summaryrefslogtreecommitdiff
path: root/test/system
diff options
context:
space:
mode:
Diffstat (limited to 'test/system')
-rw-r--r--test/system/030-run.bats11
-rw-r--r--test/system/120-load.bats2
-rw-r--r--test/system/160-volumes.bats39
-rw-r--r--test/system/170-run-userns.bats39
-rw-r--r--test/system/500-networking.bats4
-rw-r--r--test/system/520-checkpoint.bats30
-rw-r--r--test/system/600-completion.bats102
7 files changed, 198 insertions, 29 deletions
diff --git a/test/system/030-run.bats b/test/system/030-run.bats
index 283c3aea9..241831257 100644
--- a/test/system/030-run.bats
+++ b/test/system/030-run.bats
@@ -855,4 +855,15 @@ EOF
run_podman rmi $test_image
}
+@test "podman create --security-opt" {
+ run_podman create --security-opt no-new-privileges=true $IMAGE
+ run_podman rm $output
+ run_podman create --security-opt no-new-privileges:true $IMAGE
+ run_podman rm $output
+ run_podman create --security-opt no-new-privileges=false $IMAGE
+ run_podman rm $output
+ run_podman create --security-opt no-new-privileges $IMAGE
+ run_podman rm $output
+}
+
# vim: filetype=sh
diff --git a/test/system/120-load.bats b/test/system/120-load.bats
index 45e0b3362..5a7f63b43 100644
--- a/test/system/120-load.bats
+++ b/test/system/120-load.bats
@@ -121,7 +121,7 @@ verify_iid_and_name() {
run_podman untag $IMAGE $newname
run_podman image scp -q ${notme}@localhost::$newname
- expect="Loaded image(s): $newname"
+ expect="Loaded image: $newname"
is "$output" "$expect" "-q silences output"
# Confirm that we have it, and that its digest matches our original
diff --git a/test/system/160-volumes.bats b/test/system/160-volumes.bats
index 5b0460723..797883ec6 100644
--- a/test/system/160-volumes.bats
+++ b/test/system/160-volumes.bats
@@ -411,4 +411,43 @@ NeedsChown | true
fi
}
+@test "podman --image-volume" {
+ tmpdir=$PODMAN_TMPDIR/volume-test
+ mkdir -p $tmpdir
+ containerfile=$tmpdir/Containerfile
+ cat >$containerfile <<EOF
+FROM $IMAGE
+VOLUME /data
+EOF
+ fs=$(stat -f -c %T .)
+ run_podman build -t volume_image $tmpdir
+
+ containersconf=$tmpdir/containers.conf
+ cat >$containersconf <<EOF
+[engine]
+image_volume_mode="tmpfs"
+EOF
+
+ run_podman run --image-volume tmpfs --rm volume_image stat -f -c %T /data
+ is "$output" "tmpfs" "Should be tmpfs"
+
+ run_podman 1 run --image-volume ignore --rm volume_image stat -f -c %T /data
+ is "$output" "stat: can't read file system information for '/data': No such file or directory" "Should fail with /data does not exists"
+
+ CONTAINERS_CONF="$containersconf" run_podman run --rm volume_image stat -f -c %T /data
+ is "$output" "tmpfs" "Should be tmpfs"
+
+ CONTAINERS_CONF="$containersconf" run_podman run --image-volume bind --rm volume_image stat -f -c %T /data
+ assert "$output" != "tmpfs" "Should match hosts $fs"
+
+ CONTAINERS_CONF="$containersconf" run_podman run --image-volume tmpfs --rm volume_image stat -f -c %T /data
+ is "$output" "tmpfs" "Should be tmpfs"
+
+ CONTAINERS_CONF="$containersconf" run_podman 1 run --image-volume ignore --rm volume_image stat -f -c %T /data
+ is "$output" "stat: can't read file system information for '/data': No such file or directory" "Should fail with /data does not exists"
+
+ run_podman rm --all --force -t 0
+ run_podman image rm --force localhost/volume_image
+}
+
# vim: filetype=sh
diff --git a/test/system/170-run-userns.bats b/test/system/170-run-userns.bats
index b80351902..84788a7f4 100644
