summaryrefslogtreecommitdiff
path: root/test/system
diff options
context:
space:
mode:
Diffstat (limited to 'test/system')
-rw-r--r--test/system/030-run.bats4
-rw-r--r--test/system/050-stop.bats2
-rw-r--r--test/system/065-cp.bats315
-rw-r--r--test/system/070-build.bats118
-rw-r--r--test/system/120-load.bats7
-rw-r--r--test/system/410-selinux.bats21
-rwxr-xr-xtest/system/build-testimage52
-rw-r--r--test/system/helpers.bash9
8 files changed, 428 insertions, 100 deletions
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 93449ece9..b2999a9e7 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -139,7 +139,7 @@ echo $rand | 0 | $rand
is "$output" "" "--pull=never [present]: no output"
# Now test with a remote image which we don't have present (the 00 tag)
- NONLOCAL_IMAGE="$PODMAN_TEST_IMAGE_REGISTRY/$PODMAN_TEST_IMAGE_USER/$PODMAN_TEST_IMAGE_NAME:00000000"
+ NONLOCAL_IMAGE="$PODMAN_NONLOCAL_IMAGE_FQN"
run_podman 125 run --pull=never $NONLOCAL_IMAGE true
is "$output" "Error: unable to find a name and tag match for $NONLOCAL_IMAGE in repotags: no such image" "--pull=never [with image not present]: error"
@@ -175,7 +175,7 @@ echo $rand | 0 | $rand
# 'run --rmi' deletes the image in the end unless it's used by another container
@test "podman run --rmi" {
# Name of a nonlocal image. It should be pulled in by the first 'run'
- NONLOCAL_IMAGE="$PODMAN_TEST_IMAGE_REGISTRY/$PODMAN_TEST_IMAGE_USER/$PODMAN_TEST_IMAGE_NAME:00000000"
+ NONLOCAL_IMAGE="$PODMAN_NONLOCAL_IMAGE_FQN"
run_podman 1 image exists $NONLOCAL_IMAGE
# Run a container, without --rm; this should block subsequent --rmi
diff --git a/test/system/050-stop.bats b/test/system/050-stop.bats
index 7d9f1fcb3..0652a97e4 100644
--- a/test/system/050-stop.bats
+++ b/test/system/050-stop.bats
@@ -66,7 +66,7 @@ load helpers
name=thiscontainerdoesnotexist
run_podman 125 stop $name
is "$output" \
- "Error: no container with name or ID $name found: no such container" \
+ "Error: no container with name or ID \"$name\" found: no such container" \
"podman stop nonexistent container"
run_podman stop --ignore $name
diff --git a/test/system/065-cp.bats b/test/system/065-cp.bats
index 312106b36..73e807843 100644
--- a/test/system/065-cp.bats
+++ b/test/system/065-cp.bats
@@ -15,6 +15,7 @@ load helpers
random-1-$(random_string 15)
random-2-$(random_string 20)
)
+
echo "${randomcontent[0]}" > $srcdir/hostfile0
echo "${randomcontent[1]}" > $srcdir/hostfile1
echo "${randomcontent[2]}" > $srcdir/hostfile2
@@ -24,6 +25,10 @@ load helpers
run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
run_podman exec cpcontainer mkdir /srv/subdir
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
# format is: <id> | <destination arg to cp> | <full dest path> | <test name>
# where:
# id is 0-2, one of the random strings/files
@@ -44,8 +49,7 @@ load helpers
0 | subdir | /srv/subdir/hostfile0 | copy to workdir/subdir
"
- # Copy one of the files into container, exec+cat, confirm the file
- # is there and matches what we expect
+ # RUNNING container
while read id dest dest_fullname description; do
run_podman cp $srcdir/hostfile$id cpcontainer:$dest
run_podman exec cpcontainer cat $dest_fullname
@@ -67,6 +71,61 @@ load helpers
is "$output" 'Error: "/IdoNotExist/" could not be found on container cpcontainer: No such file or directory' \
"copy into nonexistent path in container"
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+
+ # CREATED container
+ while read id dest dest_fullname description; do
+ run_podman create --name cpcontainer --workdir=/srv $cpimage sleep infinity
+ run_podman cp $srcdir/hostfile$id cpcontainer:$dest
+ run_podman start cpcontainer
+ run_podman exec cpcontainer cat $dest_fullname
+ is "$output" "${randomcontent[$id]}" "$description (cp -> ctr:$dest)"
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+ done < <(parse_table "$tests")
+
+ run_podman rmi -f $cpimage
+}
+
+
