From 54b588c07d05858c9bbc523eeff0badb85d53f76 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Thu, 18 Feb 2021 13:51:27 +0100
Subject: rootless cni without infra container

Instead of creating an extra container create a network and mount
namespace inside the podman user namespace. This ns is used to
for rootless cni operations.
This helps to align the rootless and rootful network code path.
If we run as rootless we just have to set up a extra net ns and
initialize slirp4netns in it. The ocicni lib will be called in
that net ns.

This design allows allows easier maintenance, no extra container
with pause processes, support for rootless cni with --uidmap
and possibly more.

The biggest problem is backwards compatibility. I don't think
live migration can be possible. If the user reboots or restart
all cni containers everything should work as expected again.
The user is left with the rootless-cni-infa container and image
but this can safely be removed.

To make the existing cni configs work we need execute the cni plugins
in a extra mount namespace. This ensures that we can safely mount over
/run and /var which have to be writeable for the cni plugins without
removing access to these files by the main podman process. One caveat
is that we need to keep the netns files at `XDG_RUNTIME_DIR/netns`
accessible.

`XDG_RUNTIME_DIR/rootless-cni/{run,var}` will be mounted to `/{run,var}`.
To ensure that we keep the netns directory we bind mount this relative
to the new root location, e.g. XDG_RUNTIME_DIR/rootless-cni/run/user/1000/netns
before we mount the run directory. The run directory is mounted recursive,
this makes the netns directory at the same path accessible as before.

This also allows iptables-legacy to work because /run/xtables.lock is
now writeable.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 test/system/500-networking.bats | 7 -------
 1 file changed, 7 deletions(-)

(limited to 'test')

diff --git a/test/system/500-networking.bats b/test/system/500-networking.bats
index 4868ad6a0..804dd46b1 100644
--- a/test/system/500-networking.bats
+++ b/test/system/500-networking.bats
@@ -143,13 +143,6 @@ load helpers
 
     run_podman network rm $mynetname
     run_podman 1 network rm $mynetname
-
-    # rootless CNI leaves behind an image pulled by SHA, hence with no tag.
-    # Remove it if present; we can only remove it by ID.
-    run_podman images --format '{{.Id}}' rootless-cni-infra
-    if [ -n "$output" ]; then
-        run_podman rmi $output
-    fi
 }
 
 @test "podman network reload" {
-- 
cgit v1.2.3-54-g00ecf


From 00b2ec5e6f8ad332411271df1bdd968493cab2c2 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Thu, 18 Feb 2021 14:53:53 +0100
Subject: Add rootless support for cni and --uidmap

This is supported with the new rootless cni logic.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 libpod/container_internal.go       |  4 +---
 libpod/networking_linux.go         |  7 +++++--
 pkg/specgen/generate/namespaces.go |  3 ---
 test/e2e/run_networking_test.go    | 20 ++++++++++++--------
 4 files changed, 18 insertions(+), 16 deletions(-)

(limited to 'test')

diff --git a/libpod/container_internal.go b/libpod/container_internal.go
index 106e2569b..a53027ab2 100644
--- a/libpod/container_internal.go
+++ b/libpod/container_internal.go
@@ -966,9 +966,7 @@ func (c *Container) completeNetworkSetup() error {
 	if err := c.syncContainer(); err != nil {
 		return err
 	}
-	if rootless.IsRootless() {
-		return c.runtime.setupRootlessNetNS(c)
-	} else if c.config.NetMode.IsSlirp4netns() {
+	if c.config.NetMode.IsSlirp4netns() {
 		return c.runtime.setupSlirp4netns(c)
 	}
 	if err := c.runtime.setupNetNS(c); err != nil {
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index aac02d8cc..1bfb82cdb 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -972,8 +972,11 @@ func (r *Runtime) setupNetNS(ctr *Container) error {
 	if _, err := rand.Reader.Read(b); err != nil {
 		return errors.Wrapf(err, "failed to generate random netns name")
 	}
-
-	nsPath := fmt.Sprintf("/run/netns/cni-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
+	nsPath, err := netns.GetNSRunDir()
+	if err != nil {
+		return err
+	}
+	nsPath = filepath.Join(nsPath, fmt.Sprintf("cni-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:]))
 