--- a/test/system/170-run-userns.bats
+++ b/test/system/170-run-userns.bats
@@ -38,10 +38,12 @@ function _require_crun() {
@test "rootful pod with custom ID mapping" {
skip_if_rootless "does not work rootless - rootful feature"
- skip_if_remote "remote --uidmap is broken (see #14233)"
random_pod_name=$(random_string 30)
run_podman pod create --uidmap 0:200000:5000 --name=$random_pod_name
run_podman pod start $random_pod_name
+ run_podman pod inspect --format '{{.InfraContainerID}}' $random_pod_name
+ run podman inspect --format '{{.HostConfig.IDMappings.UIDMap}}' $output
+ is "$output" ".*0:200000:5000" "UID Map Successful"
# Remove the pod and the pause image
run_podman pod rm $random_pod_name
@@ -109,15 +111,30 @@ EOF
}
@test "podman userns=nomap" {
- skip_if_not_rootless "--userns=nomap only works in rootless mode"
- ns_user=$(id -un)
- baseuid=$(egrep "${ns_user}:" /etc/subuid | cut -f2 -d:)
- test ! -z ${baseuid} || skip "no IDs allocated for user ${ns_user}"
+ if is_rootless; then
+ ns_user=$(id -un)
+ baseuid=$(egrep "${ns_user}:" /etc/subuid | cut -f2 -d:)
+ test ! -z ${baseuid} || skip "no IDs allocated for user ${ns_user}"
+
+ test_name="test_$(random_string 12)"
+ run_podman run -d --userns=nomap $IMAGE sleep 100
+ cid=${output}
+ run_podman top ${cid} huser
+ is "${output}" "HUSER.*${baseuid}" "Container should start with baseuid from /etc/subuid not user UID"
+ run_podman rm -t 0 --force ${cid}
+ else
+ run_podman 125 run -d --userns=nomap $IMAGE sleep 100
+ is "${output}" "Error: nomap is only supported in rootless mode" "Container should fail to start since nomap is not suppored in rootful mode"
+ fi
+}
- test_name="test_$(random_string 12)"
- run_podman run -d --userns=nomap $IMAGE sleep 100
- cid=${output}
- run_podman top ${cid} huser
- is "${output}" "HUSER.*${baseuid}" "Container should start with baseuid from /etc/subuid not user UID"
- run_podman rm -t 0 --force ${cid}
+@test "podman userns=keep-id" {
+ if is_rootless; then
+ user=$(id -u)
+ run_podman run --rm --userns=keep-id $IMAGE id -u
+ is "${output}" "$user" "Container should run as the current user"
+ else
+ run_podman 125 run --rm --userns=keep-id $IMAGE id -u
+ is "${output}" "Error: keep-id is only supported in rootless mode" "Container should fail to start since keep-id is not suppored in rootful mode"
+ fi
}
diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats
index 3db0804d1..92aabae32 100644
--- a/test/system/500-networking.bats
+++ b/test/system/500-networking.bats
@@ -111,6 +111,10 @@ load helpers
$IMAGE nc -l -n -v -p $myport
cid="$output"
+ # check that podman stores the network info correctly when a userns is used (#14465)
+ run_podman container inspect --format "{{.NetworkSettings.SandboxKey}}" $cid
+ assert "$output" =~ ".*/netns/netns-.*" "Netns path should be set"
+
wait_for_output "listening on .*:$myport .*" $cid
# emit random string, and check it
diff --git a/test/system/520-checkpoint.bats b/test/system/520-checkpoint.bats
index c16a8c35d..7f60f01b3 100644
--- a/test/system/520-checkpoint.bats
+++ b/test/system/520-checkpoint.bats
@@ -170,4 +170,34 @@ function teardown() {
# FIXME: test --leave-running
+@test "podman checkpoint --file-locks" {
+ action='flock test.lock sh -c "while [ -e /wait ];do sleep 0.5;done;for i in 1 2 3;do echo \$i;sleep 0.5;done"'
+ run_podman run -d $IMAGE sh -c "touch /wait; touch test.lock; echo READY; $action & $action & wait"