+@test "podman cp file from host to container tmpfs mount" {
+ srcdir=$PODMAN_TMPDIR/cp-test-file-host-to-ctr
+ mkdir -p $srcdir
+ content=tmpfile-content$(random_string 20)
+ echo $content > $srcdir/file
+
+ # RUNNING container
+ run_podman run -d --mount type=tmpfs,dst=/tmp --name cpcontainer $IMAGE sleep infinity
+ run_podman cp $srcdir/file cpcontainer:/tmp
+ run_podman exec cpcontainer cat /tmp/file
+ is "$output" "${content}" "cp to running container's tmpfs"
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+
+ # CREATED container (with copy up)
+ run_podman create --mount type=tmpfs,dst=/tmp --name cpcontainer $IMAGE sleep infinity
+ run_podman cp $srcdir/file cpcontainer:/tmp
+ run_podman start cpcontainer
+ run_podman exec cpcontainer cat /tmp/file
+ is "$output" "${content}" "cp to created container's tmpfs"
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+}
+
+
+@test "podman cp file from host to container and check ownership" {
+ srcdir=$PODMAN_TMPDIR/cp-test-file-host-to-ctr
+ mkdir -p $srcdir
+ content=cp-user-test-$(random_string 10)
+ echo "content" > $srcdir/hostfile
+ userid=$(id -u)
+
+ run_podman run --user=$userid --userns=keep-id -d --name cpcontainer $IMAGE sleep infinity
+ run_podman cp $srcdir/hostfile cpcontainer:/tmp/hostfile
+ run_podman exec cpcontainer stat -c "%u" /tmp/hostfile
+ is "$output" "$userid" "copied file is chowned to the container user"
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
}
@@ -87,6 +146,10 @@ load helpers
run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /srv/containerfile1"
run_podman exec cpcontainer sh -c "mkdir /srv/subdir; echo ${randomcontent[2]} > /srv/subdir/containerfile2"
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
# format is: <id> | <source arg to cp> | <destination arg (appended to $srcdir) to cp> | <full dest path (appended to $srcdir)> | <test name>
tests="
0 | /tmp/containerfile | | /containerfile | copy to srcdir/
@@ -98,109 +161,214 @@ load helpers
2 | subdir/containerfile2 | / | /containerfile2 | copy from workdir/subdir (rel path) to srcdir
"
- # Copy one of the files to the host, cat, confirm the file
- # is there and matches what we expect
+ # RUNNING container
while read id src dest dest_fullname description; do
# dest may be "''" for empty table cells
if [[ $dest == "''" ]];then
unset dest
fi
run_podman cp cpcontainer:$src "$srcdir$dest"
- run cat $srcdir$dest_fullname
- is "$output" "${randomcontent[$id]}" "$description (cp ctr:$src to \$srcdir$dest)"
- rm $srcdir/$dest_fullname
+ is "$(< $srcdir$dest_fullname)" "${randomcontent[$id]}" "$description (cp ctr:$src to \$srcdir$dest)"
+ rm $srcdir$dest_fullname
done < <(parse_table "$tests")
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+ # Created container
+ run_podman create --name cpcontainer --workdir=/srv $cpimage
+ while read id src dest dest_fullname description; do
+ # dest may be "''" for empty table cells
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+ run_podman cp cpcontainer:$src "$srcdir$dest"
+ is "$(< $srcdir$dest_fullname)" "${randomcontent[$id]}" "$description (cp ctr:$src to \$srcdir$dest)"
+ rm $srcdir$dest_fullname
+ done < <(parse_table "$tests")
run_podman rm -f cpcontainer
+
+ run_podman rmi -f $cpimage
}
@test "podman cp dir from host to container" {
- dirname=dir-test
- srcdir=$PODMAN_TMPDIR/$dirname
- mkdir -p $srcdir
+ srcdir=$PODMAN_TMPDIR
+ mkdir -p $srcdir/dir/sub
local -a randomcontent=(
random-0-$(random_string 10)
random-1-$(random_string 15)
)
- echo "${randomcontent[0]}" > $srcdir/hostfile0
- echo "${randomcontent[1]}" > $srcdir/hostfile1
+ echo "${randomcontent[0]}" > $srcdir/dir/sub/hostfile0
+ echo "${randomcontent[1]}" > $srcdir/dir/sub/hostfile1
# "." and "dir/." will copy the contents, so make sure that a dir ending
# with dot is treated correctly.
- mkdir -p $srcdir.
- cp $srcdir/* $srcdir./
+ mkdir -p $srcdir/dir.
