diff options
Diffstat (limited to 'test/system')
| -rw-r--r-- | test/system/001-basic.bats | 2 | ||||
| -rw-r--r-- | test/system/030-run.bats | 4 | ||||
| -rw-r--r-- | test/system/160-volumes.bats | 244 | ||||
| -rw-r--r-- | test/system/200-pod-top.bats | 40 | ||||
| -rw-r--r-- | test/system/200-pod.bats | 174 | ||||
| -rw-r--r-- | test/system/250-systemd.bats | 7 |
6 files changed, 428 insertions, 43 deletions
diff --git a/test/system/001-basic.bats b/test/system/001-basic.bats index 5fc07acfb..71595f419 100644 --- a/test/system/001-basic.bats +++ b/test/system/001-basic.bats @@ -23,7 +23,7 @@ function setup() { is "${lines[0]}" "Version:[ ]\+[1-9][0-9.]\+" "Version line 1" is "$output" ".*Go Version: \+" "'Go Version' in output" - is "$output" ".*RemoteAPI Version: \+" "API version in output" + is "$output" ".*API Version: \+" "API version in output" } diff --git a/test/system/030-run.bats b/test/system/030-run.bats index ae2e39d6b..1bcf3896f 100644 --- a/test/system/030-run.bats +++ b/test/system/030-run.bats @@ -8,8 +8,8 @@ load helpers # 2019-09 Fedora 31 and rawhide (32) are switching from runc to crun # because of cgroups v2; crun emits different error messages. # Default to runc: - err_no_such_cmd="Error: .*: starting container process caused .*exec:.*stat /no/such/command: no such file or directory" - err_no_exec_dir="Error: .*: starting container process caused .*exec:.* permission denied" + err_no_such_cmd="Error: .*: starting container process caused.*exec:.*stat /no/such/command: no such file or directory" + err_no_exec_dir="Error: .*: starting container process caused.*exec:.* permission denied" # ...but check the configured runtime engine, and switch to crun as needed run_podman info --format '{{ .Host.OCIRuntime.Path }}' diff --git a/test/system/160-volumes.bats b/test/system/160-volumes.bats new file mode 100644 index 000000000..3233e6f04 --- /dev/null +++ b/test/system/160-volumes.bats @@ -0,0 +1,244 @@ +#!/usr/bin/env bats -*- bats -*- +# +# podman volume-related tests +# + +load helpers + +function setup() { + basic_setup + + run_podman '?' volume rm -a +} + +function teardown() { + run_podman '?' rm -a --volumes + run_podman '?' volume rm -a -f + + basic_teardown +} + + +# Simple volume tests: share files between host and container +@test "podman run --volumes : basic" { + skip_if_remote "volumes cannot be shared across hosts" + + # Create three temporary directories + vol1=${PODMAN_TMPDIR}/v1_$(random_string) + vol2=${PODMAN_TMPDIR}/v2_$(random_string) + vol3=${PODMAN_TMPDIR}/v3_$(random_string) + mkdir $vol1 $vol2 $vol3 + + # In each directory, write a random string to a file + echo $(random_string) >$vol1/file1_in + echo $(random_string) >$vol2/file2_in + echo $(random_string) >$vol3/file3_in + + # Run 'cat' on each file, and compare against local files. Mix -v / --volume + # flags, and specify them out of order just for grins. The shell wildcard + # expansion must sort vol1/2/3 lexically regardless. + v_opts="-v $vol1:/vol1:z --volume $vol3:/vol3:z -v $vol2:/vol2:z" + run_podman run --rm $v_opts $IMAGE sh -c "cat /vol?/file?_in" + + for i in 1 2 3; do + eval voldir=\$vol${i} + is "${lines[$(($i - 1))]}" "$(< $voldir/file${i}_in)" \ + "contents of /vol${i}/file${i}_in" + done + + # Confirm that container sees vol1 as a mount point + run_podman run --rm $v_opts $IMAGE mount + is "$output" ".* on /vol1 type .