+ local cid="$output"
+
+ # Wait for container to start emitting output
+ wait_for_ready $cid
+
+ # Checkpoint, and confirm via inspect
+ run_podman container checkpoint --file-locks $cid
+ is "$output" "$cid" "podman container checkpoint"
+
+ run_podman container inspect \
+ --format '{{.State.Status}}:{{.State.Running}}:{{.State.Paused}}:{{.State.Checkpointed}}' $cid
+ is "$output" "exited:false:false:true" "State. Status:Running:Pause:Checkpointed"
+
+ # Restart immediately and confirm state
+ run_podman container restore --file-locks $cid
+ is "$output" "$cid" "podman container restore"
+
+ # Signal the container to continue; this is where the 1-2-3s will come from
+ run_podman exec $cid rm /wait
+
+ # Wait for the container to stop
+ run_podman wait $cid
+
+ run_podman logs $cid
+ trim=$(sed -z -e 's/[\r\n]\+//g' <<<"$output")
+ is "$trim" "READY123123" "File lock restored"
+}
# vim: filetype=sh
diff --git a/test/system/600-completion.bats b/test/system/600-completion.bats
index 018e95e78..cb4a2c5f8 100644
--- a/test/system/600-completion.bats
+++ b/test/system/600-completion.bats
@@ -8,6 +8,16 @@
load helpers
+function setup() {
+ # $PODMAN may be a space-separated string, e.g. if we include a --url.
+ local -a podman_as_array=($PODMAN)
+ # __completeNoDesc must be the first arg if we running the completion cmd
+ # set the var for the run_completion function
+ PODMAN_COMPLETION="${podman_as_array[0]} __completeNoDesc ${podman_as_array[@]:1}"
+
+ basic_setup
+}
+
# Returns true if we are able to podman-pause
function _can_pause() {
# Even though we're just trying completion, not an actual unpause,
@@ -88,8 +98,14 @@ function check_shell_completion() {
continue 2
fi
+ name=$random_container_name
+ # special case podman cp suggest containers names with a colon
+ if [[ $cmd = "cp" ]]; then
+ name="$name:"
+ fi
+
run_completion "$@" $cmd "${extra_args[@]}" ""
- is "$output" ".*-$random_container_name${nl}" \
+ is "$output" ".*-$name${nl}" \
"$* $cmd: actual container listed in suggestions"
match=true
@@ -175,7 +191,7 @@ function check_shell_completion() {
_check_completion_end NoSpace
else
_check_completion_end Default
- assert "${#lines[@]}" -eq 2 "$* $cmd: Suggestions are in the output"
+ _check_no_suggestions
fi
;;
@@ -205,16 +221,7 @@ function check_shell_completion() {
if [[ ! ${args##* } =~ "..." ]]; then
run_completion "$@" $cmd "${extra_args[@]}" ""
_check_completion_end NoFileComp
- if [ ${#lines[@]} -gt 2 ]; then
- # checking for line count is not enough since we may include additional debug output
- # lines starting with [Debug] are allowed
- i=0
- length=$(( ${#lines[@]} - 2 ))
- while [[ i -lt length ]]; do
- assert "${lines[$i]:0:7}" == "[Debug]" "Suggestions are in the output"
- i=$(( i + 1 ))
- done
- fi
+ _check_no_suggestions
fi
done
@@ -231,6 +238,24 @@ function _check_completion_end() {
is "${lines[-1]}" "Completion ended with directive: ShellCompDirective$1" "Completion has wrong ShellCompDirective set"
}
+# Check that there are no suggestions in the output.
+# We could only check stdout and not stderr but this is not possible with bats.
+# By default we always have two extra lines at the end for the ShellCompDirective.
+# Then we could also have other extra lines for debugging, they will always start
+# with [Debug], e.g. `[Debug] [Error] no container with name or ID "t12" found: no such container`.