+ cp -r $srcdir/dir/* $srcdir/dir.
run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
run_podman exec cpcontainer mkdir /srv/subdir
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
# format is: <source arg to cp (appended to srcdir)> | <destination arg to cp> | <full dest path> | <test name>
tests="
- | / | /dir-test | copy to root
- . | / | /dir-test. | copy dotdir to root
- / | /tmp | /tmp/dir-test | copy to tmp
- /. | /usr/ | /usr/ | copy contents of dir to usr/
- | . | /srv/dir-test | copy to workdir (rel path)
- | subdir/. | /srv/subdir/dir-test | copy to workdir subdir (rel path)
+ dir | / | /dir/sub | copy dir to root
+ dir. | / | /dir./sub | copy dir. to root
+ dir/ | /tmp | /tmp/dir/sub | copy dir/ to tmp
+ dir/. | /usr/ | /usr/sub | copy dir/. usr/
+ dir/sub | . | /srv/sub | copy dir/sub to workdir (rel path)
+ dir/sub/. | subdir/. | /srv/subdir | copy dir/sub/. to workdir subdir (rel path)
+ dir | /newdir1 | /newdir1/sub | copy dir to newdir1
+ dir/ | /newdir2 | /newdir2/sub | copy dir/ to newdir2
+ dir/. | /newdir3 | /newdir3/sub | copy dir/. to newdir3
"
+ # RUNNING container
while read src dest dest_fullname description; do
# src may be "''" for empty table cells
if [[ $src == "''" ]];then
unset src
fi
- run_podman cp $srcdir$src cpcontainer:$dest
- run_podman exec cpcontainer ls $dest_fullname
- run_podman exec cpcontainer cat $dest_fullname/hostfile0
- is "$output" "${randomcontent[0]}" "$description (cp -> ctr:$dest)"
- run_podman exec cpcontainer cat $dest_fullname/hostfile1
- is "$output" "${randomcontent[1]}" "$description (cp -> ctr:$dest)"
+ run_podman cp $srcdir/$src cpcontainer:$dest
+ run_podman exec cpcontainer cat $dest_fullname/hostfile0 $dest_fullname/hostfile1
+ is "${lines[0]}" "${randomcontent[0]}" "$description (cp -> ctr:$dest)"
+ is "${lines[1]}" "${randomcontent[1]}" "$description (cp -> ctr:$dest)"
done < <(parse_table "$tests")
-
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
+
+ # CREATED container
+ while read src dest dest_fullname description; do
+ # src may be "''" for empty table cells
+ if [[ $src == "''" ]];then
+ unset src
+ fi
+ run_podman create --name cpcontainer --workdir=/srv $cpimage sleep infinity
+ run_podman cp $srcdir/$src cpcontainer:$dest
+ run_podman start cpcontainer
+ run_podman exec cpcontainer cat $dest_fullname/hostfile0 $dest_fullname/hostfile1
+ is "${lines[0]}" "${randomcontent[0]}" "$description (cp -> ctr:$dest)"
+ is "${lines[1]}" "${randomcontent[1]}" "$description (cp -> ctr:$dest)"
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+ done < <(parse_table "$tests")
+
+ run_podman rmi -f $cpimage
}
@test "podman cp dir from container to host" {
- srcdir=$PODMAN_TMPDIR/dir-test
- mkdir -p $srcdir
+ destdir=$PODMAN_TMPDIR/cp-test-dir-ctr-to-host
+ mkdir -p $destdir
+ # Create 2 files with random content in the container.
+ local -a randomcontent=(
+ random-0-$(random_string 10)
+ random-1-$(random_string 15)
+ )
run_podman run -d --name cpcontainer --workdir=/srv $IMAGE sleep infinity
- run_podman exec cpcontainer sh -c 'mkdir /srv/subdir; echo "This first file is on the container" > /srv/subdir/containerfile1'
- run_podman exec cpcontainer sh -c 'echo "This second file is on the container as well" > /srv/subdir/containerfile2'
+ run_podman exec cpcontainer sh -c "mkdir /srv/subdir; echo ${randomcontent[0]} > /srv/subdir/containerfile0"
+ run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /srv/subdir/containerfile1"
# "." and "dir/." will copy the contents, so make sure that a dir ending
# with dot is treated correctly.
run_podman exec cpcontainer sh -c 'mkdir /tmp/subdir.; cp /srv/subdir/* /tmp/subdir./'
- run_podman cp cpcontainer:/srv $srcdir
- run cat $srcdir/srv/subdir/containerfile1
- is "$output" "This first file is on the container"
- run cat $srcdir/srv/subdir/containerfile2
- is "$output" "This second file is on the container as well"
- rm -rf $srcdir/srv/subdir
-
- run_podman cp cpcontainer:/srv/. $srcdir
- run ls $srcdir/subdir
- run cat $srcdir/subdir/containerfile1
- is "$output" "This first file is on the container"
- run cat $srcdir/subdir/containerfile2
- is "$output" "This second file is on the container as well"
- rm -rf $srcdir/subdir
-
- run_podman cp cpcontainer:/srv/subdir/. $srcdir
- run cat $srcdir/containerfile1
- is "$output" "This first file is on the container"
- run cat $srcdir/containerfile2
- is "$output" "This second file is on the container as well"
- rm -rf $srcdir/subdir
-
- run_podman cp cpcontainer:/tmp/subdir. $srcdir
- run cat $srcdir/subdir./containerfile1
- is "$output" "This first file is on the container"
- run cat $srcdir/subdir./containerfile2
- is "$output" "This second file is on the container as well"
- rm -rf $srcdir/subdir.
