github.com/fabiokung/docker@v0.11.2-0.20170222101415-4534dcd49497/integration-cli/docker_cli_run_unix_test.go (about) 1 // +build !windows 2 3 package main 4 5 import ( 6 "bufio" 7 "encoding/json" 8 "fmt" 9 "io/ioutil" 10 "os" 11 "os/exec" 12 "path/filepath" 13 "regexp" 14 "strconv" 15 "strings" 16 "syscall" 17 "time" 18 19 "github.com/docker/docker/integration-cli/checker" 20 "github.com/docker/docker/pkg/homedir" 21 "github.com/docker/docker/pkg/mount" 22 "github.com/docker/docker/pkg/parsers" 23 "github.com/docker/docker/pkg/sysinfo" 24 icmd "github.com/docker/docker/pkg/testutil/cmd" 25 "github.com/go-check/check" 26 "github.com/kr/pty" 27 ) 28 29 // #6509 30 func (s *DockerSuite) TestRunRedirectStdout(c *check.C) { 31 checkRedirect := func(command string) { 32 _, tty, err := pty.Open() 33 c.Assert(err, checker.IsNil, check.Commentf("Could not open pty")) 34 cmd := exec.Command("sh", "-c", command) 35 cmd.Stdin = tty 36 cmd.Stdout = tty 37 cmd.Stderr = tty 38 c.Assert(cmd.Start(), checker.IsNil) 39 ch := make(chan error) 40 go func() { 41 ch <- cmd.Wait() 42 close(ch) 43 }() 44 45 select { 46 case <-time.After(10 * time.Second): 47 c.Fatal("command timeout") 48 case err := <-ch: 49 c.Assert(err, checker.IsNil, check.Commentf("wait err")) 50 } 51 } 52 53 checkRedirect(dockerBinary + " run -i busybox cat /etc/passwd | grep -q root") 54 checkRedirect(dockerBinary + " run busybox cat /etc/passwd | grep -q root") 55 } 56 57 // Test recursive bind mount works by default 58 func (s *DockerSuite) TestRunWithVolumesIsRecursive(c *check.C) { 59 // /tmp gets permission denied 60 testRequires(c, NotUserNamespace, SameHostDaemon) 61 tmpDir, err := ioutil.TempDir("", "docker_recursive_mount_test") 62 c.Assert(err, checker.IsNil) 63 64 defer os.RemoveAll(tmpDir) 65 66 // Create a temporary tmpfs mount. 67 tmpfsDir := filepath.Join(tmpDir, "tmpfs") 68 c.Assert(os.MkdirAll(tmpfsDir, 0777), checker.IsNil, check.Commentf("failed to mkdir at %s", tmpfsDir)) 69 c.Assert(mount.Mount("tmpfs", tmpfsDir, "tmpfs", ""), checker.IsNil, check.Commentf("failed to create a tmpfs mount at %s", tmpfsDir)) 70 71 f, err := ioutil.TempFile(tmpfsDir, "touch-me") 72 c.Assert(err, checker.IsNil) 73 defer f.Close() 74 75 out, _ := dockerCmd(c, "run", "--name", "test-data", "--volume", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox:latest", "ls", "/tmp/tmpfs") 76 c.Assert(out, checker.Contains, filepath.Base(f.Name()), check.Commentf("Recursive bind mount test failed. Expected file not found")) 77 } 78 79 func (s *DockerSuite) TestRunDeviceDirectory(c *check.C) { 80 testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm) 81 if _, err := os.Stat("/dev/snd"); err != nil { 82 c.Skip("Host does not have /dev/snd") 83 } 84 85 out, _ := dockerCmd(c, "run", "--device", "/dev/snd:/dev/snd", "busybox", "sh", "-c", "ls /dev/snd/") 86 c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "timer", check.Commentf("expected output /dev/snd/timer")) 87 88 out, _ = dockerCmd(c, "run", "--device", "/dev/snd:/dev/othersnd", "busybox", "sh", "-c", "ls /dev/othersnd/") 89 c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "seq", check.Commentf("expected output /dev/othersnd/seq")) 90 } 91 92 // TestRunAttachDetach checks attaching and detaching with the default escape sequence. 