docker_cli_daemon_test.go 39 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244
  1. // +build daemon
  2. package main
  3. import (
  4. "encoding/json"
  5. "fmt"
  6. "io/ioutil"
  7. "net"
  8. "os"
  9. "os/exec"
  10. "path/filepath"
  11. "regexp"
  12. "strconv"
  13. "strings"
  14. "time"
  15. "github.com/docker/libnetwork/iptables"
  16. "github.com/docker/libtrust"
  17. "github.com/go-check/check"
  18. )
  19. func (s *DockerDaemonSuite) TestDaemonRestartWithRunningContainersPorts(c *check.C) {
  20. if err := s.d.StartWithBusybox(); err != nil {
  21. c.Fatalf("Could not start daemon with busybox: %v", err)
  22. }
  23. if out, err := s.d.Cmd("run", "-d", "--name", "top1", "-p", "1234:80", "--restart", "always", "busybox:latest", "top"); err != nil {
  24. c.Fatalf("Could not run top1: err=%v\n%s", err, out)
  25. }
  26. // --restart=no by default
  27. if out, err := s.d.Cmd("run", "-d", "--name", "top2", "-p", "80", "busybox:latest", "top"); err != nil {
  28. c.Fatalf("Could not run top2: err=%v\n%s", err, out)
  29. }
  30. testRun := func(m map[string]bool, prefix string) {
  31. var format string
  32. for cont, shouldRun := range m {
  33. out, err := s.d.Cmd("ps")
  34. if err != nil {
  35. c.Fatalf("Could not run ps: err=%v\n%q", err, out)
  36. }
  37. if shouldRun {
  38. format = "%scontainer %q is not running"
  39. } else {
  40. format = "%scontainer %q is running"
  41. }
  42. if shouldRun != strings.Contains(out, cont) {
  43. c.Fatalf(format, prefix, cont)
  44. }
  45. }
  46. }
  47. testRun(map[string]bool{"top1": true, "top2": true}, "")
  48. if err := s.d.Restart(); err != nil {
  49. c.Fatalf("Could not restart daemon: %v", err)
  50. }
  51. testRun(map[string]bool{"top1": true, "top2": false}, "After daemon restart: ")
  52. }
  53. func (s *DockerDaemonSuite) TestDaemonRestartWithVolumesRefs(c *check.C) {
  54. if err := s.d.StartWithBusybox(); err != nil {
  55. c.Fatal(err)
  56. }
  57. if out, err := s.d.Cmd("run", "-d", "--name", "volrestarttest1", "-v", "/foo", "busybox"); err != nil {
  58. c.Fatal(err, out)
  59. }
  60. if err := s.d.Restart(); err != nil {
  61. c.Fatal(err)
  62. }
  63. if _, err := s.d.Cmd("run", "-d", "--volumes-from", "volrestarttest1", "--name", "volrestarttest2", "busybox", "top"); err != nil {
  64. c.Fatal(err)
  65. }
  66. if out, err := s.d.Cmd("rm", "-fv", "volrestarttest2"); err != nil {
  67. c.Fatal(err, out)
  68. }
  69. v, err := s.d.Cmd("inspect", "--format", "{{ json .Volumes }}", "volrestarttest1")
  70. if err != nil {
  71. c.Fatal(err)
  72. }
  73. volumes := make(map[string]string)
  74. json.Unmarshal([]byte(v), &volumes)
  75. if _, err := os.Stat(volumes["/foo"]); err != nil {
  76. c.Fatalf("Expected volume to exist: %s - %s", volumes["/foo"], err)
  77. }
  78. }
  79. func (s *DockerDaemonSuite) TestDaemonStartIptablesFalse(c *check.C) {
  80. if err := s.d.Start("--iptables=false"); err != nil {
  81. c.Fatalf("we should have been able to start the daemon with passing iptables=false: %v", err)
  82. }
  83. }
  84. // Issue #8444: If docker0 bridge is modified (intentionally or unintentionally) and
  85. // no longer has an IP associated, we should gracefully handle that case and associate
  86. // an IP with it rather than fail daemon start
  87. func (s *DockerDaemonSuite) TestDaemonStartBridgeWithoutIPAssociation(c *check.C) {
  88. // rather than depending on brctl commands to verify docker0 is created and up
  89. // let's start the daemon and stop it, and then make a modification to run the
  90. // actual test
  91. if err := s.d.Start(); err != nil {
  92. c.Fatalf("Could not start daemon: %v", err)
  93. }
  94. if err := s.d.Stop(); err != nil {
  95. c.Fatalf("Could not stop daemon: %v", err)
  96. }
  97. // now we will remove the ip from docker0 and then try starting the daemon
  98. ipCmd := exec.Command("ip", "addr", "flush", "dev", "docker0")
  99. stdout, stderr, _, err := runCommandWithStdoutStderr(ipCmd)
  100. if err != nil {
  101. c.Fatalf("failed to remove docker0 IP association: %v, stdout: %q, stderr: %q", err, stdout, stderr)
  102. }
  103. if err := s.d.Start(); err != nil {
  104. warning := "**WARNING: Docker bridge network in bad state--delete docker0 bridge interface to fix"
  105. c.Fatalf("Could not start daemon when docker0 has no IP address: %v\n%s", err, warning)
  106. }
  107. }
  108. func (s *DockerDaemonSuite) TestDaemonIptablesClean(c *check.C) {
  109. if err := s.d.StartWithBusybox(); err != nil {
  110. c.Fatalf("Could not start daemon with busybox: %v", err)
  111. }
  112. if out, err := s.d.Cmd("run", "-d", "--name", "top", "-p", "80", "busybox:latest", "top"); err != nil {
  113. c.Fatalf("Could not run top: %s, %v", out, err)
  114. }
  115. // get output from iptables with container running
  116. ipTablesSearchString := "tcp dpt:80"
  117. ipTablesCmd := exec.Command("iptables", "-nvL")
  118. out, _, err := runCommandWithOutput(ipTablesCmd)
  119. if err != nil {
  120. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  121. }
  122. if !strings.Contains(out, ipTablesSearchString) {
  123. c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)
  124. }
  125. if err := s.d.Stop(); err != nil {
  126. c.Fatalf("Could not stop daemon: %v", err)
  127. }
  128. // get output from iptables after restart
  129. ipTablesCmd = exec.Command("iptables", "-nvL")
  130. out, _, err = runCommandWithOutput(ipTablesCmd)
  131. if err != nil {
  132. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  133. }
  134. if strings.Contains(out, ipTablesSearchString) {
  135. c.Fatalf("iptables output should not have contained %q, but was %q", ipTablesSearchString, out)
  136. }
  137. }
  138. func (s *DockerDaemonSuite) TestDaemonIptablesCreate(c *check.C) {
  139. if err := s.d.StartWithBusybox(); err != nil {
  140. c.Fatalf("Could not start daemon with busybox: %v", err)
  141. }
  142. if out, err := s.d.Cmd("run", "-d", "--name", "top", "--restart=always", "-p", "80", "busybox:latest", "top"); err != nil {
