github.com/cloudfoundry-attic/garden-linux@v0.333.2-candidate/containerizer/system/run_in_container_linux_test.go (about)

     1  package system_test
     2  
     3  import (
     4  	"io"
     5  	"os/exec"
     6  	"syscall"
     7  
     8  	"fmt"
     9  )
    10  
    11  func runInContainer(stdout, stderr io.Writer, privileged bool, programName string, args ...string) error {
    12  	var container string
    13  
    14  	// Locate appropriate binary.
    15  	// Note: gexec.Build must be run in the suite rather than in the test to avoid intermittent failures
    16  	// due to racing builds.
    17  	switch programName {
    18  	case "fake_mounter":
    19  		container = fakeMounterBin
    20  	case "fake_container":
    21  		container = fakeContainerBin
    22  	default:
    23  		return fmt.Errorf("Unexpected programName %q", programName)
    24  	}
    25  
    26  	flags := syscall.CLONE_NEWNS
    27  	flags = flags | syscall.CLONE_NEWUTS
    28  	if !privileged {
    29  		flags = flags | syscall.CLONE_NEWUSER
    30  	}
    31  
    32  	cmd := exec.Command(container, args...)
    33  	cmd.Stdout = stdout
    34  	cmd.Stderr = stderr
    35  	cmd.SysProcAttr = &syscall.SysProcAttr{
    36  		Cloneflags: uintptr(flags),
    37  	}
    38  
    39  	if !privileged {
    40  		cmd.SysProcAttr.UidMappings = []syscall.SysProcIDMap{
    41  			{
    42  				ContainerID: 0,
    43  				HostID:      0,
    44  				Size:        1,
    45  			},
    46  		}
    47  		cmd.SysProcAttr.GidMappings = []syscall.SysProcIDMap{
    48  			{
    49  				ContainerID: 0,
    50  				HostID:      0,
    51  				Size:        1,
    52  			},
    53  		}
    54  	}
    55  
    56  	return cmd.Run()
    57  }