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
+ # format is: <source arg to cp (appended to /srv)> | <dest> | <full dest path> | <test name>
+ tests="
+/srv | | /srv/subdir | copy /srv
+/srv | /newdir | /newdir/subdir | copy /srv to /newdir
+/srv/ | | /srv/subdir | copy /srv/
+/srv/. | | /subdir | copy /srv/.
+/srv/. | /newdir | /newdir/subdir | copy /srv/. to /newdir
+/srv/subdir/. | | | copy /srv/subdir/.
+/tmp/subdir. | | /subdir. | copy /tmp/subdir.
+"
+
+ # RUNNING container
+ while read src dest dest_fullname description; do
+ if [[ $src == "''" ]];then
+ unset src
+ fi
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+ if [[ $dest_fullname == "''" ]];then
+ unset dest_fullname
+ fi
+ run_podman cp cpcontainer:$src $destdir$dest
+ is "$(< $destdir$dest_fullname/containerfile0)" "${randomcontent[0]}" "$description"
+ is "$(< $destdir$dest_fullname/containerfile1)" "${randomcontent[1]}" "$description"
+ rm -rf $destdir/*
+ done < <(parse_table "$tests")
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+
+ # CREATED container
+ run_podman create --name cpcontainer --workdir=/srv $cpimage
+ while read src dest dest_fullname description; do
+ if [[ $src == "''" ]];then
+ unset src
+ fi
+ if [[ $dest == "''" ]];then
+ unset dest
+ fi
+ if [[ $dest_fullname == "''" ]];then
+ unset dest_fullname
+ fi
+ run_podman cp cpcontainer:$src $destdir$dest
+ is "$(< $destdir$dest_fullname/containerfile0)" "${randomcontent[0]}" "$description"
+ is "$(< $destdir$dest_fullname/containerfile1)" "${randomcontent[1]}" "$description"
+ rm -rf $destdir/*
+ done < <(parse_table "$tests")
+ run_podman rm -f cpcontainer
+
+ run_podman rmi -f $cpimage
+}
+
+
+@test "podman cp symlinked directory from container" {
+ destdir=$PODMAN_TMPDIR/cp-weird-symlink
+ mkdir -p $destdir
+
+ # Create 3 files with random content in the container.
+ local -a randomcontent=(
+ random-0-$(random_string 10)
+ random-1-$(random_string 15)
+ )
+ run_podman run -d --name cpcontainer $IMAGE sleep infinity
+ run_podman exec cpcontainer sh -c "echo ${randomcontent[0]} > /tmp/containerfile0"
+ run_podman exec cpcontainer sh -c "echo ${randomcontent[1]} > /tmp/containerfile1"
+ run_podman exec cpcontainer sh -c "mkdir /tmp/sub && cd /tmp/sub && ln -s .. weirdlink"
+
+ # Commit the image for testing non-running containers
+ run_podman commit -q cpcontainer
+ cpimage="$output"
+
+ # RUNNING container
+ # NOTE: /dest does not exist yet but is expected to be created during copy
+ run_podman cp cpcontainer:/tmp/sub/weirdlink $destdir/dest
+ run cat $destdir/dest/containerfile0 $destdir/dest/containerfile1
+ is "${lines[0]}" "${randomcontent[0]}" "eval symlink - running container"
+ is "${lines[1]}" "${randomcontent[1]}" "eval symlink - running container"
+
+ run_podman kill cpcontainer
+ run_podman rm -f cpcontainer
+ run rm -rf $srcdir/dest
+
+ # CREATED container
+ run_podman create --name cpcontainer $cpimage
+ run_podman cp cpcontainer:/tmp/sub/weirdlink $destdir/dest
+ run cat $destdir/dest/containerfile0 $destdir/dest/containerfile1
+ is "${lines[0]}" "${randomcontent[0]}" "eval symlink - created container"
+ is "${lines[1]}" "${randomcontent[1]}" "eval symlink - created container"
run_podman rm -f cpcontainer
}
@@ -228,9 +396,7 @@ load helpers
run_podman create --name cpcontainer -v $volume1:/tmp/volume -v $volume2:/tmp/volume/sub-volume $IMAGE
run_podman cp $srcdir/hostfile cpcontainer:/tmp/volume/sub-volume
-
- run cat $volume2_mount/hostfile
- is "$output" "This file should be in volume2"
+ is "$(< $volume2_mount/hostfile)" "This file should be in volume2"