  143. c.Fatalf("Could not run top: %s, %v", out, err)
  144. }
  145. // get output from iptables with container running
  146. ipTablesSearchString := "tcp dpt:80"
  147. ipTablesCmd := exec.Command("iptables", "-nvL")
  148. out, _, err := runCommandWithOutput(ipTablesCmd)
  149. if err != nil {
  150. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  151. }
  152. if !strings.Contains(out, ipTablesSearchString) {
  153. c.Fatalf("iptables output should have contained %q, but was %q", ipTablesSearchString, out)
  154. }
  155. if err := s.d.Restart(); err != nil {
  156. c.Fatalf("Could not restart daemon: %v", err)
  157. }
  158. // make sure the container is not running
  159. runningOut, err := s.d.Cmd("inspect", "--format='{{.State.Running}}'", "top")
  160. if err != nil {
  161. c.Fatalf("Could not inspect on container: %s, %v", out, err)
  162. }
  163. if strings.TrimSpace(runningOut) != "true" {
  164. c.Fatalf("Container should have been restarted after daemon restart. Status running should have been true but was: %q", strings.TrimSpace(runningOut))
  165. }
  166. // get output from iptables after restart
  167. ipTablesCmd = exec.Command("iptables", "-nvL")
  168. out, _, err = runCommandWithOutput(ipTablesCmd)
  169. if err != nil {
  170. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  171. }
  172. if !strings.Contains(out, ipTablesSearchString) {
  173. c.Fatalf("iptables output after restart should have contained %q, but was %q", ipTablesSearchString, out)
  174. }
  175. }
  176. func (s *DockerDaemonSuite) TestDaemonLogLevelWrong(c *check.C) {
  177. c.Assert(s.d.Start("--log-level=bogus"), check.NotNil, check.Commentf("Daemon shouldn't start with wrong log level"))
  178. }
  179. func (s *DockerDaemonSuite) TestDaemonLogLevelDebug(c *check.C) {
  180. if err := s.d.Start("--log-level=debug"); err != nil {
  181. c.Fatal(err)
  182. }
  183. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  184. if !strings.Contains(string(content), `level=debug`) {
  185. c.Fatalf(`Missing level="debug" in log file:\n%s`, string(content))
  186. }
  187. }
  188. func (s *DockerDaemonSuite) TestDaemonLogLevelFatal(c *check.C) {
  189. // we creating new daemons to create new logFile
  190. if err := s.d.Start("--log-level=fatal"); err != nil {
  191. c.Fatal(err)
  192. }
  193. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  194. if strings.Contains(string(content), `level=debug`) {
  195. c.Fatalf(`Should not have level="debug" in log file:\n%s`, string(content))
  196. }
  197. }
  198. func (s *DockerDaemonSuite) TestDaemonFlagD(c *check.C) {
  199. if err := s.d.Start("-D"); err != nil {
  200. c.Fatal(err)
  201. }
  202. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  203. if !strings.Contains(string(content), `level=debug`) {
  204. c.Fatalf(`Should have level="debug" in log file using -D:\n%s`, string(content))
  205. }
  206. }
  207. func (s *DockerDaemonSuite) TestDaemonFlagDebug(c *check.C) {
  208. if err := s.d.Start("--debug"); err != nil {
  209. c.Fatal(err)
  210. }
  211. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  212. if !strings.Contains(string(content), `level=debug`) {
  213. c.Fatalf(`Should have level="debug" in log file using --debug:\n%s`, string(content))
  214. }
  215. }
  216. func (s *DockerDaemonSuite) TestDaemonFlagDebugLogLevelFatal(c *check.C) {
  217. if err := s.d.Start("--debug", "--log-level=fatal"); err != nil {
  218. c.Fatal(err)
  219. }
  220. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  221. if !strings.Contains(string(content), `level=debug`) {
  222. c.Fatalf(`Should have level="debug" in log file when using both --debug and --log-level=fatal:\n%s`, string(content))
  223. }
  224. }
  225. func (s *DockerDaemonSuite) TestDaemonAllocatesListeningPort(c *check.C) {
  226. listeningPorts := [][]string{
  227. {"0.0.0.0", "0.0.0.0", "5678"},
  228. {"127.0.0.1", "127.0.0.1", "1234"},
  229. {"localhost", "127.0.0.1", "1235"},
  230. }
  231. cmdArgs := []string{}
  232. for _, hostDirective := range listeningPorts {
  233. cmdArgs = append(cmdArgs, "--host", fmt.Sprintf("tcp://%s:%s", hostDirective[0], hostDirective[2]))
  234. }
  235. if err := s.d.StartWithBusybox(cmdArgs...); err != nil {
  236. c.Fatalf("Could not start daemon with busybox: %v", err)
  237. }
  238. for _, hostDirective := range listeningPorts {
  239. output, err := s.d.Cmd("run", "-p", fmt.Sprintf("%s:%s:80", hostDirective[1], hostDirective[2]), "busybox", "true")
  240. if err == nil {
  241. c.Fatalf("Container should not start, expected port already allocated error: %q", output)
  242. } else if !strings.Contains(output, "port is already allocated") {
  243. c.Fatalf("Expected port is already allocated error: %q", output)
  244. }
  245. }
  246. }
  247. // #9629
  248. func (s *DockerDaemonSuite) TestDaemonVolumesBindsRefs(c *check.C) {
  249. if err := s.d.StartWithBusybox(); err != nil {
  250. c.Fatal(err)
  251. }
  252. tmp, err := ioutil.TempDir(os.TempDir(), "")
  253. if err != nil {
  254. c.Fatal(err)
  255. }
  256. defer os.RemoveAll(tmp)
  257. if err := ioutil.WriteFile(tmp+"/test", []byte("testing"), 0655); err != nil {
  258. c.Fatal(err)
  259. }
  260. if out, err := s.d.Cmd("create", "-v", tmp+":/foo", "--name=voltest", "busybox"); err != nil {
  261. c.Fatal(err, out)
  262. }
  263. if err := s.d.Restart(); err != nil {
  264. c.Fatal(err)
  265. }
  266. if out, err := s.d.Cmd("run", "--volumes-from=voltest", "--name=consumer", "busybox", "/bin/sh", "-c", "[ -f /foo/test ]"); err != nil {
  267. c.Fatal(err, out)
  268. }
  269. }
  270. func (s *DockerDaemonSuite) TestDaemonKeyGeneration(c *check.C) {
  271. // TODO: skip or update for Windows daemon
  272. os.Remove("/etc/docker/key.json")
  273. if err := s.d.Start(); err != nil {
  274. c.Fatalf("Could not start daemon: %v", err)
  275. }
  276. s.d.Stop()
  277. k, err := libtrust.LoadKeyFile("/etc/docker/key.json")
  278. if err != nil {
  279. c.Fatalf("Error opening key file")
  280. }
  281. kid := k.KeyID()
