %s", ul)
  2898. }
  2899. }
  2900. func (s *DockerSuite) TestRunContainerWithCgroupParent(c *check.C) {
  2901. // Not applicable on Windows as uses Unix specific functionality
  2902. testRequires(c, DaemonIsLinux)
  2903. cgroupParent := "test"
  2904. name := "cgroup-test"
  2905. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2906. if err != nil {
  2907. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", string(out), err)
  2908. }
  2909. cgroupPaths := parseCgroupPaths(string(out))
  2910. if len(cgroupPaths) == 0 {
  2911. c.Fatalf("unexpected output - %q", string(out))
  2912. }
  2913. id, err := getIDByName(name)
  2914. c.Assert(err, check.IsNil)
  2915. expectedCgroup := path.Join(cgroupParent, id)
  2916. found := false
  2917. for _, path := range cgroupPaths {
  2918. if strings.HasSuffix(path, expectedCgroup) {
  2919. found = true
  2920. break
  2921. }
  2922. }
  2923. if !found {
  2924. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  2925. }
  2926. }
  2927. func (s *DockerSuite) TestRunContainerWithCgroupParentAbsPath(c *check.C) {
  2928. // Not applicable on Windows as uses Unix specific functionality
  2929. testRequires(c, DaemonIsLinux)
  2930. cgroupParent := "/cgroup-parent/test"
  2931. name := "cgroup-test"
  2932. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2933. if err != nil {
  2934. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", string(out), err)
  2935. }
  2936. cgroupPaths := parseCgroupPaths(string(out))
  2937. if len(cgroupPaths) == 0 {
  2938. c.Fatalf("unexpected output - %q", string(out))
  2939. }
  2940. id, err := getIDByName(name)
  2941. c.Assert(err, check.IsNil)
  2942. expectedCgroup := path.Join(cgroupParent, id)
  2943. found := false
  2944. for _, path := range cgroupPaths {
  2945. if strings.HasSuffix(path, expectedCgroup) {
  2946. found = true
  2947. break
  2948. }
  2949. }
  2950. if !found {
  2951. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  2952. }
  2953. }
  2954. // TestRunInvalidCgroupParent checks that a specially-crafted cgroup parent doesn't cause Docker to crash or start modifying /.
  2955. func (s *DockerSuite) TestRunInvalidCgroupParent(c *check.C) {
  2956. // Not applicable on Windows as uses Unix specific functionality
  2957. testRequires(c, DaemonIsLinux)
  2958. cgroupParent := "../../../../../../../../SHOULD_NOT_EXIST"
  2959. cleanCgroupParent := "SHOULD_NOT_EXIST"
  2960. name := "cgroup-invalid-test"
  2961. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2962. if err != nil {
  2963. // XXX: This may include a daemon crash.
  2964. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", string(out), err)
  2965. }
  2966. // We expect "/SHOULD_NOT_EXIST" to not exist. If not, we have a security issue.
  2967. if _, err := os.Stat("/SHOULD_NOT_EXIST"); err == nil || !os.IsNotExist(err) {
  2968. c.Fatalf("SECURITY: --cgroup-parent with ../../ relative paths cause files to be created in the host (this is bad) !!")
  2969. }
  2970. cgroupPaths := parseCgroupPaths(string(out))
  2971. if len(cgroupPaths) == 0 {
  2972. c.Fatalf("unexpected output - %q", string(out))
  2973. }
  2974. id, err := getIDByName(name)
  2975. c.Assert(err, check.IsNil)
  2976. expectedCgroup := path.Join(cleanCgroupParent, id)
  2977. found := false
  2978. for _, path := range cgroupPaths {
  2979. if strings.HasSuffix(path, expectedCgroup) {
  2980. found = true
  2981. break
  2982. }
  2983. }
  2984. if !found {
  2985. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  2986. }
  2987. }
  2988. // TestRunInvalidCgroupParent checks that a specially-crafted cgroup parent doesn't cause Docker to crash or start modifying /.
  2989. func (s *DockerSuite) TestRunAbsoluteInvalidCgroupParent(c *check.C) {
  2990. // Not applicable on Windows as uses Unix specific functionality
  2991. testRequires(c, DaemonIsLinux)
  2992. cgroupParent := "/../../../../../../../../SHOULD_NOT_EXIST"
  2993. cleanCgroupParent := "/SHOULD_NOT_EXIST"
  2994. name := "cgroup-absolute-invalid-test"
  2995. out, _, err := dockerCmdWithError("run", "--cgroup-parent", cgroupParent, "--name", name, "busybox", "cat", "/proc/self/cgroup")
  2996. if err != nil {
  2997. // XXX: This may include a daemon crash.