# Volume 1 must be empty.
run ls $volume1_mount
@@ -254,9 +420,7 @@ load helpers
run_podman create --name cpcontainer -v $volume:/tmp/volume -v $mountdir:/tmp/volume/mount $IMAGE
run_podman cp $srcdir/hostfile cpcontainer:/tmp/volume/mount
-
- run cat $mountdir/hostfile
- is "$output" "This file should be in the mount"
+ is "$(< $mountdir/hostfile)" "This file should be in the mount"
run_podman rm -f cpcontainer
run_podman volume rm $volume
@@ -284,7 +448,7 @@ load helpers
# cp no longer supports wildcarding
run_podman 125 cp 'cpcontainer:/tmp/*' $dstdir
- run_podman rm cpcontainer
+ run_podman rm -f cpcontainer
}
@@ -308,7 +472,7 @@ load helpers
# make sure there are no files in dstdir
is "$(/bin/ls -1 $dstdir)" "" "incorrectly copied symlink from host"
- run_podman rm cpcontainer
+ run_podman rm -f cpcontainer
}
@@ -332,7 +496,7 @@ load helpers
# make sure there are no files in dstdir
is "$(/bin/ls -1 $dstdir)" "" "incorrectly copied symlink from host"
- run_podman rm cpcontainer
+ run_podman rm -f cpcontainer
}
@@ -352,7 +516,7 @@ load helpers
# dstdir must be empty
is "$(/bin/ls -1 $dstdir)" "" "incorrectly copied symlink from host"
- run_podman rm cpcontainer
+ run_podman rm -f cpcontainer
}
@@ -409,6 +573,7 @@ load helpers
run_podman exec cpcontainer cat /tmp/d3/x
is "$output" "$rand_content3" "cp creates file named x"
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
}
@@ -446,6 +611,7 @@ load helpers
run_podman exec cpcontainer cat $graphroot/$rand_filename
is "$output" "$rand_content" "Contents of file copied into container"
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
}
@@ -494,6 +660,7 @@ load helpers
run_podman 125 cp - cpcontainer:/tmp/IdoNotExist < $tar_file
is "$output" 'Error: destination must be a directory when copying from stdin'
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
}
@@ -527,8 +694,7 @@ load helpers
fi
tar xvf $srcdir/stdout.tar -C $srcdir
- run cat $srcdir/file.txt
- is "$output" "$rand_content"
+ is "$(< $srcdir/file.txt)" "$rand_content"
run 1 ls $srcdir/empty.txt
rm -f $srcdir/*
@@ -539,11 +705,10 @@ load helpers
fi
tar xvf $srcdir/stdout.tar -C $srcdir
- run cat $srcdir/tmp/file.txt
- is "$output" "$rand_content"
- run cat $srcdir/tmp/empty.txt
- is "$output" ""
+ is "$(< $srcdir/tmp/file.txt)" "$rand_content"
+ is "$(< $srcdir/tmp/empty.txt)" ""
+ run_podman kill cpcontainer
run_podman rm -f cpcontainer
}
diff --git a/test/system/070-build.bats b/test/system/070-build.bats
index 89f3f5c64..d413b0c10 100644
--- a/test/system/070-build.bats
+++ b/test/system/070-build.bats
@@ -168,6 +168,9 @@ EOF
CAT_SECRET="cat /run/secrets/$secret_filename"
fi
+ # For --dns-search: a domain that is unlikely to exist
+ local nosuchdomain=nx$(random_string 10).net
+
# Command to run on container startup with no args
cat >$tmpdir/mycmd <<EOF
#!/bin/sh
@@ -188,11 +191,17 @@ EOF
https_proxy=https-proxy-in-env-file
EOF
+ # Build args: one explicit (foo=bar), one implicit (foo)
+ local arg_implicit_value=implicit_$(random_string 15)
+ local arg_explicit_value=explicit_$(random_string 15)
+
# NOTE: it's important to not create the workdir.
# Podman will make sure to create a missing workdir
# if needed. See #9040.
cat >$tmpdir/Containerfile <<EOF
FROM $IMAGE
+ARG arg_explicit
+ARG arg_implicit
LABEL $label_name=$label_value
WORKDIR $workdir
@@ -217,18 +226,47 @@ RUN chown 2:3 /bin/mydefaultcmd
RUN $CAT_SECRET
+RUN echo explicit-build-arg=\$arg_explicit
+RUN echo implicit-build-arg=\$arg_implicit
+
CMD ["/bin/mydefaultcmd","$s_echo"]
+RUN cat /etc/resolv.conf
EOF
+ # The goal is to test that a missing value will be inherited from
+ # environment - but that can't work with remote, so for simplicity
+ # just make it explicit in that case too.