  282. // Test Key ID is a valid fingerprint (e.g. QQXN:JY5W:TBXI:MK3X:GX6P:PD5D:F56N:NHCS:LVRZ:JA46:R24J:XEFF)
  283. if len(kid) != 59 {
  284. c.Fatalf("Bad key ID: %s", kid)
  285. }
  286. }
  287. func (s *DockerDaemonSuite) TestDaemonKeyMigration(c *check.C) {
  288. // TODO: skip or update for Windows daemon
  289. os.Remove("/etc/docker/key.json")
  290. k1, err := libtrust.GenerateECP256PrivateKey()
  291. if err != nil {
  292. c.Fatalf("Error generating private key: %s", err)
  293. }
  294. if err := os.MkdirAll(filepath.Join(os.Getenv("HOME"), ".docker"), 0755); err != nil {
  295. c.Fatalf("Error creating .docker directory: %s", err)
  296. }
  297. if err := libtrust.SaveKey(filepath.Join(os.Getenv("HOME"), ".docker", "key.json"), k1); err != nil {
  298. c.Fatalf("Error saving private key: %s", err)
  299. }
  300. if err := s.d.Start(); err != nil {
  301. c.Fatalf("Could not start daemon: %v", err)
  302. }
  303. s.d.Stop()
  304. k2, err := libtrust.LoadKeyFile("/etc/docker/key.json")
  305. if err != nil {
  306. c.Fatalf("Error opening key file")
  307. }
  308. if k1.KeyID() != k2.KeyID() {
  309. c.Fatalf("Key not migrated")
  310. }
  311. }
  312. // Simulate an older daemon (pre 1.3) coming up with volumes specified in containers
  313. // without corresponding volume json
  314. func (s *DockerDaemonSuite) TestDaemonUpgradeWithVolumes(c *check.C) {
  315. graphDir := filepath.Join(os.TempDir(), "docker-test")
  316. defer os.RemoveAll(graphDir)
  317. if err := s.d.StartWithBusybox("-g", graphDir); err != nil {
  318. c.Fatal(err)
  319. }
  320. tmpDir := filepath.Join(os.TempDir(), "test")
  321. defer os.RemoveAll(tmpDir)
  322. if out, err := s.d.Cmd("create", "-v", tmpDir+":/foo", "--name=test", "busybox"); err != nil {
  323. c.Fatal(err, out)
  324. }
  325. if err := s.d.Stop(); err != nil {
  326. c.Fatal(err)
  327. }
  328. // Remove this since we're expecting the daemon to re-create it too
  329. if err := os.RemoveAll(tmpDir); err != nil {
  330. c.Fatal(err)
  331. }
  332. configDir := filepath.Join(graphDir, "volumes")
  333. if err := os.RemoveAll(configDir); err != nil {
  334. c.Fatal(err)
  335. }
  336. if err := s.d.Start("-g", graphDir); err != nil {
  337. c.Fatal(err)
  338. }
  339. if _, err := os.Stat(tmpDir); os.IsNotExist(err) {
  340. c.Fatalf("expected volume path %s to exist but it does not", tmpDir)
  341. }
  342. dir, err := ioutil.ReadDir(configDir)
  343. if err != nil {
  344. c.Fatal(err)
  345. }
  346. if len(dir) == 0 {
  347. c.Fatalf("expected volumes config dir to contain data for new volume")
  348. }
  349. // Now with just removing the volume config and not the volume data
  350. if err := s.d.Stop(); err != nil {
  351. c.Fatal(err)
  352. }
  353. if err := os.RemoveAll(configDir); err != nil {
  354. c.Fatal(err)
  355. }
  356. if err := s.d.Start("-g", graphDir); err != nil {
  357. c.Fatal(err)
  358. }
  359. dir, err = ioutil.ReadDir(configDir)
  360. if err != nil {
  361. c.Fatal(err)
  362. }
  363. if len(dir) == 0 {
  364. c.Fatalf("expected volumes config dir to contain data for new volume")
  365. }
  366. }
  367. // GH#11320 - verify that the daemon exits on failure properly
  368. // Note that this explicitly tests the conflict of {-b,--bridge} and {--bip} options as the means
  369. // to get a daemon init failure; no other tests for -b/--bip conflict are therefore required
  370. func (s *DockerDaemonSuite) TestDaemonExitOnFailure(c *check.C) {
  371. //attempt to start daemon with incorrect flags (we know -b and --bip conflict)
  372. if err := s.d.Start("--bridge", "nosuchbridge", "--bip", "1.1.1.1"); err != nil {
  373. //verify we got the right error
  374. if !strings.Contains(err.Error(), "Daemon exited and never started") {
  375. c.Fatalf("Expected daemon not to start, got %v", err)
  376. }
  377. // look in the log and make sure we got the message that daemon is shutting down
  378. runCmd := exec.Command("grep", "Error starting daemon", s.d.LogfileName())
  379. if out, _, err := runCommandWithOutput(runCmd); err != nil {
  380. c.Fatalf("Expected 'Error starting daemon' message; but doesn't exist in log: %q, err: %v", out, err)
  381. }
  382. } else {
  383. //if we didn't get an error and the daemon is running, this is a failure
  384. c.Fatal("Conflicting options should cause the daemon to error out with a failure")
  385. }
  386. }
  387. func (s *DockerDaemonSuite) TestDaemonBridgeExternal(c *check.C) {
  388. d := s.d
  389. err := d.Start("--bridge", "nosuchbridge")
  390. c.Assert(err, check.NotNil, check.Commentf("--bridge option with an invalid bridge should cause the daemon to fail"))
  391. defer d.Restart()
  392. bridgeName := "external-bridge"
  393. bridgeIp := "192.169.1.1/24"
  394. _, bridgeIPNet, _ := net.ParseCIDR(bridgeIp)
  395. out, err := createInterface(c, "bridge", bridgeName, bridgeIp)
  396. c.Assert(err, check.IsNil, check.Commentf(out))
  397. defer deleteInterface(c, bridgeName)
  398. err = d.StartWithBusybox("--bridge", bridgeName)
  399. c.Assert(err, check.IsNil)
  400. ipTablesSearchString := bridgeIPNet.String()
  401. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  402. out, _, err = runCommandWithOutput(ipTablesCmd)
  403. c.Assert(err, check.IsNil)
  404. c.Assert(strings.Contains(out, ipTablesSearchString), check.Equals, true,
  405. check.Commentf("iptables output should have contained %q, but was %q",
  406. ipTablesSearchString, out))
  407. _, err = d.Cmd("run", "-d", "--name", "ExtContainer", "busybox", "top")
  408. c.Assert(err, check.IsNil)
  409. containerIp := d.findContainerIP("ExtContainer")
  410. ip := net.ParseIP(containerIp)
  411. c.Assert(bridgeIPNet.Contains(ip), check.Equals, true,
  412. check.Commentf("Container IP-Address must be in the same subnet range : %s",
  413. containerIp))
  414. }
  415. func createInterface(c *check.C, ifType string, ifName string, ipNet string) (string, error) {
  416. args := []string{"link", "add", "name", ifName, "type", ifType}
  417. ipLinkCmd := exec.Command("ip", args...)