*" "'mount' in container lists vol1" + + # Have the container do write operations, confirm them on host + out1=$(random_string) + run_podman run --rm $v_opts $IMAGE sh -c "echo $out1 >/vol1/file1_out; + cp /vol2/file2_in /vol3/file3_out" + is "$(<$vol1/file1_out)" "$out1" "contents of /vol1/file1_out" + is "$(<$vol3/file3_out)" "$(<$vol2/file2_in)" "contents of /vol3/file3_out" + + # Writing to read-only volumes: not allowed + run_podman 1 run --rm -v $vol1:/vol1ro:z,ro $IMAGE sh -c "touch /vol1ro/abc" + is "$output" ".*Read-only file system" "touch on read-only volume" +} + + +# Named volumes +@test "podman volume create / run" { + myvolume=myvol$(random_string) + mylabel=$(random_string) + + # Create a named volume + run_podman volume create --label l=$mylabel $myvolume + is "$output" "$myvolume" "output from volume create" + + # Confirm that it shows up in 'volume ls', and confirm values + run_podman volume ls --format json + tests=" +Name | $myvolume +Driver | local +Labels.l | $mylabel +" + parse_table "$tests" | while read field expect; do + actual=$(jq -r ".[0].$field" <<<"$output") + is "$actual" "$expect" "volume ls .$field" + done + + # Run a container that writes to a file in that volume + mountpoint=$(jq -r '.[0].Mountpoint' <<<"$output") + rand=$(random_string) + run_podman run --rm --volume $myvolume:/vol $IMAGE sh -c "echo $rand >/vol/myfile" + + # Confirm that the file is visible, with content, outside the container + is "$(<$mountpoint/myfile)" "$rand" "we see content created in container" + + # Clean up + run_podman volume rm $myvolume +} + + +# Running scripts (executables) from a volume +@test "podman volume: exec/noexec" { + myvolume=myvol$(random_string) + + run_podman volume create $myvolume + is "$output" "$myvolume" "output from volume create" + + run_podman volume inspect --format '{{.Mountpoint}}' $myvolume + mountpoint="$output" + + # Create a script, make it runnable + rand=$(random_string) + cat >$mountpoint/myscript <<EOF +#!/bin/sh +echo "got here -$rand-" +EOF + chmod 755 $mountpoint/myscript + + # By default, volumes are mounted exec, but we have manually added the + # noexec option. This should fail. + # ARGH. Unfortunately, runc (used for cgroups v1) produces a different error + local expect_rc=126 + local expect_msg='.* OCI runtime permission denied.*' + run_podman info --format '{{ .Host.OCIRuntime.Path }}' + if expr "$output" : ".*/runc"; then + expect_rc=1 + expect_msg='.* exec user process caused.*permission denied' + fi + + run_podman ${expect_rc} run --rm --volume $myvolume:/vol:noexec,z $IMAGE /vol/myscript + is "$output" "$expect_msg" "run on volume, noexec" + + # With the default, it should pass + run_podman run --rm -v $myvolume:/vol:z $IMAGE /vol/myscript + is "$output" "got here -$rand-" "script in volume is runnable with default (exec)" + + # Clean up + run_podman volume rm $myvolume +} + + +# Anonymous temporary volumes, and persistent autocreated named ones +@test "podman volume, implicit creation with run" { + + # No hostdir arg: create anonymous container with random name + rand=$(random_string) + run_podman run -v /myvol $IMAGE sh -c "echo $rand >/myvol/myfile" + + run_podman volume ls -q + tempvolume="$output" + + # We should see the file created in the container + run_podman volume inspect --format '{{.Mountpoint}}' $tempvolume + mountpoint="$output" + test -e "$mountpoint/myfile" + is "$(< $mountpoint/myfile)" "$rand" "file contents, anonymous