+ local build_arg_implicit="--build-arg arg_implicit"
+ if is_remote; then
+ build_arg_implicit+="=$arg_implicit_value"
+ fi
+
# cd to the dir, so we test relative paths (important for podman-remote)
cd $PODMAN_TMPDIR
+ export arg_explicit="THIS SHOULD BE OVERRIDDEN BY COMMAND LINE!"
+ export arg_implicit=${arg_implicit_value}
run_podman ${MOUNTS_CONF} build \
+ --build-arg arg_explicit=${arg_explicit_value} \
+ $build_arg_implicit \
+ --dns-search $nosuchdomain \
-t build_test -f build-test/Containerfile build-test
local iid="${lines[-1]}"
+ if [[ $output =~ missing.*build.argument ]]; then
+ die "podman did not see the given --build-arg(s)"
+ fi
+
# Make sure 'podman build' had the secret mounted
is "$output" ".*$secret_contents.*" "podman build has /run/secrets mounted"
+ # --build-arg should be set, both via 'foo=bar' and via just 'foo' ($foo)
+ is "$output" ".*explicit-build-arg=${arg_explicit_value}" \
+ "--build-arg arg_explicit=explicit-value works"
+ is "$output" ".*implicit-build-arg=${arg_implicit_value}" \
+ "--build-arg arg_implicit works (inheriting from environment)"
+ is "$output" ".*search $nosuchdomain" \
+ "--dns-search added to /etc/resolv.conf"
+
if is_remote; then
ENVHOST=""
else
@@ -305,8 +343,10 @@ Cmd[0] | /bin/mydefaultcmd
Cmd[1] | $s_echo
WorkingDir | $workdir
Labels.$label_name | $label_value
-Labels.\"io.buildah.version\" | $buildah_version
"
+ # FIXME: 2021-02-24: Fixed in buildah #3036; reenable this once podman
+ # vendors in a newer buildah!
+ # Labels.\"io.buildah.version\" | $buildah_version
parse_table "$tests" | while read field expect; do
actual=$(jq -r ".[0].Config.$field" <<<"$output")
@@ -360,6 +400,82 @@ Labels.\"io.buildah.version\" | $buildah_version
run_podman rmi -f build_test
}
+@test "podman build - COPY with ignore" {
+ local tmpdir=$PODMAN_TMPDIR/build-test-$(random_string 10)
+ mkdir -p $tmpdir/subdir
+
+ # Create a bunch of files. Declare this as an array to avoid duplication
+ # because we iterate over that list below, checking for each file.
+ # A leading "-" indicates that the file SHOULD NOT exist in the built image
+ local -a files=(
+ -test1 -test1.txt
+ test2 test2.txt
+ subdir/sub1 subdir/sub1.txt
+ -subdir/sub2 -subdir/sub2.txt
+ this-file-does-not-match-anything-in-ignore-file
+ comment
+ )
+ for f in ${files[@]}; do
+ # The magic '##-' strips off the '-' prefix
+ echo "$f" > $tmpdir/${f##-}
+ done
+
+ # Directory that doesn't exist in the image; COPY should create it
+ local newdir=/newdir-$(random_string 12)
+ cat >$tmpdir/Containerfile <<EOF
+FROM $IMAGE
+COPY ./ $newdir/
+EOF
+
+ # Run twice: first with a custom --ignorefile, then with a default one.
+ # This ordering is deliberate: if we were to run with .dockerignore
+ # first, and forget to rm it, and then run with --ignorefile, _and_
+ # there was a bug in podman where --ignorefile was a NOP (eg #9570),
+ # the test might pass because of the existence of .dockerfile.
+ for ignorefile in ignoreme-$(random_string 5) .dockerignore; do
+ # Patterns to ignore. Mostly copied from buildah/tests/bud/dockerignore
+ cat >$tmpdir/$ignorefile <<EOF
+# comment
+test*
+!test2*
+subdir
+!*/sub1*
+EOF
+
+ # Build an image. For .dockerignore
+ local -a ignoreflag
+ unset ignoreflag
+ if [[ $ignorefile != ".dockerignore" ]]; then
+ ignoreflag="--ignorefile $tmpdir/$ignorefile"
+ fi
+ run_podman build -t build_test ${ignoreflag} $tmpdir
+
+ # Delete the ignore file! Otherwise, in the next iteration of the loop,
+ # we could end up with an existing .dockerignore that invisibly
+ # takes precedence over --ignorefile
+ rm -f $tmpdir/$ignorefile
+
+ # It would be much more readable, and probably safer, to iterate
+ # over each file, running 'podman run ... ls -l $f'. But each podman run
+ # takes a second or so, and we are mindful of each second.