  2998. c.Fatalf("unexpected failure when running container with --cgroup-parent option - %s\n%v", string(out), err)
  2999. }
  3000. // We expect "/SHOULD_NOT_EXIST" to not exist. If not, we have a security issue.
  3001. if _, err := os.Stat("/SHOULD_NOT_EXIST"); err == nil || !os.IsNotExist(err) {
  3002. c.Fatalf("SECURITY: --cgroup-parent with /../../ garbage paths cause files to be created in the host (this is bad) !!")
  3003. }
  3004. cgroupPaths := parseCgroupPaths(string(out))
  3005. if len(cgroupPaths) == 0 {
  3006. c.Fatalf("unexpected output - %q", string(out))
  3007. }
  3008. id, err := getIDByName(name)
  3009. c.Assert(err, check.IsNil)
  3010. expectedCgroup := path.Join(cleanCgroupParent, id)
  3011. found := false
  3012. for _, path := range cgroupPaths {
  3013. if strings.HasSuffix(path, expectedCgroup) {
  3014. found = true
  3015. break
  3016. }
  3017. }
  3018. if !found {
  3019. c.Fatalf("unexpected cgroup paths. Expected at least one cgroup path to have suffix %q. Cgroup Paths: %v", expectedCgroup, cgroupPaths)
  3020. }
  3021. }
  3022. func (s *DockerSuite) TestRunContainerWithCgroupMountRO(c *check.C) {
  3023. // Not applicable on Windows as uses Unix specific functionality
  3024. // --read-only + userns has remount issues
  3025. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3026. filename := "/sys/fs/cgroup/devices/test123"
  3027. out, _, err := dockerCmdWithError("run", "busybox", "touch", filename)
  3028. if err == nil {
  3029. c.Fatal("expected cgroup mount point to be read-only, touch file should fail")
  3030. }
  3031. expected := "Read-only file system"
  3032. if !strings.Contains(out, expected) {
  3033. c.Fatalf("expected output from failure to contain %s but contains %s", expected, out)
  3034. }
  3035. }
  3036. func (s *DockerSuite) TestRunContainerNetworkModeToSelf(c *check.C) {
  3037. // Not applicable on Windows which does not support --net=container
  3038. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3039. out, _, err := dockerCmdWithError("run", "--name=me", "--net=container:me", "busybox", "true")
  3040. if err == nil || !strings.Contains(out, "cannot join own network") {
  3041. c.Fatalf("using container net mode to self should result in an error\nerr: %q\nout: %s", err, out)
  3042. }
  3043. }
  3044. func (s *DockerSuite) TestRunContainerNetModeWithDnsMacHosts(c *check.C) {
  3045. // Not applicable on Windows which does not support --net=container
  3046. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3047. out, _, err := dockerCmdWithError("run", "-d", "--name", "parent", "busybox", "top")
  3048. if err != nil {
  3049. c.Fatalf("failed to run container: %v, output: %q", err, out)
  3050. }
  3051. out, _, err = dockerCmdWithError("run", "--dns", "1.2.3.4", "--net=container:parent", "busybox")
  3052. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkAndDNS.Error()) {
  3053. c.Fatalf("run --net=container with --dns should error out")
  3054. }
  3055. out, _, err = dockerCmdWithError("run", "--mac-address", "92:d0:c6:0a:29:33", "--net=container:parent", "busybox")
  3056. if err == nil || !strings.Contains(out, runconfig.ErrConflictContainerNetworkAndMac.Error()) {
  3057. c.Fatalf("run --net=container with --mac-address should error out")
  3058. }
  3059. out, _, err = dockerCmdWithError("run", "--add-host", "test:192.168.2.109", "--net=container:parent", "busybox")
  3060. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkHosts.Error()) {
  3061. c.Fatalf("run --net=container with --add-host should error out")
  3062. }
  3063. }