 	if err := os.MkdirAll(filepath.Dir(nsPath), 0711); err != nil {
 		return err
diff --git a/pkg/specgen/generate/namespaces.go b/pkg/specgen/generate/namespaces.go
index b87375a92..845dfdad7 100644
--- a/pkg/specgen/generate/namespaces.go
+++ b/pkg/specgen/generate/namespaces.go
@@ -236,9 +236,6 @@ func namespaceOptions(ctx context.Context, s *specgen.SpecGenerator, rt *libpod.
 	case specgen.Private:
 		fallthrough
 	case specgen.Bridge:
-		if postConfigureNetNS && rootless.IsRootless() {
-			return nil, errors.New("CNI networks not supported with user namespaces")
-		}
 		portMappings, err := createPortMappings(ctx, s, img)
 		if err != nil {
 			return nil, err
diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go
index 0e6e636bc..43eb8fe4e 100644
--- a/test/e2e/run_networking_test.go
+++ b/test/e2e/run_networking_test.go
@@ -641,22 +641,26 @@ var _ = Describe("Podman run networking", func() {
 		Expect(run.OutputToString()).To(ContainSubstring(ipAddr))
 	})
 
-	It("podman rootless fails custom CNI network with --uidmap", func() {
-		SkipIfNotRootless("The configuration works with rootless")
-
+	It("podman cni network works across user ns", func() {
 		netName := stringid.GenerateNonCryptoID()
 		create := podmanTest.Podman([]string{"network", "create", netName})
 		create.WaitWithDefaultTimeout()
 		Expect(create.ExitCode()).To(BeZero())
 		defer podmanTest.removeCNINetwork(netName)
 
-		run := podmanTest.Podman([]string{"run", "--rm", "--net", netName, "--uidmap", "0:1:4096", ALPINE, "true"})
+		name := "nc-server"
+		run := podmanTest.Podman([]string{"run", "-d", "--name", name, "--net", netName, ALPINE, "nc", "-l", "-p", "8080"})
+		run.WaitWithDefaultTimeout()
+		Expect(run.ExitCode()).To(Equal(0))
+
+		run = podmanTest.Podman([]string{"run", "--rm", "--net", netName, "--uidmap", "0:1:4096", ALPINE, "sh", "-c", fmt.Sprintf("echo podman | nc -w 1 %s.dns.podman 8080", name)})
 		run.WaitWithDefaultTimeout()
-		Expect(run.ExitCode()).To(Equal(125))
+		Expect(run.ExitCode()).To(Equal(0))
 
-		remove := podmanTest.Podman([]string{"network", "rm", netName})
-		remove.WaitWithDefaultTimeout()
-		Expect(remove.ExitCode()).To(BeZero())
+		log := podmanTest.Podman([]string{"logs", name})
+		log.WaitWithDefaultTimeout()
+		Expect(log.ExitCode()).To(Equal(0))
+		Expect(log.OutputToString()).To(Equal("podman"))
 	})
 
 	It("podman run with new:pod and static-ip", func() {
-- 
cgit v1.2.3-54-g00ecf


From 294c90b05e068badb759b7618b4d156a75f7fb69 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Sun, 21 Feb 2021 00:13:42 +0100
Subject: Enable rootless network connect/disconnect

With the new rootless cni supporting network connect/disconnect is easy.
Combine common setps into extra functions to prevent code duplication.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 libpod/networking_linux.go                  | 102 ++++++++++++++--------------
 test/e2e/network_connect_disconnect_test.go |  25 +++----
 2 files changed, 62 insertions(+), 65 deletions(-)

(limited to 'test')

diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index 287742706..a5056d834 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -310,13 +310,36 @@ func (r *Runtime) getRootlessCNINetNs(new bool) (*rootlessCNI, error) {
 	return rootlessCNINS, nil
 }
 