  418. out, _, err := runCommandWithOutput(ipLinkCmd)
  419. if err != nil {
  420. return out, err
  421. }
  422. ifCfgCmd := exec.Command("ifconfig", ifName, ipNet, "up")
  423. out, _, err = runCommandWithOutput(ifCfgCmd)
  424. return out, err
  425. }
  426. func deleteInterface(c *check.C, ifName string) {
  427. ifCmd := exec.Command("ip", "link", "delete", ifName)
  428. out, _, err := runCommandWithOutput(ifCmd)
  429. c.Assert(err, check.IsNil, check.Commentf(out))
  430. flushCmd := exec.Command("iptables", "-t", "nat", "--flush")
  431. out, _, err = runCommandWithOutput(flushCmd)
  432. c.Assert(err, check.IsNil, check.Commentf(out))
  433. flushCmd = exec.Command("iptables", "--flush")
  434. out, _, err = runCommandWithOutput(flushCmd)
  435. c.Assert(err, check.IsNil, check.Commentf(out))
  436. }
  437. func (s *DockerDaemonSuite) TestDaemonBridgeIP(c *check.C) {
  438. // TestDaemonBridgeIP Steps
  439. // 1. Delete the existing docker0 Bridge
  440. // 2. Set --bip daemon configuration and start the new Docker Daemon
  441. // 3. Check if the bip config has taken effect using ifconfig and iptables commands
  442. // 4. Launch a Container and make sure the IP-Address is in the expected subnet
  443. // 5. Delete the docker0 Bridge
  444. // 6. Restart the Docker Daemon (via defered action)
  445. // This Restart takes care of bringing docker0 interface back to auto-assigned IP
  446. defaultNetworkBridge := "docker0"
  447. deleteInterface(c, defaultNetworkBridge)
  448. d := s.d
  449. bridgeIp := "192.169.1.1/24"
  450. ip, bridgeIPNet, _ := net.ParseCIDR(bridgeIp)
  451. err := d.StartWithBusybox("--bip", bridgeIp)
  452. c.Assert(err, check.IsNil)
  453. defer d.Restart()
  454. ifconfigSearchString := ip.String()
  455. ifconfigCmd := exec.Command("ifconfig", defaultNetworkBridge)
  456. out, _, _, err := runCommandWithStdoutStderr(ifconfigCmd)
  457. c.Assert(err, check.IsNil)
  458. c.Assert(strings.Contains(out, ifconfigSearchString), check.Equals, true,
  459. check.Commentf("ifconfig output should have contained %q, but was %q",
  460. ifconfigSearchString, out))
  461. ipTablesSearchString := bridgeIPNet.String()
  462. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  463. out, _, err = runCommandWithOutput(ipTablesCmd)
  464. c.Assert(err, check.IsNil)
  465. c.Assert(strings.Contains(out, ipTablesSearchString), check.Equals, true,
  466. check.Commentf("iptables output should have contained %q, but was %q",
  467. ipTablesSearchString, out))
  468. out, err = d.Cmd("run", "-d", "--name", "test", "busybox", "top")
  469. c.Assert(err, check.IsNil)
  470. containerIp := d.findContainerIP("test")
  471. ip = net.ParseIP(containerIp)
  472. c.Assert(bridgeIPNet.Contains(ip), check.Equals, true,
  473. check.Commentf("Container IP-Address must be in the same subnet range : %s",
  474. containerIp))
  475. deleteInterface(c, defaultNetworkBridge)
  476. }
  477. func (s *DockerDaemonSuite) TestDaemonRestartWithBridgeIPChange(c *check.C) {
  478. if err := s.d.Start(); err != nil {
  479. c.Fatalf("Could not start daemon: %v", err)
  480. }
  481. defer s.d.Restart()
  482. if err := s.d.Stop(); err != nil {
  483. c.Fatalf("Could not stop daemon: %v", err)
  484. }
  485. // now we will change the docker0's IP and then try starting the daemon
  486. bridgeIP := "192.169.100.1/24"
  487. _, bridgeIPNet, _ := net.ParseCIDR(bridgeIP)
  488. ipCmd := exec.Command("ifconfig", "docker0", bridgeIP)
  489. stdout, stderr, _, err := runCommandWithStdoutStderr(ipCmd)
  490. if err != nil {
  491. c.Fatalf("failed to change docker0's IP association: %v, stdout: %q, stderr: %q", err, stdout, stderr)
  492. }
  493. if err := s.d.Start("--bip", bridgeIP); err != nil {
  494. c.Fatalf("Could not start daemon: %v", err)
  495. }
  496. //check if the iptables contains new bridgeIP MASQUERADE rule
  497. ipTablesSearchString := bridgeIPNet.String()
  498. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  499. out, _, err := runCommandWithOutput(ipTablesCmd)
  500. if err != nil {
  501. c.Fatalf("Could not run iptables -nvL: %s, %v", out, err)
  502. }
  503. if !strings.Contains(out, ipTablesSearchString) {
  504. c.Fatalf("iptables output should have contained new MASQUERADE rule with IP %q, but was %q", ipTablesSearchString, out)
  505. }
  506. }
  507. func (s *DockerDaemonSuite) TestDaemonBridgeFixedCidr(c *check.C) {
  508. d := s.d
  509. bridgeName := "external-bridge"
  510. bridgeIp := "192.169.1.1/24"
  511. out, err := createInterface(c, "bridge", bridgeName, bridgeIp)
  512. c.Assert(err, check.IsNil, check.Commentf(out))
  513. defer deleteInterface(c, bridgeName)
  514. args := []string{"--bridge", bridgeName, "--fixed-cidr", "192.169.1.0/30"}
  515. err = d.StartWithBusybox(args...)