  3064. func (s *DockerSuite) TestRunContainerNetModeWithExposePort(c *check.C) {
  3065. // Not applicable on Windows which does not support --net=container
  3066. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3067. dockerCmd(c, "run", "-d", "--name", "parent", "busybox", "top")
  3068. out, _, err := dockerCmdWithError("run", "-p", "5000:5000", "--net=container:parent", "busybox")
  3069. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkPublishPorts.Error()) {
  3070. c.Fatalf("run --net=container with -p should error out")
  3071. }
  3072. out, _, err = dockerCmdWithError("run", "-P", "--net=container:parent", "busybox")
  3073. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkPublishPorts.Error()) {
  3074. c.Fatalf("run --net=container with -P should error out")
  3075. }
  3076. out, _, err = dockerCmdWithError("run", "--expose", "5000", "--net=container:parent", "busybox")
  3077. if err == nil || !strings.Contains(out, runconfig.ErrConflictNetworkExposePorts.Error()) {
  3078. c.Fatalf("run --net=container with --expose should error out")
  3079. }
  3080. }
  3081. func (s *DockerSuite) TestRunLinkToContainerNetMode(c *check.C) {
  3082. // Not applicable on Windows which does not support --net=container or --link
  3083. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3084. dockerCmd(c, "run", "--name", "test", "-d", "busybox", "top")
  3085. dockerCmd(c, "run", "--name", "parent", "-d", "--net=container:test", "busybox", "top")
  3086. dockerCmd(c, "run", "-d", "--link=parent:parent", "busybox", "top")
  3087. dockerCmd(c, "run", "--name", "child", "-d", "--net=container:parent", "busybox", "top")
  3088. dockerCmd(c, "run", "-d", "--link=child:child", "busybox", "top")
  3089. }
  3090. func (s *DockerSuite) TestRunLoopbackOnlyExistsWhenNetworkingDisabled(c *check.C) {
  3091. // TODO Windows: This may be possible to convert.
  3092. testRequires(c, DaemonIsLinux)
  3093. out, _ := dockerCmd(c, "run", "--net=none", "busybox", "ip", "-o", "-4", "a", "show", "up")
  3094. var (
  3095. count = 0
  3096. parts = strings.Split(out, "\n")
  3097. )
  3098. for _, l := range parts {
  3099. if l != "" {
  3100. count++
  3101. }
  3102. }
  3103. if count != 1 {
  3104. c.Fatalf("Wrong interface count in container %d", count)
  3105. }
  3106. if !strings.HasPrefix(out, "1: lo") {
  3107. c.Fatalf("Wrong interface in test container: expected [1: lo], got %s", out)
  3108. }
  3109. }
  3110. // Issue #4681
  3111. func (s *DockerSuite) TestRunLoopbackWhenNetworkDisabled(c *check.C) {
  3112. if daemonPlatform == "windows" {
  3113. dockerCmd(c, "run", "--net=none", WindowsBaseImage, "ping", "-n", "1", "127.0.0.1")
  3114. } else {
  3115. dockerCmd(c, "run", "--net=none", "busybox", "ping", "-c", "1", "127.0.0.1")
  3116. }
  3117. }
  3118. func (s *DockerSuite) TestRunModeNetContainerHostname(c *check.C) {
  3119. // Windows does not support --net=container
  3120. testRequires(c, DaemonIsLinux, ExecSupport, NotUserNamespace)
  3121. dockerCmd(c, "run", "-i", "-d", "--name", "parent", "busybox", "top")
  3122. out, _ := dockerCmd(c, "exec", "parent", "cat", "/etc/hostname")
  3123. out1, _ := dockerCmd(c, "run", "--net=container:parent", "busybox", "cat", "/etc/hostname")
  3124. if out1 != out {
  3125. c.Fatal("containers with shared net namespace should have same hostname")
  3126. }
  3127. }
  3128. func (s *DockerSuite) TestRunNetworkNotInitializedNoneMode(c *check.C) {
  3129. // TODO Windows: Network settings are not currently propagated. This may
  3130. // be resolved in the future with the move to libnetwork and CNM.