-// Create and configure a new network namespace for a container
-func (r *Runtime) configureNetNS(ctr *Container, ctrNS ns.NetNS) ([]*cnitypes.Result, error) {
+// setUpOCICNIPod will set up the cni networks, on error it will also tear down the cni
+// networks. If rootless it will join/create the rootless cni namespace.
+func (r *Runtime) setUpOCICNIPod(podNetwork ocicni.PodNetwork) ([]ocicni.NetResult, error) {
 	rootlessCNINS, err := r.getRootlessCNINetNs(true)
 	if err != nil {
 		return nil, err
 	}
+	var results []ocicni.NetResult
+	setUpPod := func() error {
+		results, err = r.netPlugin.SetUpPod(podNetwork)
+		if err != nil {
+			if err2 := r.netPlugin.TearDownPod(podNetwork); err2 != nil {
+				logrus.Errorf("Error tearing down partially created network namespace for container %s: %v", podNetwork.ID, err2)
+			}
+			return errors.Wrapf(err, "error configuring network namespace for container %s", podNetwork.ID)
+		}
+		return nil
+	}
+	// rootlessCNINS is nil if we are root
+	if rootlessCNINS != nil {
+		// execute the cni setup in the rootless net ns
+		err = rootlessCNINS.Do(setUpPod)
+	} else {
+		err = setUpPod()
+	}
+	return results, err
+}
 
+// Create and configure a new network namespace for a container
+func (r *Runtime) configureNetNS(ctr *Container, ctrNS ns.NetNS) ([]*cnitypes.Result, error) {
 	var requestedIP net.IP
 	if ctr.requestedIP != nil {
 		requestedIP = ctr.requestedIP
@@ -360,28 +383,7 @@ func (r *Runtime) configureNetNS(ctr *Container, ctrNS ns.NetNS) ([]*cnitypes.Re
 		podNetwork.Aliases = aliases
 	}
 
-	var results []ocicni.NetResult
-	setUpPod := func() error {
-		results, err = r.netPlugin.SetUpPod(podNetwork)
-		if err != nil {
-			return errors.Wrapf(err, "error configuring network namespace for container %s", ctr.ID())
-		}
-		defer func() {
-			if err != nil {
-				if err2 := r.netPlugin.TearDownPod(podNetwork); err2 != nil {
-					logrus.Errorf("Error tearing down partially created network namespace for container %s: %v", ctr.ID(), err2)
-				}
-			}
-		}()
-		return nil
-	}
-	// rootlessCNINS is nil if we are root
-	if rootlessCNINS != nil {
-		// execute the cni setup in the rootless net ns
-		err = rootlessCNINS.Do(setUpPod)
-	} else {
-		err = setUpPod()
-	}
+	results, err := r.setUpOCICNIPod(podNetwork)
 	if err != nil {
 		return nil, err
 	}
@@ -514,6 +516,28 @@ func (r *Runtime) closeNetNS(ctr *Container) error {
 	return nil
 }
 
+// Tear down a container's CNI network configuration and joins the
+// rootless net ns as rootless user
+func (r *Runtime) teardownOCICNIPod(podNetwork ocicni.PodNetwork) error {
+	rootlessCNINS, err := r.getRootlessCNINetNs(false)
+	if err != nil {
+		return err
+	}
+	tearDownPod := func() error {
+		err := r.netPlugin.TearDownPod(podNetwork)
+		return errors.Wrapf(err, "error tearing down CNI namespace configuration for container %s", podNetwork.ID)
+	}
+
+	// rootlessCNINS is nil if we are root
+	if rootlessCNINS != nil {
+		// execute the cni setup in the rootless net ns
+		err = rootlessCNINS.Do(tearDownPod)
+	} else {
+		err = tearDownPod()
+	}
+	return err
+}
+
 // Tear down a container's CNI network configuration, but do not tear down the
 // namespace itself.
 func (r *Runtime) teardownCNI(ctr *Container) error {
@@ -530,10 +554,6 @@ func (r *Runtime) teardownCNI(ctr *Container) error {
 	}
 
 	if !ctr.config.NetMode.IsSlirp4netns() && len(networks) > 0 {
-		rootlessCNINS, err := r.getRootlessCNINetNs(false)
-		if err != nil {
-			return err
-		}
 		var requestedIP net.IP
 		if ctr.requestedIP != nil {
 			requestedIP = ctr.requestedIP
@@ -553,21 +573,7 @@ func (r *Runtime) teardownCNI(ctr *Container) error {
 		}
 