93 func (s *DockerSuite) TestRunAttachDetach(c *check.C) { 94 name := "attach-detach" 95 96 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat") 97 98 cmd := exec.Command(dockerBinary, "attach", name) 99 stdout, err := cmd.StdoutPipe() 100 c.Assert(err, checker.IsNil) 101 cpty, tty, err := pty.Open() 102 c.Assert(err, checker.IsNil) 103 defer cpty.Close() 104 cmd.Stdin = tty 105 c.Assert(cmd.Start(), checker.IsNil) 106 c.Assert(waitRun(name), check.IsNil) 107 108 _, err = cpty.Write([]byte("hello\n")) 109 c.Assert(err, checker.IsNil) 110 111 out, err := bufio.NewReader(stdout).ReadString('\n') 112 c.Assert(err, checker.IsNil) 113 c.Assert(strings.TrimSpace(out), checker.Equals, "hello") 114 115 // escape sequence 116 _, err = cpty.Write([]byte{16}) 117 c.Assert(err, checker.IsNil) 118 time.Sleep(100 * time.Millisecond) 119 _, err = cpty.Write([]byte{17}) 120 c.Assert(err, checker.IsNil) 121 122 ch := make(chan struct{}) 123 go func() { 124 cmd.Wait() 125 ch <- struct{}{} 126 }() 127 128 select { 129 case <-ch: 130 case <-time.After(10 * time.Second): 131 c.Fatal("timed out waiting for container to exit") 132 } 133 134 running := inspectField(c, name, "State.Running") 135 c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running")) 136 137 out, _ = dockerCmd(c, "events", "--since=0", "--until", daemonUnixTime(c), "-f", "container="+name) 138 // attach and detach event should be monitored 139 c.Assert(out, checker.Contains, "attach") 140 c.Assert(out, checker.Contains, "detach") 141 } 142 143 // TestRunAttachDetachFromFlag checks attaching and detaching with the escape sequence specified via flags. 144 func (s *DockerSuite) TestRunAttachDetachFromFlag(c *check.C) { 145 name := "attach-detach" 146 keyCtrlA := []byte{1} 147 keyA := []byte{97} 148 149 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat") 150 151 cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-a,a", name) 152 stdout, err := cmd.StdoutPipe() 153 if err != nil { 154 c.Fatal(err) 155 } 156 cpty, tty, err := pty.Open() 157 if err != nil { 158 c.Fatal(err) 159 } 160 defer cpty.Close() 161 cmd.Stdin = tty 162 if err := cmd.Start(); err != nil { 163 c.Fatal(err) 164 } 165 c.Assert(waitRun(name), check.IsNil) 166 167 if _, err := cpty.Write([]byte("hello\n")); err != nil { 168 c.Fatal(err) 169 } 170 171 out, err := bufio.NewReader(stdout).ReadString('\n') 172 if err != nil { 173 c.Fatal(err) 174 } 175 if strings.TrimSpace(out) != "hello" { 176 c.Fatalf("expected 'hello', got %q", out) 177 } 178 179 // escape sequence 180 if _, err := cpty.Write(keyCtrlA); err != nil { 181 c.Fatal(err) 182 } 183 time.Sleep(100 * time.Millisecond) 184 if _, err := cpty.Write(keyA); err != nil { 185 c.Fatal(err) 186 } 187 188 ch := make(chan struct{}) 189 go func() { 190 cmd.Wait() 191 ch <- struct{}{} 192 }() 193 194 select { 195 case <-ch: 196 case <-time.After(10 * time.Second): 197 c.Fatal("timed out waiting for container to exit") 198 } 199 200 running := inspectField(c, name, "State.Running") 201 c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running")) 202 } 203 204 // TestRunAttachDetachFromInvalidFlag checks attaching and detaching with the escape sequence specified via flags. 