summaryrefslogtreecommitdiff
path: root/daemon/oci_linux_test.go
Commit message (Collapse)AuthorAgeFilesLines
* daemon: setupFakeDaemon(): add fakeImageServiceSebastiaan van Stijn2023-04-181-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | To prevent a panic happening when running tests: === FAIL: daemon TestTmpfsDevShmNoDupMount (0.01s) panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x120 pc=0x261a373] goroutine 134 [running]: testing.tRunner.func1.2({0x28baf20, 0x3ea8000}) /usr/local/go/src/testing/testing.go:1526 +0x24e testing.tRunner.func1() /usr/local/go/src/testing/testing.go:1529 +0x39f panic({0x28baf20, 0x3ea8000}) /usr/local/go/src/runtime/panic.go:884 +0x213 github.com/docker/docker/daemon.(*Daemon).createSpec(0xc0006e0000, {0x2ea5588, 0xc00012a008}, 0xc0003b5900) /go/src/github.com/docker/docker/daemon/oci_linux.go:1060 +0xf33 github.com/docker/docker/daemon.TestTmpfsDevShmNoDupMount(0xc000b781a0?) /go/src/github.com/docker/docker/daemon/oci_linux_test.go:77 +0x20a testing.tRunner(0xc000b78340, 0x2c74210) /usr/local/go/src/testing/testing.go:1576 +0x10b created by testing.(*T).Run /usr/local/go/src/testing/testing.go:1629 +0x3ea Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* imageservice: Add context to various methodsNicolas De Loof2022-11-031-8/+9
| | | | | Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com> Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
* pkg/containerfs: alias ContainerFS to stringCory Snider2022-09-231-2/+1
| | | | | | Drop the constructor and redundant string() type-casts. Signed-off-by: Cory Snider <csnider@mirantis.com>
* Finish refactor of UID/GID usage to a new structCory Snider2022-03-141-2/+0
| | | | | | | | | | | | | | | | | | | | | | Finish the refactor which was partially completed with commit 34536c498d56, passing around IdentityMapping structs instead of pairs of []IDMap slices. Existing code which uses []IDMap relies on zero-valued fields to be valid, empty mappings. So in order to successfully finish the refactoring without introducing bugs, their replacement therefore also needs to have a useful zero value which represents an empty mapping. Change IdentityMapping to be a pass-by-value type so that there are no nil pointers to worry about. The functionality provided by the deprecated NewIDMappingsFromMaps function is required by unit tests to to construct arbitrary IdentityMapping values. And the daemon will always need to access the mappings to pass them to the Linux kernel. Accommodate these use cases by exporting the struct fields instead. BuildKit currently depends on the UIDs and GIDs methods so we cannot get rid of them yet. Signed-off-by: Cory Snider <csnider@mirantis.com>
* daemon.WithCommonOptions() fix detection of user-namespacesSebastiaan van Stijn2021-08-301-2/+14
| | | | | | | | | | | | | | | | | | | Commit dae652e2e5e47d99c8febd5bc81df0a3269beb74 added support for non-privileged containers to use ICMP_PROTO (used for `ping`). This option cannot be set for containers that have user-namespaces enabled. However, the detection looks to be incorrect; HostConfig.UsernsMode was added in 6993e891d10c760d22e0ea3d455f13858cd0de46 / ee2183881b0273ff1707501e71798a61018f50f0, and the property only has meaning if the daemon is running with user namespaces enabled. In other situations, the property has no meaning. As a result of the above, the sysctl would only be set for containers running with UsernsMode=host on a daemon running with user-namespaces enabled. This patch adds a check if the daemon has user-namespaces enabled (RemappedRoot having a non-empty value), or if the daemon is running inside a user namespace (e.g. rootless mode) to fix the detection. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* Merge pull request #40084 from thaJeztah/hostconfig_const_cleanupAkihiro Suda2021-08-281-2/+2
|\ | | | | api/types: hostconfig: add some constants/enums and minor code cleanup
| * api/types: hostconfig: define consts for IpcModeSebastiaan van Stijn2021-08-061-2/+2
| | | | | | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* | refactor: move from io/ioutil to io and os packageEng Zer Jun2021-08-271-2/+1
|/ | | | | | | | The io/ioutil package has been deprecated in Go 1.16. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
* Fixup libnetwork lint errorsBrian Goff2021-06-011-1/+1
| | | | Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* Fix libnetwork importsBrian Goff2021-06-011-1/+1
| | | | | | | | | After moving libnetwork to this repo, we need to update all the import paths for libnetwork to point to docker/docker/libnetwork instead of docker/libnetwork. This change implements that. Signed-off-by: Brian Goff <cpuguy83@gmail.com>
* daemon/oci_linux_test: Skip privileged tests when non-rootArnaud Rebillout2020-12-151-0/+5