+function _check_no_suggestions() {
+ if [ ${#lines[@]} -gt 2 ]; then
+ # Checking for line count is not enough since we may include additional debug output.
+ # Lines starting with [Debug] are allowed.
+ local i=0
+ length=$((${#lines[@]} - 2))
+ while [[ i -lt length ]]; do
+ assert "${lines[$i]:0:7}" == "[Debug]" "Unexpected non-Debug output line: ${lines[$i]}"
+ i=$((i + 1))
+ done
+ fi
+}
+
@test "podman shell completion test" {
@@ -280,11 +305,6 @@ function _check_completion_end() {
# create secret
run_podman secret create $random_secret_name $secret_file
- # $PODMAN may be a space-separated string, e.g. if we include a --url.
- local -a podman_as_array=($PODMAN)
- # __completeNoDesc must be the first arg if we running the completion cmd
- PODMAN_COMPLETION="${podman_as_array[0]} __completeNoDesc ${podman_as_array[@]:1}"
-
# Called with no args -- start with 'podman --help'. check_shell_completion() will
# recurse for any subcommands.
check_shell_completion
@@ -316,3 +336,51 @@ function _check_completion_end() {
done <<<"$output"
}
+
+@test "podman shell completion for paths in container/image" {
+ skip_if_remote "mounting via remote does not work"
+ for cmd in create run; do
+ run_completion $cmd $IMAGE ""
+ assert "$output" =~ ".*^/etc/\$.*" "etc directory suggested (cmd: podman $cmd)"
+ assert "$output" =~ ".*^/home/\$.*" "home directory suggested (cmd: podman $cmd)"
+ assert "$output" =~ ".*^/root/\$.*" "root directory suggested (cmd: podman $cmd)"
+
+ # check completion for subdirectory
+ run_completion $cmd $IMAGE "/etc"
+ # It should be safe to assume the os-release file always exists in $IMAGE
+ assert "$output" =~ ".*^/etc/os-release\$.*" "/etc files suggested (cmd: podman $cmd /etc)"
+ # check completion for partial file name
+ run_completion $cmd $IMAGE "/etc/os-"
+ assert "$output" =~ ".*^/etc/os-release\$.*" "/etc files suggested (cmd: podman $cmd /etc/os-)"
+
+ # check completion with relative path components
+ # It is important the we will still use the image root and not escape to the host
+ run_completion $cmd $IMAGE "../../"
+ assert "$output" =~ ".*^../../etc/\$.*" "relative etc directory suggested (cmd: podman $cmd ../../)"
+ assert "$output" =~ ".*^../../home/\$.*" "relative home directory suggested (cmd: podman $cmd ../../)"
+ done
+
+ random_name=$(random_string 30)
+ random_file=$(random_string 30)
+ run_podman run --name $random_name $IMAGE sh -c "touch /tmp/$random_file && touch /tmp/${random_file}2 && mkdir /emptydir"
+
+ # check completion for podman cp
+ run_completion cp ""
+ assert "$output" =~ ".*^$random_name\:\$.*" "podman cp suggest container names"
+
+ run_completion cp "$random_name:"
+ assert "$output" =~ ".*^$random_name\:/etc/\$.*" "podman cp suggest paths in container"
+
+ run_completion cp "$random_name:/tmp"
+ assert "$output" =~ ".*^$random_name\:/tmp/$random_file\$.*" "podman cp suggest custom file in container"
+
+ run_completion cp "$random_name:/tmp/$random_file"
+ assert "$output" =~ ".*^$random_name\:/tmp/$random_file\$.*" "podman cp suggest /tmp/$random_file file in container"
+ assert "$output" =~ ".*^$random_name\:/tmp/${random_file}2\$.*" "podman cp suggest /tmp/${random_file}2 file in container"
+
+ run_completion cp "$random_name:/emptydir"
+ assert "$output" =~ ".*^$random_name\:/emptydir/\$.*ShellCompDirectiveNoSpace" "podman cp suggest empty dir with no space directive (:2)"
+
+ # cleanup container
+ run_podman rm $random_name
+}
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-01-28 15:00:55 +0000