  3131. testRequires(c, DaemonIsLinux)
  3132. out, _ := dockerCmd(c, "run", "-d", "--net=none", "busybox", "top")
  3133. id := strings.TrimSpace(out)
  3134. res, err := inspectField(id, "NetworkSettings.Networks.none.IPAddress")
  3135. c.Assert(err, check.IsNil)
  3136. if res != "" {
  3137. c.Fatalf("For 'none' mode network must not be initialized, but container got IP: %s", res)
  3138. }
  3139. }
  3140. func (s *DockerSuite) TestTwoContainersInNetHost(c *check.C) {
  3141. // Not applicable as Windows does not support --net=host
  3142. testRequires(c, DaemonIsLinux, NotUserNamespace, NotUserNamespace)
  3143. dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
  3144. dockerCmd(c, "run", "-d", "--net=host", "--name=second", "busybox", "top")
  3145. dockerCmd(c, "stop", "first")
  3146. dockerCmd(c, "stop", "second")
  3147. }
  3148. func (s *DockerSuite) TestContainersInUserDefinedNetwork(c *check.C) {
  3149. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  3150. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork")
  3151. dockerCmd(c, "run", "-d", "--net=testnetwork", "--name=first", "busybox", "top")
  3152. c.Assert(waitRun("first"), check.IsNil)
  3153. dockerCmd(c, "run", "-t", "--net=testnetwork", "--name=second", "busybox", "ping", "-c", "1", "first")
  3154. }
  3155. func (s *DockerSuite) TestContainersInMultipleNetworks(c *check.C) {
  3156. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  3157. // Create 2 networks using bridge driver
  3158. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3159. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  3160. // Run and connect containers to testnetwork1
  3161. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  3162. c.Assert(waitRun("first"), check.IsNil)
  3163. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3164. c.Assert(waitRun("second"), check.IsNil)
  3165. // Check connectivity between containers in testnetwork2
  3166. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3167. // Connect containers to testnetwork2
  3168. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  3169. dockerCmd(c, "network", "connect", "testnetwork2", "second")
  3170. // Check connectivity between containers
  3171. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  3172. }
  3173. func (s *DockerSuite) TestContainersNetworkIsolation(c *check.C) {
  3174. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  3175. // Create 2 networks using bridge driver
  3176. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3177. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  3178. // Run 1 container in testnetwork1 and another in testnetwork2
  3179. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  3180. c.Assert(waitRun("first"), check.IsNil)
  3181. dockerCmd(c, "run", "-d", "--net=testnetwork2", "--name=second", "busybox", "top")
  3182. c.Assert(waitRun("second"), check.IsNil)
  3183. // Check Isolation between containers : ping must fail
  3184. _, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  3185. c.Assert(err, check.NotNil)
  3186. // Connect first container to testnetwork2
  3187. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  3188. // ping must succeed now
  3189. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  3190. c.Assert(err, check.IsNil)
  3191. // Disconnect first container from testnetwork2
  3192. dockerCmd(c, "network", "disconnect", "testnetwork2", "first")
  3193. // ping must fail again
  3194. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second")
  3195. c.Assert(err, check.NotNil)
  3196. }
  3197. func (s *DockerSuite) TestNetworkRmWithActiveContainers(c *check.C) {
  3198. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3199. // Create 2 networks using bridge driver
  3200. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3201. // Run and connect containers to testnetwork1
  3202. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  3203. c.Assert(waitRun("first"), check.IsNil)
  3204. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3205. c.Assert(waitRun("second"), check.IsNil)
  3206. // Network delete with active containers must fail
  3207. _, _, err := dockerCmdWithError("network", "rm", "testnetwork1")
  3208. c.Assert(err, check.NotNil)
  3209. dockerCmd(c, "stop", "first")
  3210. _, _, err = dockerCmdWithError("network", "rm", "testnetwork1")
  3211. c.Assert(err, check.NotNil)
  3212. }
  3213. func (s *DockerSuite) TestContainerRestartInMultipleNetworks(c *check.C) {
  3214. testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
  3215. // Create 2 networks using bridge driver
  3216. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3217. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork2")
  3218. // Run and connect containers to testnetwork1
  3219. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=first", "busybox", "top")
  3220. c.Assert(waitRun("first"), check.IsNil)
  3221. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3222. c.Assert(waitRun("second"), check.IsNil)