volume" + + # Remove the container, using rm --volumes. Volume should now be gone. + run_podman rm -a --volumes + run_podman volume ls -q + is "$output" "" "anonymous volume is removed after container is rm'ed" + + # Create a *named* container. This one should persist after container ends + myvol=myvol$(random_string) + rand=$(random_string) + + run_podman run --rm -v $myvol:/myvol:z $IMAGE \ + sh -c "echo $rand >/myvol/myfile" + run_podman volume ls -q + is "$output" "$myvol" "autocreated named container persists" + + # ...and should be usable, read/write, by a second container + run_podman run --rm -v $myvol:/myvol:z $IMAGE \ + sh -c "cp /myvol/myfile /myvol/myfile2" + + run_podman volume rm $myvol + + # Autocreated volumes should also work with keep-id + # All we do here is check status; podman 1.9.1 would fail with EPERM + myvol=myvol$(random_string) + run_podman run --rm -v $myvol:/myvol:z --userns=keep-id $IMAGE \ + touch /myvol/myfile + + run_podman volume rm $myvol +} + + +# Confirm that container sees the correct id +@test "podman volume with --userns=keep-id" { + is_rootless || skip "only meaningful when run rootless" + + myvoldir=${PODMAN_TMPDIR}/volume_$(random_string) + mkdir $myvoldir + touch $myvoldir/myfile + + # With keep-id + run_podman run --rm -v $myvoldir:/vol:z --userns=keep-id $IMAGE \ + stat -c "%u:%s" /vol/myfile + is "$output" "$(id -u):0" "with keep-id: stat(file in container) == my uid" + + # Without + run_podman run --rm -v $myvoldir:/vol:z $IMAGE \ + stat -c "%u:%s" /vol/myfile + is "$output" "0:0" "w/o keep-id: stat(file in container) == root" +} + + +# 'volume prune' identifies and cleans up unused volumes +@test "podman volume prune" { + # Create four named volumes + local -a v=() + for i in 1 2 3 4;do + vol=myvol${i}$(random_string) + v[$i]=$vol + run_podman volume create $vol + done + + # Run two containers: one mounting v1, one mounting v2 & v3 + run_podman run --name c1 --volume ${v[1]}:/vol1 $IMAGE date + run_podman run --name c2 --volume ${v[2]}:/vol2 -v ${v[3]}:/vol3 \ + $IMAGE date + + # prune should remove v4 + run_podman volume prune --force + is "$output" "${v[4]}" "volume prune, with 1, 2, 3 in use, deletes only 4" + + # Remove the container using v2 and v3. Prune should now remove those. + # The 'echo sort' is to get the output sorted and in one line. + run_podman rm c2 + run_podman volume prune --force + is "$(echo $(sort <<<$output))" "${v[2]} ${v[3]}" \ + "volume prune, after rm c2, deletes volumes 2 and 3" + + # Remove the final container. Prune should now remove v1. + run_podman rm c1 + run_podman volume prune --force + is "$output" "${v[1]}" "volume prune, after rm c2 & c1, deletes volume 1" + + # Further prunes are NOPs + run_podman volume prune --force + is "$output" "" "no more volumes to prune" +} + + +# vim: filetype=sh diff --git a/test/system/200-pod-top.bats b/test/system/200-pod-top.bats deleted file mode 100644 index bba1e8d14..000000000 --- a/test/system/200-pod-top.bats +++ /dev/null @@ -1,40 +0,0 @@ -#!/usr/bin/env bats - -load helpers - -@test "podman pod top - containers in different PID namespaces" { - skip_if_remote "podman-pod does not work with podman-remote" - - # With infra=false, we don't get a /pause container (we also - # don't pull k8s.gcr.io/pause ) - no_infra='--infra=false' - run_podman pod create $no_infra - podid="$output" - - # Start two containers... - run_podman run -d --pod $podid $IMAGE top -d 2 - cid1="$output" - run_podman run -d --pod $podid $IMAGE top -d 2 - cid2="$output" - - # ...and wait for them to actually start. - wait_for_output "PID \+PPID \+USER " $cid1 - wait_for_output "PID \+PPID \+USER " $cid2 - - # Both containers have emitted at least one top-like line. - # Now run 'pod top', and expect two 'top -d 2' processes running. - run_podman pod top $podid - is "$output" ".