  516. c.Assert(err, check.IsNil)
  517. defer d.Restart()
  518. for i := 0; i < 4; i++ {
  519. cName := "Container" + strconv.Itoa(i)
  520. out, err := d.Cmd("run", "-d", "--name", cName, "busybox", "top")
  521. if err != nil {
  522. c.Assert(strings.Contains(out, "no available ip addresses"), check.Equals, true,
  523. check.Commentf("Could not run a Container : %s %s", err.Error(), out))
  524. }
  525. }
  526. }
  527. func (s *DockerDaemonSuite) TestDaemonIP(c *check.C) {
  528. d := s.d
  529. ipStr := "192.170.1.1/24"
  530. ip, _, _ := net.ParseCIDR(ipStr)
  531. args := []string{"--ip", ip.String()}
  532. err := d.StartWithBusybox(args...)
  533. c.Assert(err, check.IsNil)
  534. defer d.Restart()
  535. out, err := d.Cmd("run", "-d", "-p", "8000:8000", "busybox", "top")
  536. c.Assert(err, check.NotNil,
  537. check.Commentf("Running a container must fail with an invalid --ip option"))
  538. c.Assert(strings.Contains(out, "Error starting userland proxy"), check.Equals, true)
  539. ifName := "dummy"
  540. out, err = createInterface(c, "dummy", ifName, ipStr)
  541. c.Assert(err, check.IsNil, check.Commentf(out))
  542. defer deleteInterface(c, ifName)
  543. _, err = d.Cmd("run", "-d", "-p", "8000:8000", "busybox", "top")
  544. c.Assert(err, check.IsNil)
  545. ipTablesCmd := exec.Command("iptables", "-t", "nat", "-nvL")
  546. out, _, err = runCommandWithOutput(ipTablesCmd)
  547. c.Assert(err, check.IsNil)
  548. regex := fmt.Sprintf("DNAT.*%s.*dpt:8000", ip.String())
  549. matched, _ := regexp.MatchString(regex, out)
  550. c.Assert(matched, check.Equals, true,
  551. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  552. }
  553. func (s *DockerDaemonSuite) TestDaemonICCPing(c *check.C) {
  554. d := s.d
  555. bridgeName := "external-bridge"
  556. bridgeIp := "192.169.1.1/24"
  557. out, err := createInterface(c, "bridge", bridgeName, bridgeIp)
  558. c.Assert(err, check.IsNil, check.Commentf(out))
  559. defer deleteInterface(c, bridgeName)
  560. args := []string{"--bridge", bridgeName, "--icc=false"}
  561. err = d.StartWithBusybox(args...)
  562. c.Assert(err, check.IsNil)
  563. defer d.Restart()
  564. ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")
  565. out, _, err = runCommandWithOutput(ipTablesCmd)
  566. c.Assert(err, check.IsNil)
  567. regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)
  568. matched, _ := regexp.MatchString(regex, out)
  569. c.Assert(matched, check.Equals, true,
  570. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  571. // Pinging another container must fail with --icc=false
  572. pingContainers(c, d, true)
  573. ipStr := "192.171.1.1/24"
  574. ip, _, _ := net.ParseCIDR(ipStr)
  575. ifName := "icc-dummy"
  576. createInterface(c, "dummy", ifName, ipStr)
  577. // But, Pinging external or a Host interface must succeed
  578. pingCmd := fmt.Sprintf("ping -c 1 %s -W 1", ip.String())
  579. runArgs := []string{"--rm", "busybox", "sh", "-c", pingCmd}
  580. _, err = d.Cmd("run", runArgs...)
  581. c.Assert(err, check.IsNil)
  582. }
  583. func (s *DockerDaemonSuite) TestDaemonICCLinkExpose(c *check.C) {
  584. d := s.d
  585. bridgeName := "external-bridge"
  586. bridgeIp := "192.169.1.1/24"
  587. out, err := createInterface(c, "bridge", bridgeName, bridgeIp)
  588. c.Assert(err, check.IsNil, check.Commentf(out))
  589. defer deleteInterface(c, bridgeName)
  590. args := []string{"--bridge", bridgeName, "--icc=false"}
  591. err = d.StartWithBusybox(args...)
  592. c.Assert(err, check.IsNil)
  593. defer d.Restart()
  594. ipTablesCmd := exec.Command("iptables", "-nvL", "FORWARD")
  595. out, _, err = runCommandWithOutput(ipTablesCmd)
  596. c.Assert(err, check.IsNil)
  597. regex := fmt.Sprintf("DROP.*all.*%s.*%s", bridgeName, bridgeName)
  598. matched, _ := regexp.MatchString(regex, out)
  599. c.Assert(matched, check.Equals, true,
  600. check.Commentf("iptables output should have contained %q, but was %q", regex, out))
  601. out, err = d.Cmd("run", "-d", "--expose", "4567", "--name", "icc1", "busybox", "nc", "-l", "-p", "4567")
  602. c.Assert(err, check.IsNil, check.Commentf(out))
  603. out, err = d.Cmd("run", "--link", "icc1:icc1", "busybox", "nc", "icc1", "4567")
  604. c.Assert(err, check.IsNil, check.Commentf(out))
  605. }
  606. func (s *DockerDaemonSuite) TestDaemonLinksIpTablesRulesWhenLinkAndUnlink(c *check.C) {
  607. bridgeName := "external-bridge"
  608. bridgeIp := "192.169.1.1/24"
  609. out, err := createInterface(c, "bridge", bridgeName, bridgeIp)
  610. c.Assert(err, check.IsNil, check.Commentf(out))
  611. defer deleteInterface(c, bridgeName)
  612. args := []string{"--bridge", bridgeName, "--icc=false"}
  613. err = s.d.StartWithBusybox(args...)