  3223. // Check connectivity between containers in testnetwork2
  3224. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3225. // Connect containers to testnetwork2
  3226. dockerCmd(c, "network", "connect", "testnetwork2", "first")
  3227. dockerCmd(c, "network", "connect", "testnetwork2", "second")
  3228. // Check connectivity between containers
  3229. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  3230. // Stop second container and test ping failures on both networks
  3231. dockerCmd(c, "stop", "second")
  3232. _, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3233. c.Assert(err, check.NotNil)
  3234. _, _, err = dockerCmdWithError("exec", "first", "ping", "-c", "1", "second.testnetwork2")
  3235. c.Assert(err, check.NotNil)
  3236. // Start second container and connectivity must be restored on both networks
  3237. dockerCmd(c, "start", "second")
  3238. dockerCmd(c, "exec", "first", "ping", "-c", "1", "second.testnetwork1")
  3239. dockerCmd(c, "exec", "second", "ping", "-c", "1", "first.testnetwork2")
  3240. }
  3241. func (s *DockerSuite) TestContainerWithConflictingHostNetworks(c *check.C) {
  3242. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3243. // Run a container with --net=host
  3244. dockerCmd(c, "run", "-d", "--net=host", "--name=first", "busybox", "top")
  3245. c.Assert(waitRun("first"), check.IsNil)
  3246. // Create a network using bridge driver
  3247. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3248. // Connecting to the user defined network must fail
  3249. _, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
  3250. c.Assert(err, check.NotNil)
  3251. }
  3252. func (s *DockerSuite) TestContainerWithConflictingSharedNetwork(c *check.C) {
  3253. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3254. dockerCmd(c, "run", "-d", "--name=first", "busybox", "top")
  3255. c.Assert(waitRun("first"), check.IsNil)
  3256. // Run second container in first container's network namespace
  3257. dockerCmd(c, "run", "-d", "--net=container:first", "--name=second", "busybox", "top")
  3258. c.Assert(waitRun("second"), check.IsNil)
  3259. // Create a network using bridge driver
  3260. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3261. // Connecting to the user defined network must fail
  3262. out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "second")
  3263. c.Assert(err, check.NotNil)
  3264. c.Assert(out, checker.Contains, runconfig.ErrConflictSharedNetwork.Error())
  3265. }
  3266. func (s *DockerSuite) TestContainerWithConflictingNoneNetwork(c *check.C) {
  3267. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3268. dockerCmd(c, "run", "-d", "--net=none", "--name=first", "busybox", "top")
  3269. c.Assert(waitRun("first"), check.IsNil)
  3270. // Create a network using bridge driver
  3271. dockerCmd(c, "network", "create", "-d", "bridge", "testnetwork1")
  3272. // Connecting to the user defined network must fail
  3273. out, _, err := dockerCmdWithError("network", "connect", "testnetwork1", "first")
  3274. c.Assert(err, check.NotNil)
  3275. c.Assert(out, checker.Contains, runconfig.ErrConflictNoNetwork.Error())
  3276. // create a container connected to testnetwork1
  3277. dockerCmd(c, "run", "-d", "--net=testnetwork1", "--name=second", "busybox", "top")
  3278. c.Assert(waitRun("second"), check.IsNil)
  3279. // Connect second container to none network. it must fail as well
  3280. _, _, err = dockerCmdWithError("network", "connect", "none", "second")
  3281. c.Assert(err, check.NotNil)
  3282. }
  3283. // #11957 - stdin with no tty does not exit if stdin is not closed even though container exited
  3284. func (s *DockerSuite) TestRunStdinBlockedAfterContainerExit(c *check.C) {
  3285. cmd := exec.Command(dockerBinary, "run", "-i", "--name=test", "busybox", "true")
  3286. in, err := cmd.StdinPipe()
  3287. c.Assert(err, check.IsNil)
  3288. defer in.Close()
  3289. c.Assert(cmd.Start(), check.IsNil)
  3290. waitChan := make(chan error)
  3291. go func() {
  3292. waitChan <- cmd.Wait()
  3293. }()
  3294. select {
  3295. case err := <-waitChan:
  3296. c.Assert(err, check.IsNil)
  3297. case <-time.After(30 * time.Second):
  3298. c.Fatal("timeout waiting for command to exit")
  3299. }
  3300. }
  3301. func (s *DockerSuite) TestRunWrongCpusetCpusFlagValue(c *check.C) {
  3302. // TODO Windows: This needs validation (error out) in the daemon.
  3303. testRequires(c, DaemonIsLinux)
  3304. out, exitCode, err := dockerCmdWithError("run", "--cpuset-cpus", "1-10,11--", "busybox", "true")
  3305. c.Assert(err, check.NotNil)
  3306. expected := "Error response from daemon: Invalid value 1-10,11-- for cpuset cpus.\n"
  3307. if !(strings.Contains(out, expected) || exitCode == 125) {
  3308. c.Fatalf("Expected output to contain %q with exitCode 125, got out: %q exitCode: %v", expected, out, exitCode)
  3309. }
  3310. }
  3311. func (s *DockerSuite) TestRunWrongCpusetMemsFlagValue(c *check.C) {
  3312. // TODO Windows: This needs validation (error out) in the daemon.