 		podNetwork := r.getPodNetwork(ctr.ID(), ctr.Name(), ctr.state.NetNS.Path(), networks, ctr.config.PortMappings, requestedIP, requestedMAC, ctr.state.NetInterfaceDescriptions)
-
-		tearDownPod := func() error {
-			if err := r.netPlugin.TearDownPod(podNetwork); err != nil {
-				return errors.Wrapf(err, "error tearing down CNI namespace configuration for container %s", ctr.ID())
-			}
-			return nil
-		}
-
-		// rootlessCNINS is nil if we are root
-		if rootlessCNINS != nil {
-			// execute the cni setup in the rootless net ns
-			err = rootlessCNINS.Do(tearDownPod)
-		} else {
-			err = tearDownPod()
-		}
+		err = r.teardownOCICNIPod(podNetwork)
 		return err
 	}
 	return nil
@@ -920,7 +926,7 @@ func (c *Container) NetworkDisconnect(nameOrID, netName string, force bool) erro
 	}
 
 	podConfig := c.runtime.getPodNetwork(c.ID(), c.Name(), c.state.NetNS.Path(), []string{netName}, c.config.PortMappings, nil, nil, c.state.NetInterfaceDescriptions)
-	if err := c.runtime.netPlugin.TearDownPod(podConfig); err != nil {
+	if err := c.runtime.teardownOCICNIPod(podConfig); err != nil {
 		return err
 	}
 
@@ -984,7 +990,7 @@ func (c *Container) NetworkConnect(nameOrID, netName string, aliases []string) e
 	podConfig := c.runtime.getPodNetwork(c.ID(), c.Name(), c.state.NetNS.Path(), []string{netName}, c.config.PortMappings, nil, nil, c.state.NetInterfaceDescriptions)
 	podConfig.Aliases = make(map[string][]string, 1)
 	podConfig.Aliases[netName] = aliases
-	results, err := c.runtime.netPlugin.SetUpPod(podConfig)
+	results, err := c.runtime.setUpOCICNIPod(podConfig)
 	if err != nil {
 		return err
 	}
@@ -1031,9 +1037,6 @@ func (c *Container) NetworkConnect(nameOrID, netName string, aliases []string) e
 
 // DisconnectContainerFromNetwork removes a container from its CNI network
 func (r *Runtime) DisconnectContainerFromNetwork(nameOrID, netName string, force bool) error {
-	if rootless.IsRootless() {
-		return errors.New("network connect is not enabled for rootless containers")
-	}
 	ctr, err := r.LookupContainer(nameOrID)
 	if err != nil {
 		return err
@@ -1043,9 +1046,6 @@ func (r *Runtime) DisconnectContainerFromNetwork(nameOrID, netName string, force
 
 // ConnectContainerToNetwork connects a container to a CNI network
 func (r *Runtime) ConnectContainerToNetwork(nameOrID, netName string, aliases []string) error {
-	if rootless.IsRootless() {
-		return errors.New("network disconnect is not enabled for rootless containers")
-	}
 	ctr, err := r.LookupContainer(nameOrID)
 	if err != nil {
 		return err
diff --git a/test/e2e/network_connect_disconnect_test.go b/test/e2e/network_connect_disconnect_test.go
index e9a7b421f..6974c7614 100644
--- a/test/e2e/network_connect_disconnect_test.go
+++ b/test/e2e/network_connect_disconnect_test.go
@@ -33,14 +33,12 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("bad network name in disconnect should result in error", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		dis := podmanTest.Podman([]string{"network", "disconnect", "foobar", "test"})
 		dis.WaitWithDefaultTimeout()
 		Expect(dis.ExitCode()).ToNot(BeZero())
 	})
 
 	It("bad container name in network disconnect should result in error", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName})
 		session.WaitWithDefaultTimeout()
@@ -72,7 +70,6 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("podman network disconnect", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName})
 		session.WaitWithDefaultTimeout()
@@ -102,14 +99,12 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("bad network name in connect should result in error", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		dis := podmanTest.Podman([]string{"network", "connect", "foobar", "test"})
 		dis.WaitWithDefaultTimeout()
 		Expect(dis.ExitCode()).ToNot(BeZero())
 	})
 
 	It("bad container name in network connect should result in error", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName})
 		session.WaitWithDefaultTimeout()
@@ -141,7 +136,6 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("podman connect on a container that already is connected to the network should error", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName})
 		session.WaitWithDefaultTimeout()
@@ -159,7 +153,6 @@ var _ = Describe("Podman network connect and disconnect", func() {
 