  614. c.Assert(err, check.IsNil)
  615. defer s.d.Restart()
  616. _, err = s.d.Cmd("run", "-d", "--name", "child", "--publish", "8080:80", "busybox", "top")
  617. c.Assert(err, check.IsNil)
  618. _, err = s.d.Cmd("run", "-d", "--name", "parent", "--link", "child:http", "busybox", "top")
  619. c.Assert(err, check.IsNil)
  620. childIP := s.d.findContainerIP("child")
  621. parentIP := s.d.findContainerIP("parent")
  622. sourceRule := []string{"-i", bridgeName, "-o", bridgeName, "-p", "tcp", "-s", childIP, "--sport", "80", "-d", parentIP, "-j", "ACCEPT"}
  623. destinationRule := []string{"-i", bridgeName, "-o", bridgeName, "-p", "tcp", "-s", parentIP, "--dport", "80", "-d", childIP, "-j", "ACCEPT"}
  624. if !iptables.Exists("filter", "DOCKER", sourceRule...) || !iptables.Exists("filter", "DOCKER", destinationRule...) {
  625. c.Fatal("Iptables rules not found")
  626. }
  627. s.d.Cmd("rm", "--link", "parent/http")
  628. if iptables.Exists("filter", "DOCKER", sourceRule...) || iptables.Exists("filter", "DOCKER", destinationRule...) {
  629. c.Fatal("Iptables rules should be removed when unlink")
  630. }
  631. s.d.Cmd("kill", "child")
  632. s.d.Cmd("kill", "parent")
  633. }
  634. func (s *DockerDaemonSuite) TestDaemonUlimitDefaults(c *check.C) {
  635. testRequires(c, NativeExecDriver)
  636. if err := s.d.StartWithBusybox("--default-ulimit", "nofile=42:42", "--default-ulimit", "nproc=1024:1024"); err != nil {
  637. c.Fatal(err)
  638. }
  639. out, err := s.d.Cmd("run", "--ulimit", "nproc=2048", "--name=test", "busybox", "/bin/sh", "-c", "echo $(ulimit -n); echo $(ulimit -p)")
  640. if err != nil {
  641. c.Fatal(out, err)
  642. }
  643. outArr := strings.Split(out, "\n")
  644. if len(outArr) < 2 {
  645. c.Fatalf("got unexpected output: %s", out)
  646. }
  647. nofile := strings.TrimSpace(outArr[0])
  648. nproc := strings.TrimSpace(outArr[1])
  649. if nofile != "42" {
  650. c.Fatalf("expected `ulimit -n` to be `42`, got: %s", nofile)
  651. }
  652. if nproc != "2048" {
  653. c.Fatalf("exepcted `ulimit -p` to be 2048, got: %s", nproc)
  654. }
  655. // Now restart daemon with a new default
  656. if err := s.d.Restart("--default-ulimit", "nofile=43"); err != nil {
  657. c.Fatal(err)
  658. }
  659. out, err = s.d.Cmd("start", "-a", "test")
  660. if err != nil {
  661. c.Fatal(err)
  662. }
  663. outArr = strings.Split(out, "\n")
  664. if len(outArr) < 2 {
  665. c.Fatalf("got unexpected output: %s", out)
  666. }
  667. nofile = strings.TrimSpace(outArr[0])
  668. nproc = strings.TrimSpace(outArr[1])
  669. if nofile != "43" {
  670. c.Fatalf("expected `ulimit -n` to be `43`, got: %s", nofile)
  671. }
  672. if nproc != "2048" {
  673. c.Fatalf("exepcted `ulimit -p` to be 2048, got: %s", nproc)
  674. }
  675. }
  676. // #11315
  677. func (s *DockerDaemonSuite) TestDaemonRestartRenameContainer(c *check.C) {
  678. if err := s.d.StartWithBusybox(); err != nil {
  679. c.Fatal(err)
  680. }
  681. if out, err := s.d.Cmd("run", "--name=test", "busybox"); err != nil {
  682. c.Fatal(err, out)
  683. }
  684. if out, err := s.d.Cmd("rename", "test", "test2"); err != nil {
  685. c.Fatal(err, out)
  686. }
  687. if err := s.d.Restart(); err != nil {
  688. c.Fatal(err)
  689. }
  690. if out, err := s.d.Cmd("start", "test2"); err != nil {
  691. c.Fatal(err, out)
  692. }
  693. }
  694. func (s *DockerDaemonSuite) TestDaemonLoggingDriverDefault(c *check.C) {
  695. if err := s.d.StartWithBusybox(); err != nil {
  696. c.Fatal(err)
  697. }
  698. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  699. if err != nil {
  700. c.Fatal(out, err)
  701. }
  702. id := strings.TrimSpace(out)
  703. if out, err := s.d.Cmd("wait", id); err != nil {
  704. c.Fatal(out, err)
  705. }
  706. logPath := filepath.Join(s.d.folder, "graph", "containers", id, id+"-json.log")
  707. if _, err := os.Stat(logPath); err != nil {
  708. c.Fatal(err)
  709. }
  710. f, err := os.Open(logPath)
  711. if err != nil {
  712. c.Fatal(err)
  713. }
  714. var res struct {
  715. Log string `json:"log"`
  716. Stream string `json:"stream"`
  717. Time time.Time `json:"time"`
  718. }
  719. if err := json.NewDecoder(f).Decode(&res); err != nil {
  720. c.Fatal(err)
  721. }
  722. if res.Log != "testline\n" {
  723. c.Fatalf("Unexpected log line: %q, expected: %q", res.Log, "testline\n")
  724. }
  725. if res.Stream != "stdout" {
  726. c.Fatalf("Unexpected stream: %q, expected: %q", res.Stream, "stdout")
  727. }
  728. if !time.Now().After(res.Time) {
  729. c.Fatalf("Log time %v in future", res.Time)
  730. }
  731. }
  732. func (s *DockerDaemonSuite) TestDaemonLoggingDriverDefaultOverride(c *check.C) {
  733. if err := s.d.StartWithBusybox(); err != nil {
  734. c.Fatal(err)
  735. }
  736. out, err := s.d.Cmd("run", "-d", "--log-driver=none", "busybox", "echo", "testline")
  737. if err != nil {
  738. c.Fatal(out, err)
  739. }
  740. id := strings.TrimSpace(out)
  741. if out, err := s.d.Cmd("wait", id); err != nil {
  742. c.Fatal(out, err)
  743. }
  744. logPath := filepath.Join(s.d.folder, "graph", "containers", id, id+"-json.log")
  745. if _, err := os.Stat(logPath); err == nil || !os.IsNotExist(err) {
  746. c.Fatalf("%s shouldn't exits, error on Stat: %s", logPath, err)
  747. }
  748. }
  749. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNone(c *check.C) {
  750. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  751. c.Fatal(err)
  752. }
  753. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  754. if err != nil {
  755. c.Fatal(out, err)
  756. }
  757. id := strings.TrimSpace(out)
  758. if out, err := s.d.Cmd("wait", id); err != nil {
  759. c.Fatal(out, err)
  760. }
  761. logPath := filepath.Join(s.d.folder, "graph", "containers", id, id+"-json.log")