| | | | | | | | | | | | | | | | | | | These tests fail when run by a non-root user === RUN TestTmpfsDevShmNoDupMount oci_linux_test.go:29: assertion failed: error is not nil: mkdir /var/lib/docker: permission denied --- FAIL: TestTmpfsDevShmNoDupMount (0.00s) === RUN TestIpcPrivateVsReadonly oci_linux_test.go:29: assertion failed: error is not nil: mkdir /var/lib/docker: permission denied --- FAIL: TestIpcPrivateVsReadonly (0.00s) === RUN TestSysctlOverride oci_linux_test.go:29: assertion failed: error is not nil: mkdir /var/lib/docker: permission denied --- FAIL: TestSysctlOverride (0.00s) === RUN TestSysctlOverrideHost oci_linux_test.go:29: assertion failed: error is not nil: mkdir /var/lib/docker: permission denied --- FAIL: TestSysctlOverrideHost (0.00s) Signed-off-by: Arnaud Rebillout <elboulangero@gmail.com>
* Add default sysctls to allow ping sockets and privileged ports with no ↵Justin Cormack2020-06-041-1/+39
| | | | | | | | | | | | | capabilities Currently default capability CAP_NET_RAW allows users to open ICMP echo sockets, and CAP_NET_BIND_SERVICE allows binding to ports under 1024. Both of these are safe operations, and Linux now provides ways that these can be set, per container, to be allowed without any capabilties for non root users. Enable these by default. Users can revert to the previous behaviour by overriding the sysctl values explicitly. Signed-off-by: Justin Cormack <justin.cormack@docker.com>
* daemon: address some minor linting issues and nitsSebastiaan van Stijn2020-04-141-1/+1
| | | | Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* bump gotest.tools v3.0.1 for compatibility with Go 1.14Sebastiaan van Stijn2020-02-111-2/+2
| | | | | | full diff: https://github.com/gotestyourself/gotest.tools/compare/v2.3.0...v3.0.1 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
* oci: add integration tests for kernel.domainname configurationAleksa Sarai2018-11-301-34/+82
| | | | | | This also includes a few refactors of oci_linux_test.go. Signed-off-by: Aleksa Sarai <asarai@suse.de>
* Fix typos in commentLihua Tang2018-09-071-1/+1
| | | | Signed-off-by: Lihua Tang <lhtang@alauda.io>
* Add ADD/COPY --chown flag support to WindowsSalahuddin Khan2018-08-131-2/+2
| | | | | | | | | | | | | | | | | | | | This implements chown support on Windows. Built-in accounts as well as accounts included in the SAM database of the container are supported. NOTE: IDPair is now named Identity and IDMappings is now named IdentityMapping. The following are valid examples: ADD --chown=Guest . <some directory> COPY --chown=Administrator . <some directory> COPY --chown=Guests . <some directory> COPY --chown=ContainerUser . <some directory> On Windows an owner is only granted the permission to read the security descriptor and read/write the discretionary access control list. This fix also grants read/write and execute permissions to the owner. Signed-off-by: Salahuddin Khan <salah@docker.com>
* Update tests to use gotest.tools 👼Vincent Demeester2018-06-131-2/+2
| | | | Signed-off-by: Vincent Demeester <vincent@sbr.pm>
* daemon.getSourceMount(): fix for / mount pointKir Kolyshkin2018-05-101-0/+14
| | | | | | | | | | | A recent optimization in getSourceMount() made it return an error in case when the found mount point is "/". This prevented bind-mounted volumes from working in such cases. A (rather trivial but adeqate) unit test case is added. Fixes: 871c957242 ("getSourceMount(): simplify") Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Automated migration usingDaniel Nephin2018-03-161-8/+8
| | | | | | gty-migrate-from-testify --ignore-build-tags Signed-off-by: Daniel Nephin <dnephin@docker.com>
* daemon/oci_linux_test: add TestIpcPrivateVsReadonlyKir Kolyshkin2018-03-081-0/+38
| | | | | | | | The test case checks that in case of IpcMode: private and ReadonlyRootfs: true (as in "docker run --ipc private --read-only") the resulting /dev/shm mount is NOT made read-only. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
* Add canonical import commentDaniel Nephin2018-02-051-1/+1
| | | | Signed-off-by: Daniel Nephin <dnephin@docker.com>
* Fix "duplicate mount point" when --tmpfs /dev/shm is usedKir Kolyshkin2017-11-201-0/+50
This is a fix to the following issue: $ docker run --tmpfs /dev/shm busybox sh docker: Error response from daemon: linux mounts: Duplicate mount point '/dev/shm'. In current code (daemon.createSpec()), tmpfs mount from --tmpfs is added to list of mounts (`ms`), when the mount from IpcMounts() is added. While IpcMounts() is checking for existing mounts first, it does that by using container.HasMountFor() function which only checks container.Mounts but not container.Tmpfs. Ultimately, the solution is to get rid of container.Tmpfs (moving its data to container.Mounts). Current workaround is to add checking of container.Tmpfs into container.HasMountFor(). A unit test case is included. Unfortunately we can't call daemon.createSpec() from a unit test, as the code relies a lot on various daemon structures to be initialized properly, and it is hard to achieve. Therefore, we minimally mimick the code flow of daemon.createSpec() -- barely enough to reproduce the issue. https://github.com/moby/moby/issues/35455 Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
View Lorry Controller Status