 	It("podman network connect", func() {
 		SkipIfRemote("This requires a pending PR to be merged before it will work")
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName})
 		session.WaitWithDefaultTimeout()
@@ -203,18 +196,23 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("podman network connect when not running", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
-		netName := "aliasTest" + stringid.GenerateNonCryptoID()
-		session := podmanTest.Podman([]string{"network", "create", netName})
+		netName1 := "connect1" + stringid.GenerateNonCryptoID()
+		session := podmanTest.Podman([]string{"network", "create", netName1})
 		session.WaitWithDefaultTimeout()
 		Expect(session.ExitCode()).To(BeZero())
-		defer podmanTest.removeCNINetwork(netName)
+		defer podmanTest.removeCNINetwork(netName1)
 
-		ctr := podmanTest.Podman([]string{"create", "--name", "test", ALPINE, "top"})
+		netName2 := "connect2" + stringid.GenerateNonCryptoID()
+		session = podmanTest.Podman([]string{"network", "create", netName2})
+		session.WaitWithDefaultTimeout()
+		Expect(session.ExitCode()).To(BeZero())
+		defer podmanTest.removeCNINetwork(netName2)
+
+		ctr := podmanTest.Podman([]string{"create", "--name", "test", "--network", netName1, ALPINE, "top"})
 		ctr.WaitWithDefaultTimeout()
 		Expect(ctr.ExitCode()).To(BeZero())
 
-		dis := podmanTest.Podman([]string{"network", "connect", netName, "test"})
+		dis := podmanTest.Podman([]string{"network", "connect", netName2, "test"})
 		dis.WaitWithDefaultTimeout()
 		Expect(dis.ExitCode()).To(BeZero())
 
@@ -286,7 +284,6 @@ var _ = Describe("Podman network connect and disconnect", func() {
 	})
 
 	It("podman network disconnect when not running", func() {
-		SkipIfRootless("network connect and disconnect are only rootful")
 		netName1 := "aliasTest" + stringid.GenerateNonCryptoID()
 		session := podmanTest.Podman([]string{"network", "create", netName1})
 		session.WaitWithDefaultTimeout()
-- 
cgit v1.2.3-54-g00ecf


From 8627de28bc685b6150db170ef373a9296ed09b03 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Tue, 23 Feb 2021 13:56:29 +0100
Subject: Fix dnsname test

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 test/e2e/run_networking_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'test')

diff --git a/test/e2e/run_networking_test.go b/test/e2e/run_networking_test.go
index 43eb8fe4e..4c66e2823 100644
--- a/test/e2e/run_networking_test.go
+++ b/test/e2e/run_networking_test.go
@@ -766,7 +766,7 @@ var _ = Describe("Podman run networking", func() {
 		Expect(session.ExitCode()).To(Equal(1))
 		Expect(session.ErrorToString()).To(ContainSubstring("can't resolve 'con1'"))
 
-		session = podmanTest.Podman([]string{"run", "--name", "con4", "--network", net, ALPINE, "nslookup", pod2})
+		session = podmanTest.Podman([]string{"run", "--name", "con4", "--network", net, ALPINE, "nslookup", pod2 + ".dns.podman"})
 		session.WaitWithDefaultTimeout()
 		Expect(session.ExitCode()).To(BeZero())
 	})
-- 
cgit v1.2.3-54-g00ecf


From 954d92082534ac775761558b455408aca2246e36 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Sun, 21 Mar 2021 17:32:40 +0100
Subject: Make the docker-compose test work rootless

Make sure the DOCKER_SOCK location is accessible by the user when run
rootless. Alos set the DOCKER_HOST env var to ensure docker-compose will
use the non default location. Cleanup steps such as `rm` or `umount`
must be run inside podman unshare otherwise they can fail due missing
privileges.

