summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--libpod/networking_linux.go11
-rw-r--r--libpod/oci_linux.go15
-rw-r--r--pkg/spec/spec_test.go38
-rw-r--r--test/e2e/exec_test.go15
-rw-r--r--test/e2e/run_cleanup_test.go16
5 files changed, 65 insertions, 30 deletions
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index fd14b2f73..67dd0150b 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -127,13 +127,13 @@ type slirp4netnsCmd struct {
Args slirp4netnsCmdArg `json:"arguments"`
}
-func checkSlirpFlags(path string) (bool, bool, error) {
+func checkSlirpFlags(path string) (bool, bool, bool, error) {
cmd := exec.Command(path, "--help")
out, err := cmd.CombinedOutput()
if err != nil {
- return false, false, err
+ return false, false, false, err
}
- return strings.Contains(string(out), "--disable-host-loopback"), strings.Contains(string(out), "--mtu"), nil
+ return strings.Contains(string(out), "--disable-host-loopback"), strings.Contains(string(out), "--mtu"), strings.Contains(string(out), "--enable-sandbox"), nil
}
// Configure the network namespace for a rootless container
@@ -166,7 +166,7 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
if havePortMapping {
cmdArgs = append(cmdArgs, "--api-socket", apiSocket, fmt.Sprintf("%d", ctr.state.PID))
}
- dhp, mtu, err := checkSlirpFlags(path)
+ dhp, mtu, sandbox, err := checkSlirpFlags(path)
if err != nil {
return errors.Wrapf(err, "error checking slirp4netns binary %s", path)
}
@@ -176,6 +176,9 @@ func (r *Runtime) setupRootlessNetNS(ctr *Container) (err error) {
if mtu {
cmdArgs = append(cmdArgs, "--mtu", "65520")
}
+ if sandbox {
+ cmdArgs = append(cmdArgs, "--enable-sandbox")
+ }
cmdArgs = append(cmdArgs, "-c", "-e", "3", "-r", "4", fmt.Sprintf("%d", ctr.state.PID), "tap0")
cmd := exec.Command(path, cmdArgs...)
diff --git a/libpod/oci_linux.go b/libpod/oci_linux.go
index 091b6d155..9ec074704 100644
--- a/libpod/oci_linux.go
+++ b/libpod/oci_linux.go
@@ -8,6 +8,7 @@ import (
"os/exec"
"path/filepath"
"runtime"
+ "strconv"
"strings"
"syscall"
"time"
@@ -199,7 +200,7 @@ func (r *OCIRuntime) execContainer(c *Container, cmd, capAdd, env []string, tty
args := r.sharedConmonArgs(c, sessionID, c.execBundlePath(sessionID), c.execPidPath(sessionID), c.execLogPath(sessionID), c.execExitFileDir(sessionID), ociLog)
if preserveFDs > 0 {
- args = append(args, formatRuntimeOpts("--preserve-fds", string(preserveFDs))...)
+ args = append(args, formatRuntimeOpts("--preserve-fds", strconv.Itoa(preserveFDs))...)
}
for _, capability := range capAdd {
@@ -236,6 +237,12 @@ func (r *OCIRuntime) execContainer(c *Container, cmd, capAdd, env []string, tty
return -1, nil, err
}
+ if preserveFDs > 0 {
+ for fd := 3; fd < 3+preserveFDs; fd++ {
+ execCmd.ExtraFiles = append(execCmd.ExtraFiles, os.NewFile(uintptr(fd), fmt.Sprintf("fd-%d", fd)))
+ }
+ }
+
// we don't want to step on users fds they asked to preserve
// Since 0-2 are used for stdio, start the fds we pass in at preserveFDs+3
execCmd.Env = append(r.conmonEnv, fmt.Sprintf("_OCI_SYNCPIPE=%d", preserveFDs+3), fmt.Sprintf("_OCI_STARTPIPE=%d", preserveFDs+4), fmt.Sprintf("_OCI_ATTACHPIPE=%d", preserveFDs+5))
@@ -248,12 +255,6 @@ func (r *OCIRuntime) execContainer(c *Container, cmd, capAdd, env []string, tty
Setpgid: true,
}
- if preserveFDs > 0 {
- for fd := 3; fd < 3+preserveFDs; fd++ {
- execCmd.ExtraFiles = append(execCmd.ExtraFiles, os.NewFile(uintptr(fd), fmt.Sprintf("fd-%d", fd)))
- }
- }
-
err = startCommandGivenSelinux(execCmd)
// We don't need children pipes on the parent side
diff --git a/pkg/spec/spec_test.go b/pkg/spec/spec_test.go
index 0abff491b..2f91e1b21 100644
--- a/pkg/spec/spec_test.go
+++ b/pkg/spec/spec_test.go
@@ -4,6 +4,8 @@ import (
"runtime"
"testing"
+ "github.com/containers/libpod/pkg/cgroups"
+ "github.com/containers/libpod/pkg/rootless"
"github.com/containers/libpod/pkg/sysinfo"
"github.com/containers/storage"
"github.com/containers/storage/pkg/idtools"
@@ -26,14 +28,30 @@ func makeTestCreateConfig() *CreateConfig {
return cc
}
-// TestPIDsLimit verifies the given pid-limit is correctly defined in the spec
-func TestPIDsLimit(t *testing.T) {
+func doCommonSkipChecks(t *testing.T) {
// The default configuration of podman enables seccomp, which is not available on non-Linux systems.
// Thus, any tests that use the default seccomp setting would fail.