  3313. testRequires(c, DaemonIsLinux)
  3314. out, exitCode, err := dockerCmdWithError("run", "--cpuset-mems", "1-42--", "busybox", "true")
  3315. c.Assert(err, check.NotNil)
  3316. expected := "Error response from daemon: Invalid value 1-42-- for cpuset mems.\n"
  3317. if !(strings.Contains(out, expected) || exitCode == 125) {
  3318. c.Fatalf("Expected output to contain %q with exitCode 125, got out: %q exitCode: %v", expected, out, exitCode)
  3319. }
  3320. }
  3321. // TestRunNonExecutableCmd checks that 'docker run busybox foo' exits with error code 127'
  3322. func (s *DockerSuite) TestRunNonExecutableCmd(c *check.C) {
  3323. name := "testNonExecutableCmd"
  3324. runCmd := exec.Command(dockerBinary, "run", "--name", name, "busybox", "foo")
  3325. _, exit, _ := runCommandWithOutput(runCmd)
  3326. stateExitCode := findContainerExitCode(c, name)
  3327. if !(exit == 127 && strings.Contains(stateExitCode, "127")) {
  3328. c.Fatalf("Run non-executable command should have errored with exit code 127, but we got exit: %d, State.ExitCode: %s", exit, stateExitCode)
  3329. }
  3330. }
  3331. // TestRunNonExistingCmd checks that 'docker run busybox /bin/foo' exits with code 127.
  3332. func (s *DockerSuite) TestRunNonExistingCmd(c *check.C) {
  3333. name := "testNonExistingCmd"
  3334. runCmd := exec.Command(dockerBinary, "run", "--name", name, "busybox", "/bin/foo")
  3335. _, exit, _ := runCommandWithOutput(runCmd)
  3336. stateExitCode := findContainerExitCode(c, name)
  3337. if !(exit == 127 && strings.Contains(stateExitCode, "127")) {
  3338. c.Fatalf("Run non-existing command should have errored with exit code 127, but we got exit: %d, State.ExitCode: %s", exit, stateExitCode)
  3339. }
  3340. }
  3341. // TestCmdCannotBeInvoked checks that 'docker run busybox /etc' exits with 126, or
  3342. // 127 on Windows. The difference is that in Windows, the container must be started
  3343. // as that's when the check is made (and yes, by it's design...)
  3344. func (s *DockerSuite) TestCmdCannotBeInvoked(c *check.C) {
  3345. expected := 126
  3346. if daemonPlatform == "windows" {
  3347. expected = 127
  3348. }
  3349. name := "testCmdCannotBeInvoked"
  3350. runCmd := exec.Command(dockerBinary, "run", "--name", name, "busybox", "/etc")
  3351. _, exit, _ := runCommandWithOutput(runCmd)
  3352. stateExitCode := findContainerExitCode(c, name)
  3353. if !(exit == expected && strings.Contains(stateExitCode, strconv.Itoa(expected))) {
  3354. c.Fatalf("Run cmd that cannot be invoked should have errored with code %d, but we got exit: %d, State.ExitCode: %s", expected, exit, stateExitCode)
  3355. }
  3356. }
  3357. // TestRunNonExistingImage checks that 'docker run foo' exits with error msg 125 and contains 'Unable to find image'
  3358. func (s *DockerSuite) TestRunNonExistingImage(c *check.C) {
  3359. runCmd := exec.Command(dockerBinary, "run", "foo")
  3360. out, exit, err := runCommandWithOutput(runCmd)
  3361. if !(err != nil && exit == 125 && strings.Contains(out, "Unable to find image")) {
  3362. c.Fatalf("Run non-existing image should have errored with 'Unable to find image' code 125, but we got out: %s, exit: %d, err: %s", out, exit, err)
  3363. }
  3364. }
  3365. // TestDockerFails checks that 'docker run -foo busybox' exits with 125 to signal docker run failed
  3366. func (s *DockerSuite) TestDockerFails(c *check.C) {
  3367. runCmd := exec.Command(dockerBinary, "run", "-foo", "busybox")
  3368. out, exit, err := runCommandWithOutput(runCmd)
  3369. if !(err != nil && exit == 125) {
  3370. c.Fatalf("Docker run with flag not defined should exit with 125, but we got out: %s, exit: %d, err: %s", out, exit, err)
  3371. }
  3372. }
  3373. // TestRunInvalidReference invokes docker run with a bad reference.