Change the curl test to use --retry-all-errors otherwise the tests will
flake. The web server inside the container will return http code 500
sometimes, most likely because it is not fully ready to accept
connections. With --retry-all-errors curl will retry instead of failing
and thus the test will work.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 test/compose/test-compose | 45 +++++++++++++++++++++++++++++++++++++--------
 1 file changed, 37 insertions(+), 8 deletions(-)

(limited to 'test')

diff --git a/test/compose/test-compose b/test/compose/test-compose
index 9558fbf58..3cda8514e 100755
--- a/test/compose/test-compose
+++ b/test/compose/test-compose
@@ -13,7 +13,8 @@ TEST_ROOTDIR=$(realpath $(dirname $0))
 # Podman executable
 PODMAN_BIN=$(realpath $TEST_ROOTDIR/../../bin)/podman
 
-# Local path to docker socket (we will add the unix:/ prefix when we need it)
+# Local path to docker socket with unix prefix
+# The path will be changed for rootless users
 DOCKER_SOCK=/var/run/docker.sock
 
 # END   stuff you can but probably shouldn't customize
@@ -40,6 +41,13 @@ echo 0 >$failures_file
 ###############################################################################
 # BEGIN infrastructure code - the helper functions used in tests themselves
 
+#################
+#  is_rootless  #  Check if we run as normal user
+#################
+function is_rootless() {
+    [ "$(id -u)" -ne 0 ]
+}
+
 #########
 #  die  #  Exit error with a message to stderr
 #########
@@ -155,7 +163,7 @@ function test_port() {
     local op="$2"                # '=' or '~'
     local expect="$3"            # what to expect from curl output
 
-    local actual=$(curl --retry 5 --retry-connrefused -s http://127.0.0.1:$port/)
+    local actual=$(curl --retry 10 --retry-all-errors -s http://127.0.0.1:$port/)
     local curl_rc=$?
     if [ $curl_rc -ne 0 ]; then
         _show_ok 0 "$testname - curl failed with status $curl_rc"
@@ -179,7 +187,12 @@ function start_service() {
     test -x $PODMAN_BIN || die "Not found: $PODMAN_BIN"
 
     # FIXME: use ${testname} subdir but we can't: 50-char limit in runroot
-    rm -rf            $WORKDIR/{root,runroot,cni}
+    if ! is_rootless; then
+        rm -rf $WORKDIR/{root,runroot,cni}
+    else
+        $PODMAN_BIN unshare rm -rf $WORKDIR/{root,runroot,cni}
+    fi
+    rm -f $DOCKER_SOCK
     mkdir --mode 0755 $WORKDIR/{root,runroot,cni}
     chcon --reference=/var/lib/containers $WORKDIR/root
     cp /etc/cni/net.d/*podman*conflist $WORKDIR/cni/
@@ -190,7 +203,7 @@ function start_service() {
         --cgroup-manager=systemd \
         --cni-config-dir $WORKDIR/cni \
         system service \
-        --time 0 unix:/$DOCKER_SOCK \
+        --time 0 unix://$DOCKER_SOCK \
         &> $WORKDIR/server.log &
     service_pid=$!
 
@@ -239,6 +252,14 @@ done
 ###############################################################################
 # BEGIN entry handler (subtest invoker)
 
+# When rootless use a socket path accessible by the rootless user
+if is_rootless; then
+    DOCKER_SOCK="$WORKDIR/docker.sock"
+    DOCKER_HOST="unix://$DOCKER_SOCK"
+    # export DOCKER_HOST docker-compose will use it
+    export DOCKER_HOST
+fi
+
 # Identify the tests to run. If called with args, use those as globs.
 tests_to_run=()
 if [ -n "$*" ]; then
@@ -322,7 +343,11 @@ for t in ${tests_to_run[@]}; do
     wait $service_pid
 
     # FIXME: otherwise we get EBUSY
-    umount $WORKDIR/root/overlay  &>/dev/null
+    if ! is_rootless; then
+        umount $WORKDIR/root/overlay  &>/dev/null
+    else
+        $PODMAN_BIN unshare umount $WORKDIR/root/overlay  &>/dev/null
+    fi
 
     # FIXME: run 'podman ps'?
 #    rm -rf $WORKDIR/${testname}
@@ -336,9 +361,13 @@ done
 test_count=$(<$testcounter_file)
 failure_count=$(<$failures_file)
 
-#if [ -z "$PODMAN_TESTS_KEEP_WORKDIR" ]; then
-#    rm -rf $WORKDIR
-#fi
+if [ -z "$PODMAN_TESTS_KEEP_WORKDIR" ]; then
+     if ! is_rootless; then
+        rm -rf $WORKDIR
+    else
+        $PODMAN_BIN unshare rm -rf $WORKDIR
+    fi
+fi
 
 echo "1..${test_count}"
 
-- 
cgit v1.2.3-54-g00ecf


From 676fcb722f31f3f8eedb017bee828002d23b68f8 Mon Sep 17 00:00:00 2001
From: Paul Holzinger <paul.holzinger@web.de>
Date: Sun, 21 Mar 2021 18:23:31 +0100
Subject: Add new docker-compose test for two networks

Also fix the tests so we can use the podman function with the output.