*root.*top -d 2.*root.*top -d 2" "two 'top' containers" - - # By default (podman pod create w/ default --infra) there should be - # a /pause container. - if [ -z "$no_infra" ]; then - is "$output" ".*0 \+1 \+0 \+[0-9. ?s]\+/pause" "there is a /pause container" - fi - - # Clean up - run_podman pod rm -f $podid -} - - -# vim: filetype=sh diff --git a/test/system/200-pod.bats b/test/system/200-pod.bats new file mode 100644 index 000000000..f3d278826 --- /dev/null +++ b/test/system/200-pod.bats @@ -0,0 +1,174 @@ +#!/usr/bin/env bats + +load helpers + +# This is a long ugly way to clean up pods and remove the pause image +function teardown() { + run_podman pod rm -f -a + run_podman rm -f -a + run_podman image list --format '{{.ID}} {{.Repository}}' + while read id name; do + if [[ "$name" =~ /pause ]]; then + run_podman rmi $id + fi + done <<<"$output" + + basic_teardown +} + + +@test "podman pod top - containers in different PID namespaces" { + skip_if_remote "podman-pod does not work with podman-remote" + + # With infra=false, we don't get a /pause container (we also + # don't pull k8s.gcr.io/pause ) + no_infra='--infra=false' + run_podman pod create $no_infra + podid="$output" + + # Start two containers... + run_podman run -d --pod $podid $IMAGE top -d 2 + cid1="$output" + run_podman run -d --pod $podid $IMAGE top -d 2 + cid2="$output" + + # ...and wait for them to actually start. + wait_for_output "PID \+PPID \+USER " $cid1 + wait_for_output "PID \+PPID \+USER " $cid2 + + # Both containers have emitted at least one top-like line. + # Now run 'pod top', and expect two 'top -d 2' processes running. + run_podman pod top $podid + is "$output" ".*root.*top -d 2.*root.*top -d 2" "two 'top' containers" + + # By default (podman pod create w/ default --infra) there should be + # a /pause container. + if [ -z "$no_infra" ]; then + is "$output" ".*0 \+1 \+0 \+[0-9. ?s]\+/pause" "there is a /pause container" + fi + + # Clean up + run_podman pod rm -f $podid +} + + +@test "podman pod - communicating between pods" { + skip_if_remote "podman-pod does not work with podman-remote" + + podname=pod$(random_string) + run_podman pod create --infra=true --name=$podname + + # Randomly-assigned port in the 5xxx range + for port in $(shuf -i 5000-5999);do + if ! { exec 3<> /dev/tcp/127.0.0.1/$port; } &>/dev/null; then + break + fi + done + + # Listener. This will exit as soon as it receives a message. + run_podman run -d --pod $podname $IMAGE nc -l -p $port + cid1="$output" + + # Talker: send the message via common port on localhost + message=$(random_string 15) + run_podman run --rm --pod $podname $IMAGE \ + sh -c "echo $message | nc 127.0.0.1 $port" + + # Back to the first (listener) container. Make sure message was received. + run_podman logs $cid1 + is "$output" "$message" "message sent from one container to another" + + # Clean up. First the nc -l container... + run_podman rm $cid1 + + # ...then, from pause container, find the image ID of the pause image... + # FIXME: if #6283 gets implemented, use 