+ run_podman run --rm build_test find $newdir -type f
+ for f in ${files[@]}; do
+ if [[ $f =~ ^- ]]; then
+ f=${f##-}
+ if [[ $output =~ $f ]]; then
+ die "File '$f' found in image; it should have been ignored via $ignorefile"
+ fi
+ else
+ is "$output" ".*$newdir/$f" \
+ "File '$f' should exist in container (no match in $ignorefile)"
+ fi
+ done
+
+ # Clean up
+ run_podman rmi -f build_test
+ done
+}
+
@test "podman build - stdin test" {
# Random workdir, and random string to verify build output
workdir=/$(random_string 10)
diff --git a/test/system/120-load.bats b/test/system/120-load.bats
index 902cd9f5e..936449bdb 100644
--- a/test/system/120-load.bats
+++ b/test/system/120-load.bats
@@ -26,6 +26,13 @@ verify_iid_and_name() {
is "$new_img_name" "$1" "Name & tag of restored image"
}
+@test "podman load invalid file" {
+ # Regression test for #9672 to make sure invalid input yields errors.
+ invalid=$PODMAN_TMPDIR/invalid
+ echo "I am an invalid file and should cause a podman-load error" > $invalid
+ run_podman 125 load -i $invalid
+}
+
@test "podman save to pipe and load" {
# Generate a random name and tag (must be lower-case)
local random_name=x0$(random_string 12 | tr A-Z a-z)
diff --git a/test/system/410-selinux.bats b/test/system/410-selinux.bats
index 7482d3e55..49743ff33 100644
--- a/test/system/410-selinux.bats
+++ b/test/system/410-selinux.bats
@@ -39,17 +39,17 @@ function check_label() {
}
@test "podman selinux: container with label=disable" {
- skip_if_rootless
-
check_label "--security-opt label=disable" "spc_t"
}
@test "podman selinux: privileged container" {
- skip_if_rootless
-
check_label "--privileged --userns=host" "spc_t"
}
+@test "podman selinux: init container" {
+ check_label "--systemd=always" "container_init_t"
+}
+
@test "podman selinux: pid=host" {
# FIXME FIXME FIXME: Remove these lines once all VMs have >= 2.146.0
# (this is ugly, but better than an unconditional skip)
@@ -74,6 +74,19 @@ function check_label() {
check_label "--security-opt label=level:s0:c1,c2" "container_t" "s0:c1,c2"
}
+@test "podman selinux: inspect kvm labels" {
+ skip_if_no_selinux
+ skip_if_remote "runtime flag is not passed over remote"
+
+ tmpdir=$PODMAN_TMPDIR/kata-test
+ mkdir -p $tmpdir
+ KATA=${tmpdir}/kata-runtime
+ ln -s /bin/true ${KATA}
+ run_podman create --runtime=${KATA} --name myc $IMAGE
+ run_podman inspect --format='{{ .ProcessLabel }}' myc
+ is "$output" ".*container_kvm_t"
+}
+
# pr #6752
@test "podman selinux: inspect multiple labels" {
skip_if_no_selinux
diff --git a/test/system/build-testimage b/test/system/build-testimage
index 53ade57f0..aac08e307 100755
--- a/test/system/build-testimage
+++ b/test/system/build-testimage
@@ -12,6 +12,9 @@
# still need a fedora image for that.
#
+# Buildah binary
+BUILDAH=${BUILDAH:-buildah}
+
# Tag for this new image
YMD=$(date +%Y%m%d)
@@ -58,7 +61,8 @@ chmod 755 pause
# - check for updates @ https://hub.docker.com/_/alpine
# busybox-extras provides httpd needed in 500-networking.bats
cat >Containerfile <<EOF
-FROM docker.io/library/alpine:3.12.0
+ARG ARCH=please-override-arch
+FROM docker.io/\${ARCH}/alpine:3.12.0
RUN apk add busybox-extras
ADD testimage-id pause /home/podman/
LABEL created_by=$create_script
@@ -69,26 +73,44 @@ EOF
# --squash-all : needed by 'tree' test in 070-build.bats
podman rmi -f testimage &> /dev/null || true
-podman build --squash-all -t testimage .