Signed-off-by: Paul Holzinger <paul.holzinger@web.de>
---
 test/compose/mount_and_label/tests.sh        |  3 ++-
 test/compose/test-compose                    |  7 ++++---
 test/compose/two_networks/Readme.md          |  8 ++++++++
 test/compose/two_networks/docker-compose.yml | 11 +++++++++++
 test/compose/two_networks/tests.sh           |  7 +++++++
 5 files changed, 32 insertions(+), 4 deletions(-)
 create mode 100644 test/compose/two_networks/Readme.md
 create mode 100644 test/compose/two_networks/docker-compose.yml
 create mode 100644 test/compose/two_networks/tests.sh

(limited to 'test')

diff --git a/test/compose/mount_and_label/tests.sh b/test/compose/mount_and_label/tests.sh
index 07ff089b5..fa929bed6 100644
--- a/test/compose/mount_and_label/tests.sh
+++ b/test/compose/mount_and_label/tests.sh
@@ -1,4 +1,5 @@
 # -*- bash -*-
 
 test_port 5000 = "Podman rulez!"
-podman container inspect -l --format '{{.Config.Labels}}' | grep "the_best"
+podman container inspect -l --format '{{.Config.Labels}}'
+like "$output" "io.podman:the_best" "$testname : Container label is set"
diff --git a/test/compose/test-compose b/test/compose/test-compose
index 3cda8514e..704c71a9f 100755
--- a/test/compose/test-compose
+++ b/test/compose/test-compose
@@ -224,10 +224,11 @@ function start_service() {
 ############
 function podman() {
     echo "\$ podman $*"           >>$WORKDIR/output.log
-    $PODMAN_BIN \
+    output=$($PODMAN_BIN \
         --root    $WORKDIR/root    \
         --runroot $WORKDIR/runroot \
-        "$@"    >>$WORKDIR/output.log 2>&1
+        "$@")
+    echo -n "$output" >>$WORKDIR/output.log
 }
 
 ###################
@@ -329,7 +330,7 @@ for t in ${tests_to_run[@]}; do
         fi
 
         # Done. Clean up.
-        docker-compose down     &> $logfile
+        docker-compose down     &>> $logfile
         rc=$?
         if [[ $rc -eq 0 ]]; then
             _show_ok 1 "$testname - down"
diff --git a/test/compose/two_networks/Readme.md b/test/compose/two_networks/Readme.md
new file mode 100644
index 000000000..471004f7d
--- /dev/null
+++ b/test/compose/two_networks/Readme.md
@@ -0,0 +1,8 @@
+two networks
+===============
+
+This test checks that we can create containers with more than one network.
+
+Validation
+------------
+* podman container inspect two_networks_con1_1 --format '{{len .NetworkSettings.Networks}}' shows 2
diff --git a/test/compose/two_networks/docker-compose.yml b/test/compose/two_networks/docker-compose.yml
new file mode 100644
index 000000000..686396ccc
--- /dev/null
+++ b/test/compose/two_networks/docker-compose.yml
@@ -0,0 +1,11 @@
+version: '3'
+services:
+  con1:
+    image: alpine
+    command: top
+    networks:
+      - net1
+      - net2
+networks:
+  net1:
+  net2:
diff --git a/test/compose/two_networks/tests.sh b/test/compose/two_networks/tests.sh
new file mode 100644
index 000000000..1cc88aa5f
--- /dev/null
+++ b/test/compose/two_networks/tests.sh
@@ -0,0 +1,7 @@
+# -*- bash -*-
+
+podman container inspect two_networks_con1_1 --format '{{len .NetworkSettings.Networks}}'
+is "$output" "2" "$testname : Container is connected to both networks"
+podman container inspect two_networks_con1_1 --format '{{.NetworkSettings.Networks}}'
+like "$output" "two_networks_net1" "$testname : First network name exists"
+like "$output" "two_networks_net2" "$testname : Second network name exists"
-- 
cgit v1.2.3-54-g00ecf