'inspect --format ...' + run_podman pod inspect $podname + pause_cid=$(jq -r '.Containers[0].Id' <<<"$output") + run_podman container inspect --format '{{.Image}}' $pause_cid + pause_iid="$output" + + # ...then rm the pod, then rmi the pause image so we don't leave strays. + run_podman pod rm $podname + run_podman rmi $pause_iid +} + +# Random byte +function octet() { + echo $(( $RANDOM & 255 )) +} + +# random MAC address: convention seems to be that 2nd lsb=1, lsb=0 +# (i.e. 0bxxxxxx10) in the first octet guarantees a private space. +# FIXME: I can't find a definitive reference for this though +# Generate the address IN CAPS (A-F), but we will test it in lowercase. +function random_mac() { + local mac=$(printf "%02X" $(( $(octet) & 242 | 2 )) ) + for i in $(seq 2 6); do + mac+=$(printf ":%02X" $(octet)) + done + + echo $mac +} + +# Random RFC1918 IP address +function random_ip() { + local ip="172.20" + for i in 1 2;do + ip+=$(printf ".%d" $(octet)) + done + echo $ip +} + +@test "podman pod create - hashtag AllTheOptions" { + mac=$(random_mac) + add_host_ip=$(random_ip) + add_host_n=$(random_string | tr A-Z a-z).$(random_string | tr A-Z a-z).xyz + + dns_server=$(random_ip) + dns_opt="ndots:$(octet)" + dns_search=$(random_string 15 | tr A-Z a-z).abc + + hostname=$(random_string | tr A-Z a-z).$(random_string | tr A-Z a-z).net + + pod_id_file=${PODMAN_TMPDIR}/pod-id-file + + # Create a pod with all the desired options + # FIXME: --ip=$ip fails: + # Error adding network: failed to allocate all requested IPs + run_podman pod create --name=mypod \ + --pod-id-file=$pod_id_file \ + --mac-address=$mac \ + --hostname=$hostname \ + --add-host "$add_host_n:$add_host_ip" \ + --dns "$dns_server" \ + --dns-search "$dns_search" \ + --dns-opt "$dns_opt" + pod_id="$output" + + # Check --pod-id-file + # FIXME: broken in master; reenable once #6292 is fixed + #is "$(<$pod_id_file)" "$pod_id" "contents of pod-id-file" + + # Check each of the options + if ! is_rootless; then + run_podman run --rm --pod mypod $IMAGE ip link show + # 'ip' outputs hex in lower-case, ${expr,,} converts UC to lc + is "$output" ".* link/ether ${mac,,} " "requested MAC address was set" + fi + + run_podman run --rm --pod mypod $IMAGE hostname + is "$output" "$hostname" "--hostname set the hostname" + + run_podman run --rm --pod $pod_id $IMAGE cat /etc/hosts + is "$output" ".*$add_host_ip $add_host_n" "--add-host was added" + is "$output" ".* $hostname" "--hostname is in /etc/hosts" + # ^^^^ this must be a tab, not a space + + run_podman run --rm --pod mypod $IMAGE cat /etc/resolv.conf + is "$output" ".*nameserver $dns_server" "--dns [server] was added" + is "$output" ".*search $dns_search" "--dns-search was added" + is "$output" ".*options $dns_opt" "--dns-opt was added" +} + +# vim: filetype=sh diff --git a/test/system/250-systemd.bats b/test/system/250-systemd.bats index cdac43c1c..4bee13414 100644 --- a/test/system/250-systemd.bats +++ b/test/system/250-systemd.bats @@ -33,6 +33,13 @@ function teardown() { # This test can fail in dev. environment because of SELinux. # quick fix: chcon -t container_runtime_exec_t ./bin/podman @test "podman generate - systemd - basic" { + # podman initializes this if unset, but systemctl doesn't + if is_rootless; then + if [ -z "$XDG_RUNTIME_DIR" ]; then + export XDG_RUNTIME_DIR=/run/user/$(id -u) + fi + fi + cname=$(random_string) run_podman create --name $cname --detach $IMAGE top |