// Skip the tests on non-Linux platforms rather than explicitly disable seccomp in the test and possibly affect the test result.
if runtime.GOOS != "linux" {
t.Skip("seccomp, which is enabled by default, is only supported on Linux")
}
+
+ if rootless.IsRootless() {
+ isCgroupV2, err := cgroups.IsCgroup2UnifiedMode()
+ if err != nil {
+ t.Errorf("unexpected error: %v", err)
+ }
+
+ if !isCgroupV2 {
+ t.Skip("cgroups v1 cannot be used when rootless")
+ }
+ }
+}
+
+// TestPIDsLimit verifies the given pid-limit is correctly defined in the spec
+func TestPIDsLimit(t *testing.T) {
+ doCommonSkipChecks(t)
+
if !sysInfo.PidsLimit {
t.Skip("running test not supported by the host system")
}
@@ -50,12 +68,8 @@ func TestPIDsLimit(t *testing.T) {
// TestBLKIOWeightDevice verifies the given blkio weight is correctly set in the
// spec.
func TestBLKIOWeightDevice(t *testing.T) {
- // The default configuration of podman enables seccomp, which is not available on non-Linux systems.
- // Thus, any tests that use the default seccomp setting would fail.
- // Skip the tests on non-Linux platforms rather than explicitly disable seccomp in the test and possibly affect the test result.
- if runtime.GOOS != "linux" {
- t.Skip("seccomp, which is enabled by default, is only supported on Linux")
- }
+ doCommonSkipChecks(t)
+
if !sysInfo.BlkioWeightDevice {
t.Skip("running test not supported by the host system")
}
@@ -75,12 +89,8 @@ func TestBLKIOWeightDevice(t *testing.T) {
// TestMemorySwap verifies that the given swap memory limit is correctly set in
// the spec.
func TestMemorySwap(t *testing.T) {
- // The default configuration of podman enables seccomp, which is not available on non-Linux systems.
- // Thus, any tests that use the default seccomp setting would fail.
- // Skip the tests on non-Linux platforms rather than explicitly disable seccomp in the test and possibly affect the test result.
- if runtime.GOOS != "linux" {
- t.Skip("seccomp, which is enabled by default, is only supported on Linux")
- }
+ doCommonSkipChecks(t)
+
if !sysInfo.SwapLimit {
t.Skip("running test not supported by the host system")
}
diff --git a/test/e2e/exec_test.go b/test/e2e/exec_test.go
index 670269eab..13fdabb81 100644
--- a/test/e2e/exec_test.go
+++ b/test/e2e/exec_test.go
@@ -2,6 +2,7 @@ package integration
import (
"os"
+ "strings"
. "github.com/containers/libpod/test/utils"
. "github.com/onsi/ginkgo"
@@ -228,4 +229,18 @@ var _ = Describe("Podman exec", func() {
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(127))
})
+
+ It("podman exec preserve fds sanity check", func() {
+ // TODO: add this test once crun adds the --preserve-fds flag for exec
+ if strings.Contains(podmanTest.OCIRuntime, "crun") {
+ Skip("Test only works on crun")
+ }
+ setup := podmanTest.RunTopContainer("test1")
+ setup.WaitWithDefaultTimeout()
+ Expect(setup.ExitCode()).To(Equal(0))
+
+ session := podmanTest.Podman([]string{"exec", "--preserve-fds", "1", "test1", "ls"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+ })
})
diff --git a/test/e2e/run_cleanup_test.go b/test/e2e/run_cleanup_test.go
index 86790e726..99d0d55e5 100644
--- a/test/e2e/run_cleanup_test.go
+++ b/test/e2e/run_cleanup_test.go
@@ -4,7 +4,6 @@ package integration
import (
"os"
- "strings"
. "github.com/containers/libpod/test/utils"
. "github.com/onsi/ginkgo"
@@ -36,6 +35,8 @@ var _ = Describe("Podman run exit", func() {
})
It("podman run -d mount cleanup test", func() {
+ SkipIfRootless()
+
result := podmanTest.Podman([]string{"run", "-dt", ALPINE, "top"})
result.WaitWithDefaultTimeout()
cid := result.OutputToString()
@@ -43,25 +44,30 @@ var _ = Describe("Podman run exit", func() {
mount := SystemExec("mount", nil)
Expect(mount.ExitCode()).To(Equal(0))
- Expect(strings.Contains(mount.OutputToString(), cid))
+ Expect(mount.OutputToString()).To(ContainSubstring(cid))
pmount := podmanTest.Podman([]string{"mount", "--notruncate"})
pmount.WaitWithDefaultTimeout()
- Expect(strings.Contains(pmount.OutputToString(), cid))
Expect(pmount.ExitCode()).To(Equal(0))
+ Expect(pmount.OutputToString()).To(ContainSubstring(cid))
stop := podmanTest.Podman([]string{"stop", cid})
stop.WaitWithDefaultTimeout()
Expect(stop.ExitCode()).To(Equal(0))
+ // We have to force cleanup so the unmount happens
+ podmanCleanupSession := podmanTest.Podman([]string{"container", "cleanup", cid})
+ podmanCleanupSession.WaitWithDefaultTimeout()
+ Expect(podmanCleanupSession.ExitCode()).To(Equal(0))
+
mount = SystemExec("mount", nil)
Expect(mount.ExitCode()).To(Equal(0))
- Expect(!strings.Contains(mount.OutputToString(), cid))
+ Expect(mount.OutputToString()).NotTo(ContainSubstring(cid))
pmount = podmanTest.Podman([]string{"mount", "--notruncate"})
pmount.WaitWithDefaultTimeout()
- Expect(!strings.Contains(pmount.OutputToString(), cid))
Expect(pmount.ExitCode()).To(Equal(0))
+ Expect(pmount.OutputToString()).NotTo(ContainSubstring(cid))
})
})
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-12-25 18:01:56 +0000