  762. if _, err := os.Stat(logPath); err == nil || !os.IsNotExist(err) {
  763. c.Fatalf("%s shouldn't exits, error on Stat: %s", logPath, err)
  764. }
  765. }
  766. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNoneOverride(c *check.C) {
  767. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  768. c.Fatal(err)
  769. }
  770. out, err := s.d.Cmd("run", "-d", "--log-driver=json-file", "busybox", "echo", "testline")
  771. if err != nil {
  772. c.Fatal(out, err)
  773. }
  774. id := strings.TrimSpace(out)
  775. if out, err := s.d.Cmd("wait", id); err != nil {
  776. c.Fatal(out, err)
  777. }
  778. logPath := filepath.Join(s.d.folder, "graph", "containers", id, id+"-json.log")
  779. if _, err := os.Stat(logPath); err != nil {
  780. c.Fatal(err)
  781. }
  782. f, err := os.Open(logPath)
  783. if err != nil {
  784. c.Fatal(err)
  785. }
  786. var res struct {
  787. Log string `json:"log"`
  788. Stream string `json:"stream"`
  789. Time time.Time `json:"time"`
  790. }
  791. if err := json.NewDecoder(f).Decode(&res); err != nil {
  792. c.Fatal(err)
  793. }
  794. if res.Log != "testline\n" {
  795. c.Fatalf("Unexpected log line: %q, expected: %q", res.Log, "testline\n")
  796. }
  797. if res.Stream != "stdout" {
  798. c.Fatalf("Unexpected stream: %q, expected: %q", res.Stream, "stdout")
  799. }
  800. if !time.Now().After(res.Time) {
  801. c.Fatalf("Log time %v in future", res.Time)
  802. }
  803. }
  804. func (s *DockerDaemonSuite) TestDaemonLoggingDriverNoneLogsError(c *check.C) {
  805. if err := s.d.StartWithBusybox("--log-driver=none"); err != nil {
  806. c.Fatal(err)
  807. }
  808. out, err := s.d.Cmd("run", "-d", "busybox", "echo", "testline")
  809. if err != nil {
  810. c.Fatal(out, err)
  811. }
  812. id := strings.TrimSpace(out)
  813. out, err = s.d.Cmd("logs", id)
  814. if err == nil {
  815. c.Fatalf("Logs should fail with \"none\" driver")
  816. }
  817. if !strings.Contains(out, `"logs" command is supported only for "json-file" logging driver`) {
  818. c.Fatalf("There should be error about non-json-file driver, got: %s", out)
  819. }
  820. }
  821. func (s *DockerDaemonSuite) TestDaemonDots(c *check.C) {
  822. if err := s.d.StartWithBusybox(); err != nil {
  823. c.Fatal(err)
  824. }
  825. // Now create 4 containers
  826. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  827. c.Fatalf("Error creating container: %q", err)
  828. }
  829. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  830. c.Fatalf("Error creating container: %q", err)
  831. }
  832. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  833. c.Fatalf("Error creating container: %q", err)
  834. }
  835. if _, err := s.d.Cmd("create", "busybox"); err != nil {
  836. c.Fatalf("Error creating container: %q", err)
  837. }
  838. s.d.Stop()
  839. s.d.Start("--log-level=debug")
  840. s.d.Stop()
  841. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  842. if strings.Contains(string(content), "....") {
  843. c.Fatalf("Debug level should not have ....\n%s", string(content))
  844. }
  845. s.d.Start("--log-level=error")
  846. s.d.Stop()
  847. content, _ = ioutil.ReadFile(s.d.logFile.Name())
  848. if strings.Contains(string(content), "....") {
  849. c.Fatalf("Error level should not have ....\n%s", string(content))
  850. }
  851. s.d.Start("--log-level=info")
  852. s.d.Stop()
  853. content, _ = ioutil.ReadFile(s.d.logFile.Name())
  854. if !strings.Contains(string(content), "....") {
  855. c.Fatalf("Info level should have ....\n%s", string(content))
  856. }
  857. }
  858. func (s *DockerDaemonSuite) TestDaemonUnixSockCleanedUp(c *check.C) {
  859. dir, err := ioutil.TempDir("", "socket-cleanup-test")
  860. if err != nil {
  861. c.Fatal(err)
  862. }
  863. defer os.RemoveAll(dir)
  864. sockPath := filepath.Join(dir, "docker.sock")
  865. if err := s.d.Start("--host", "unix://"+sockPath); err != nil {
  866. c.Fatal(err)
  867. }
  868. if _, err := os.Stat(sockPath); err != nil {
  869. c.Fatal("socket does not exist")
  870. }
  871. if err := s.d.Stop(); err != nil {
  872. c.Fatal(err)
  873. }
  874. if _, err := os.Stat(sockPath); err == nil || !os.IsNotExist(err) {
  875. c.Fatal("unix socket is not cleaned up")
  876. }
  877. }
  878. func (s *DockerDaemonSuite) TestDaemonWithWrongkey(c *check.C) {
  879. type Config struct {
  880. Crv string `json:"crv"`
  881. D string `json:"d"`
  882. Kid string `json:"kid"`
  883. Kty string `json:"kty"`
  884. X string `json:"x"`
  885. Y string `json:"y"`
  886. }
  887. os.Remove("/etc/docker/key.json")
  888. if err := s.d.Start(); err != nil {
  889. c.Fatalf("Failed to start daemon: %v", err)
  890. }
  891. if err := s.d.Stop(); err != nil {
  892. c.Fatalf("Could not stop daemon: %v", err)
  893. }
  894. config := &Config{}
  895. bytes, err := ioutil.ReadFile("/etc/docker/key.json")
  896. if err != nil {
  897. c.Fatalf("Error reading key.json file: %s", err)
  898. }
  899. // byte[] to Data-Struct
  900. if err := json.Unmarshal(bytes, &config); err != nil {
  901. c.Fatalf("Error Unmarshal: %s", err)
  902. }
  903. //replace config.Kid with the fake value
  904. config.Kid = "VSAJ:FUYR:X3H2:B2VZ:KZ6U:CJD5:K7BX:ZXHY:UZXT:P4FT:MJWG:HRJ4"
  905. // NEW Data-Struct to byte[]
  906. newBytes, err := json.Marshal(&config)
  907. if err != nil {
  908. c.Fatalf("Error Marshal: %s", err)
  909. }
  910. // write back
  911. if err := ioutil.WriteFile("/etc/docker/key.json", newBytes, 0400); err != nil {
  912. c.Fatalf("Error ioutil.WriteFile: %s", err)
  913. }
  914. defer os.Remove("/etc/docker/key.json")
  915. if err := s.d.Start(); err == nil {
  916. c.Fatalf("It should not be successful to start daemon with wrong key: %v", err)
  917. }