  3374. func (s *DockerSuite) TestRunInvalidReference(c *check.C) {
  3375. out, exit, _ := dockerCmdWithError("run", "busybox@foo")
  3376. if exit == 0 {
  3377. c.Fatalf("expected non-zero exist code; received %d", exit)
  3378. }
  3379. if !strings.Contains(out, "Error parsing reference") {
  3380. c.Fatalf(`Expected "Error parsing reference" in output; got: %s`, out)
  3381. }
  3382. }
  3383. // Test fix for issue #17854
  3384. func (s *DockerSuite) TestRunInitLayerPathOwnership(c *check.C) {
  3385. // Not applicable on Windows as it does not support Linux uid/gid ownership
  3386. testRequires(c, DaemonIsLinux)
  3387. name := "testetcfileownership"
  3388. _, err := buildImage(name,
  3389. `FROM busybox
  3390. RUN echo 'dockerio:x:1001:1001::/bin:/bin/false' >> /etc/passwd
  3391. RUN echo 'dockerio:x:1001:' >> /etc/group
  3392. RUN chown dockerio:dockerio /etc`,
  3393. true)
  3394. if err != nil {
  3395. c.Fatal(err)
  3396. }
  3397. // Test that dockerio ownership of /etc is retained at runtime
  3398. out, _ := dockerCmd(c, "run", "--rm", name, "stat", "-c", "%U:%G", "/etc")
  3399. out = strings.TrimSpace(out)
  3400. if out != "dockerio:dockerio" {
  3401. c.Fatalf("Wrong /etc ownership: expected dockerio:dockerio, got %q", out)
  3402. }
  3403. }
  3404. func (s *DockerSuite) TestRunWithOomScoreAdj(c *check.C) {
  3405. testRequires(c, DaemonIsLinux)
  3406. expected := "642"
  3407. out, _ := dockerCmd(c, "run", "--oom-score-adj", expected, "busybox", "cat", "/proc/self/oom_score_adj")
  3408. oomScoreAdj := strings.TrimSpace(out)
  3409. if oomScoreAdj != "642" {
  3410. c.Fatalf("Expected oom_score_adj set to %q, got %q instead", expected, oomScoreAdj)
  3411. }
  3412. }
  3413. func (s *DockerSuite) TestRunWithOomScoreAdjInvalidRange(c *check.C) {
  3414. testRequires(c, DaemonIsLinux)
  3415. out, _, err := dockerCmdWithError("run", "--oom-score-adj", "1001", "busybox", "true")
  3416. c.Assert(err, check.NotNil)
  3417. expected := "Invalid value 1001, range for oom score adj is [-1000, 1000]."
  3418. if !strings.Contains(out, expected) {
  3419. c.Fatalf("Expected output to contain %q, got %q instead", expected, out)
  3420. }
  3421. out, _, err = dockerCmdWithError("run", "--oom-score-adj", "-1001", "busybox", "true")
  3422. c.Assert(err, check.NotNil)
  3423. expected = "Invalid value -1001, range for oom score adj is [-1000, 1000]."
  3424. if !strings.Contains(out, expected) {
  3425. c.Fatalf("Expected output to contain %q, got %q instead", expected, out)
  3426. }
  3427. }
  3428. func (s *DockerSuite) TestRunVolumesMountedAsShared(c *check.C) {
  3429. // Volume propagation is linux only. Also it creates directories for
  3430. // bind mounting, so needs to be same host.
  3431. testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
  3432. // Prepare a source directory to bind mount
  3433. tmpDir, err := ioutil.TempDir("", "volume-source")
  3434. if err != nil {
  3435. c.Fatal(err)
  3436. }
  3437. defer os.RemoveAll(tmpDir)
  3438. if err := os.Mkdir(path.Join(tmpDir, "mnt1"), 0755); err != nil {
  3439. c.Fatal(err)
  3440. }
  3441. // Convert this directory into a shared mount point so that we do
  3442. // not rely on propagation properties of parent mount.
  3443. cmd := exec.Command("mount", "--bind", tmpDir, tmpDir)
  3444. if _, err = runCommand(cmd); err != nil {
  3445. c.Fatal(err)
  3446. }
  3447. cmd = exec.Command("mount", "--make-private", "--make-shared", tmpDir)
  3448. if _, err = runCommand(cmd); err != nil {
  3449. c.Fatal(err)
  3450. }
  3451. dockerCmd(c, "run", "--privileged", "-v", fmt.Sprintf("%s:/volume-dest:shared", tmpDir), "busybox", "mount", "--bind", "/volume-dest/mnt1", "/volume-dest/mnt1")
  3452. // Make sure a bind mount under a shared volume propagated to host.