+
+# We need to use buildah because (as of 2021-02-23) only buildah has --manifest
+# and because Dan says arch emulation is not currently working on podman
+# (no further details).
+# Arch emulation on Fedora requires the qemu-user-static package.
+for arch in amd64 ppc64le s390x;do
+ ${BUILDAH} bud \
+ --arch=$arch \
+ --build-arg ARCH=$arch \
+ --manifest=testimage \
+ --squash \
+ .
+done
# Clean up
cd /tmp
rm -rf $tmpdir
-# Tag and push to quay.
-podman tag testimage quay.io/libpod/testimage:$YMD
-podman push quay.io/libpod/testimage:$YMD
+# Tag image and push (all arches) to quay.
+remote_tag=quay.io/libpod/testimage:$YMD
+podman tag testimage ${remote_tag}
+${BUILDAH} manifest push --all ${remote_tag} docker://${remote_tag}
-# Side note: there should always be a testimage tagged ':00000000'
-# (eight zeroes) in the same location; this is used by tests which
-# need to pull a non-locally-cached image. This image will rarely
-# if ever need to change, nor in fact does it even have to be a
-# copy of this testimage since all we use it for is 'true'.
+# Side note: there should always be a testimage tagged ':0000000<X>'
+# (eight digits, zero-padded sequence ID) in the same location; this is
+# used by tests which need to pull a non-locally-cached image. This
+# image will rarely if ever need to change, nor in fact does it even
+# have to be a copy of this testimage since all we use it for is 'true'.
+# However, it does need to be multiarch :-(
#
-# As of 2020-09-02 it is simply busybox, because it is super small:
+# As of 2021-02-24 it is simply busybox, because it is super small,
+# but it's complicated because of multiarch:
#
-# podman pull docker.io/library/busybox:1.32.0
-# podman tag docker.io/library/busybox:1.32.0 \
-# quay.io/libpod/testimage:00000000
-# podman push quay.io/libpod/testimage:00000000
+# img=quay.io/libpod/testimage:00000001
+# buildah manifest create $img
+# for arch in amd64 ppc64le s390x;do
+# buildah pull --arch $arch docker.io/$arch/busybox:1.32.0
+# buildah manifest add $img docker.io/$arch/busybox:1.32.0
+# done
+# buildah manifest push --all $img docker://$img
#
diff --git a/test/system/helpers.bash b/test/system/helpers.bash
index 0572c6866..38e317709 100644
--- a/test/system/helpers.bash
+++ b/test/system/helpers.bash
@@ -7,9 +7,14 @@ PODMAN=${PODMAN:-podman}
PODMAN_TEST_IMAGE_REGISTRY=${PODMAN_TEST_IMAGE_REGISTRY:-"quay.io"}
PODMAN_TEST_IMAGE_USER=${PODMAN_TEST_IMAGE_USER:-"libpod"}
PODMAN_TEST_IMAGE_NAME=${PODMAN_TEST_IMAGE_NAME:-"testimage"}
-PODMAN_TEST_IMAGE_TAG=${PODMAN_TEST_IMAGE_TAG:-"20200929"}
+PODMAN_TEST_IMAGE_TAG=${PODMAN_TEST_IMAGE_TAG:-"20210223"}
PODMAN_TEST_IMAGE_FQN="$PODMAN_TEST_IMAGE_REGISTRY/$PODMAN_TEST_IMAGE_USER/$PODMAN_TEST_IMAGE_NAME:$PODMAN_TEST_IMAGE_TAG"
+# Remote image that we *DO NOT* fetch or keep by default; used for testing pull
+# This changed from 0 to 1 on 2021-02-24 due to multiarch considerations; it
+# should change only very rarely.
+PODMAN_NONLOCAL_IMAGE_FQN="$PODMAN_TEST_IMAGE_REGISTRY/$PODMAN_TEST_IMAGE_USER/$PODMAN_TEST_IMAGE_NAME:00000001"
+
# Because who wants to spell that out each time?
IMAGE=$PODMAN_TEST_IMAGE_FQN
@@ -149,7 +154,7 @@ function run_podman() {
echo "$_LOG_PROMPT $PODMAN $*"
# BATS hangs if a subprocess remains and keeps FD 3 open; this happens
# if podman crashes unexpectedly without cleaning up subprocesses.
- run timeout --foreground -v --kill=10 $PODMAN_TIMEOUT $PODMAN "$@" 3>/dev/null
+ run timeout --foreground -v --kill=10 $PODMAN_TIMEOUT $PODMAN $_PODMAN_TEST_OPTS "$@" 3>/dev/null
# without "quotes", multiple lines are glommed together into one
if [ -n "$output" ]; then
echo "$output"