  918. content, _ := ioutil.ReadFile(s.d.logFile.Name())
  919. if !strings.Contains(string(content), "Public Key ID does not match") {
  920. c.Fatal("Missing KeyID message from daemon logs")
  921. }
  922. }
  923. func (s *DockerDaemonSuite) TestDaemonRestartKillWait(c *check.C) {
  924. if err := s.d.StartWithBusybox(); err != nil {
  925. c.Fatalf("Could not start daemon with busybox: %v", err)
  926. }
  927. out, err := s.d.Cmd("run", "-id", "busybox", "/bin/cat")
  928. if err != nil {
  929. c.Fatalf("Could not run /bin/cat: err=%v\n%s", err, out)
  930. }
  931. containerID := strings.TrimSpace(out)
  932. if out, err := s.d.Cmd("kill", containerID); err != nil {
  933. c.Fatalf("Could not kill %s: err=%v\n%s", containerID, err, out)
  934. }
  935. if err := s.d.Restart(); err != nil {
  936. c.Fatalf("Could not restart daemon: %v", err)
  937. }
  938. errchan := make(chan error)
  939. go func() {
  940. if out, err := s.d.Cmd("wait", containerID); err != nil {
  941. errchan <- fmt.Errorf("%v:\n%s", err, out)
  942. }
  943. close(errchan)
  944. }()
  945. select {
  946. case <-time.After(5 * time.Second):
  947. c.Fatal("Waiting on a stopped (killed) container timed out")
  948. case err := <-errchan:
  949. if err != nil {
  950. c.Fatal(err)
  951. }
  952. }
  953. }
  954. // TestHttpsInfo connects via two-way authenticated HTTPS to the info endpoint
  955. func (s *DockerDaemonSuite) TestHttpsInfo(c *check.C) {
  956. const (
  957. testDaemonHttpsAddr = "localhost:4271"
  958. )
  959. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-cert.pem",
  960. "--tlskey", "fixtures/https/server-key.pem", "-H", testDaemonHttpsAddr); err != nil {
  961. c.Fatalf("Could not start daemon with busybox: %v", err)
  962. }
  963. //force tcp protocol
  964. host := fmt.Sprintf("tcp://%s", testDaemonHttpsAddr)
  965. daemonArgs := []string{"--host", host, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-cert.pem", "--tlskey", "fixtures/https/client-key.pem"}
  966. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  967. if err != nil {
  968. c.Fatalf("Error Occurred: %s and output: %s", err, out)
  969. }
  970. }
  971. // TestHttpsInfoRogueCert connects via two-way authenticated HTTPS to the info endpoint
  972. // by using a rogue client certificate and checks that it fails with the expected error.
  973. func (s *DockerDaemonSuite) TestHttpsInfoRogueCert(c *check.C) {
  974. const (
  975. errBadCertificate = "remote error: bad certificate"
  976. testDaemonHttpsAddr = "localhost:4271"
  977. )
  978. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-cert.pem",
  979. "--tlskey", "fixtures/https/server-key.pem", "-H", testDaemonHttpsAddr); err != nil {
  980. c.Fatalf("Could not start daemon with busybox: %v", err)
  981. }
  982. //force tcp protocol
  983. host := fmt.Sprintf("tcp://%s", testDaemonHttpsAddr)
  984. daemonArgs := []string{"--host", host, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-rogue-cert.pem", "--tlskey", "fixtures/https/client-rogue-key.pem"}
  985. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  986. if err == nil || !strings.Contains(out, errBadCertificate) {
  987. c.Fatalf("Expected err: %s, got instead: %s and output: %s", errBadCertificate, err, out)
  988. }
  989. }
  990. // TestHttpsInfoRogueServerCert connects via two-way authenticated HTTPS to the info endpoint
  991. // which provides a rogue server certificate and checks that it fails with the expected error
  992. func (s *DockerDaemonSuite) TestHttpsInfoRogueServerCert(c *check.C) {
  993. const (
  994. errCaUnknown = "x509: certificate signed by unknown authority"
  995. testDaemonRogueHttpsAddr = "localhost:4272"
  996. )
  997. if err := s.d.Start("--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/server-rogue-cert.pem",
  998. "--tlskey", "fixtures/https/server-rogue-key.pem", "-H", testDaemonRogueHttpsAddr); err != nil {
  999. c.Fatalf("Could not start daemon with busybox: %v", err)
  1000. }
  1001. //force tcp protocol
  1002. host := fmt.Sprintf("tcp://%s", testDaemonRogueHttpsAddr)
  1003. daemonArgs := []string{"--host", host, "--tlsverify", "--tlscacert", "fixtures/https/ca.pem", "--tlscert", "fixtures/https/client-rogue-cert.pem", "--tlskey", "fixtures/https/client-rogue-key.pem"}
  1004. out, err := s.d.CmdWithArgs(daemonArgs, "info")
  1005. if err == nil || !strings.Contains(out, errCaUnknown) {
  1006. c.Fatalf("Expected err: %s, got instead: %s and output: %s", errCaUnknown, err, out)
  1007. }
  1008. }
  1009. func pingContainers(c *check.C, d *Daemon, expectFailure bool) {
  1010. var dargs []string
  1011. if d != nil {
  1012. dargs = []string{"--host", d.sock()}
  1013. }
  1014. args := append(dargs, "run", "-d", "--name", "container1", "busybox", "top")
  1015. _, err := runCommand(exec.Command(dockerBinary, args...))
  1016. c.Assert(err, check.IsNil)
  1017. args = append(dargs, "run", "--rm", "--link", "container1:alias1", "busybox", "sh", "-c")
  1018. pingCmd := "ping -c 1 %s -W 1"
  1019. args = append(args, fmt.Sprintf(pingCmd, "alias1"))
  1020. _, err = runCommand(exec.Command(dockerBinary, args...))
  1021. if expectFailure {
  1022. c.Assert(err, check.NotNil)
  1023. } else {
  1024. c.Assert(err, check.IsNil)
  1025. }
  1026. args = append(dargs, "rm", "-f", "container1")
  1027. runCommand(exec.Command(dockerBinary, args...))
  1028. }
  1029. func (s *DockerDaemonSuite) TestDaemonRestartWithSockerAsVolume(c *check.C) {
  1030. c.Assert(s.d.StartWithBusybox(), check.IsNil)
  1031. socket := filepath.Join(s.d.folder, "docker.sock")
  1032. out, err := s.d.Cmd("run", "-d", "-v", socket+":/sock", "busybox")
  1033. c.Assert(err, check.IsNil, check.Commentf("Output: %s", out))
  1034. c.Assert(s.d.Restart(), check.IsNil)
  1035. }