  3453. if mounted, _ := mount.Mounted(path.Join(tmpDir, "mnt1")); !mounted {
  3454. c.Fatalf("Bind mount under shared volume did not propagate to host")
  3455. }
  3456. mount.Unmount(path.Join(tmpDir, "mnt1"))
  3457. }
  3458. func (s *DockerSuite) TestRunVolumesMountedAsSlave(c *check.C) {
  3459. // Volume propagation is linux only. Also it creates directories for
  3460. // bind mounting, so needs to be same host.
  3461. testRequires(c, DaemonIsLinux, SameHostDaemon, NotUserNamespace)
  3462. // Prepare a source directory to bind mount
  3463. tmpDir, err := ioutil.TempDir("", "volume-source")
  3464. if err != nil {
  3465. c.Fatal(err)
  3466. }
  3467. defer os.RemoveAll(tmpDir)
  3468. if err := os.Mkdir(path.Join(tmpDir, "mnt1"), 0755); err != nil {
  3469. c.Fatal(err)
  3470. }
  3471. // Prepare a source directory with file in it. We will bind mount this
  3472. // direcotry and see if file shows up.
  3473. tmpDir2, err := ioutil.TempDir("", "volume-source2")
  3474. if err != nil {
  3475. c.Fatal(err)
  3476. }
  3477. defer os.RemoveAll(tmpDir2)
  3478. if err := ioutil.WriteFile(path.Join(tmpDir2, "slave-testfile"), []byte("Test"), 0644); err != nil {
  3479. c.Fatal(err)
  3480. }
  3481. // Convert this directory into a shared mount point so that we do
  3482. // not rely on propagation properties of parent mount.
  3483. cmd := exec.Command("mount", "--bind", tmpDir, tmpDir)
  3484. if _, err = runCommand(cmd); err != nil {
  3485. c.Fatal(err)
  3486. }
  3487. cmd = exec.Command("mount", "--make-private", "--make-shared", tmpDir)
  3488. if _, err = runCommand(cmd); err != nil {
  3489. c.Fatal(err)
  3490. }
  3491. dockerCmd(c, "run", "-i", "-d", "--name", "parent", "-v", fmt.Sprintf("%s:/volume-dest:slave", tmpDir), "busybox", "top")
  3492. // Bind mount tmpDir2/ onto tmpDir/mnt1. If mount propagates inside
  3493. // container then contents of tmpDir2/slave-testfile should become
  3494. // visible at "/volume-dest/mnt1/slave-testfile"
  3495. cmd = exec.Command("mount", "--bind", tmpDir2, path.Join(tmpDir, "mnt1"))
  3496. if _, err = runCommand(cmd); err != nil {
  3497. c.Fatal(err)
  3498. }
  3499. out, _ := dockerCmd(c, "exec", "parent", "cat", "/volume-dest/mnt1/slave-testfile")
  3500. mount.Unmount(path.Join(tmpDir, "mnt1"))
  3501. if out != "Test" {
  3502. c.Fatalf("Bind mount under slave volume did not propagate to container")
  3503. }
  3504. }
  3505. func (s *DockerSuite) TestRunNamedVolumesMountedAsShared(c *check.C) {
  3506. testRequires(c, DaemonIsLinux, NotUserNamespace)
  3507. out, exitcode, _ := dockerCmdWithError("run", "-v", "foo:/test:shared", "busybox", "touch", "/test/somefile")
  3508. if exitcode == 0 {
  3509. c.Fatalf("expected non-zero exit code; received %d", exitcode)
  3510. }
  3511. if expected := "Invalid volume specification"; !strings.Contains(out, expected) {
  3512. c.Fatalf(`Expected %q in output; got: %s`, expected, out)
  3513. }
  3514. }
  3515. func (s *DockerSuite) TestRunNamedVolumeCopyImageData(c *check.C) {
  3516. testRequires(c, DaemonIsLinux)
  3517. testImg := "testvolumecopy"
  3518. _, err := buildImage(testImg, `
  3519. FROM busybox
  3520. RUN mkdir -p /foo && echo hello > /foo/hello
  3521. `, true)
  3522. c.Assert(err, check.IsNil)
  3523. dockerCmd(c, "run", "-v", "foo:/foo", testImg)
  3524. out, _ := dockerCmd(c, "run", "-v", "foo:/foo", "busybox", "cat", "/foo/hello")
  3525. c.Assert(strings.TrimSpace(out), check.Equals, "hello")
  3526. }