205 func (s *DockerSuite) TestRunAttachDetachFromInvalidFlag(c *check.C) { 206 name := "attach-detach" 207 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "top") 208 c.Assert(waitRun(name), check.IsNil) 209 210 // specify an invalid detach key, container will ignore it and use default 211 cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-A,a", name) 212 stdout, err := cmd.StdoutPipe() 213 if err != nil { 214 c.Fatal(err) 215 } 216 cpty, tty, err := pty.Open() 217 if err != nil { 218 c.Fatal(err) 219 } 220 defer cpty.Close() 221 cmd.Stdin = tty 222 if err := cmd.Start(); err != nil { 223 c.Fatal(err) 224 } 225 226 bufReader := bufio.NewReader(stdout) 227 out, err := bufReader.ReadString('\n') 228 if err != nil { 229 c.Fatal(err) 230 } 231 // it should print a warning to indicate the detach key flag is invalid 232 errStr := "Invalid detach keys (ctrl-A,a) provided" 233 c.Assert(strings.TrimSpace(out), checker.Equals, errStr) 234 } 235 236 // TestRunAttachDetachFromConfig checks attaching and detaching with the escape sequence specified via config file. 237 func (s *DockerSuite) TestRunAttachDetachFromConfig(c *check.C) { 238 keyCtrlA := []byte{1} 239 keyA := []byte{97} 240 241 // Setup config 242 homeKey := homedir.Key() 243 homeVal := homedir.Get() 244 tmpDir, err := ioutil.TempDir("", "fake-home") 245 c.Assert(err, checker.IsNil) 246 defer os.RemoveAll(tmpDir) 247 248 dotDocker := filepath.Join(tmpDir, ".docker") 249 os.Mkdir(dotDocker, 0600) 250 tmpCfg := filepath.Join(dotDocker, "config.json") 251 252 defer func() { os.Setenv(homeKey, homeVal) }() 253 os.Setenv(homeKey, tmpDir) 254 255 data := `{ 256 "detachKeys": "ctrl-a,a" 257 }` 258 259 err = ioutil.WriteFile(tmpCfg, []byte(data), 0600) 260 c.Assert(err, checker.IsNil) 261 262 // Then do the work 263 name := "attach-detach" 264 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat") 265 266 cmd := exec.Command(dockerBinary, "attach", name) 267 stdout, err := cmd.StdoutPipe() 268 if err != nil { 269 c.Fatal(err) 270 } 271 cpty, tty, err := pty.Open() 272 if err != nil { 273 c.Fatal(err) 274 } 275 defer cpty.Close() 276 cmd.Stdin = tty 277 if err := cmd.Start(); err != nil { 278 c.Fatal(err) 279 } 280 c.Assert(waitRun(name), check.IsNil) 281 282 if _, err := cpty.Write([]byte("hello\n")); err != nil { 283 c.Fatal(err) 284 } 285 286 out, err := bufio.NewReader(stdout).ReadString('\n') 287 if err != nil { 288 c.Fatal(err) 289 } 290 if strings.TrimSpace(out) != "hello" { 291 c.Fatalf("expected 'hello', got %q", out) 292 } 293 294 // escape sequence 295 if _, err := cpty.Write(keyCtrlA); err != nil { 296 c.Fatal(err) 297 } 298 time.Sleep(100 * time.Millisecond) 299 if _, err := cpty.Write(keyA); err != nil { 300 c.Fatal(err) 301 } 302 303 ch := make(chan struct{}) 304 go func() { 305 cmd.Wait() 306 ch <- struct{}{} 307 }() 308 309 select { 310 case <-ch: 311 case <-time.After(10 * time.Second): 312 c.Fatal("timed out waiting for container to exit") 313 } 314 315 running := inspectField(c, name, "State.Running") 316 c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running")) 317 } 318 319 // TestRunAttachDetachKeysOverrideConfig checks attaching and detaching with the detach flags, making sure it overrides config file 320 func (s *DockerSuite) TestRunAttachDetachKeysOverrideConfig(c *check.C) { 321 keyCtrlA := []byte{1} 322 keyA := []byte{97} 323 324 // Setup config 325 homeKey := homedir.Key() 326 homeVal := homedir.Get() 327 tmpDir, err := ioutil.TempDir("", "fake-home") 328 c.Assert(err, checker.IsNil) 329 defer os.RemoveAll(tmpDir) 330 331 dotDocker := filepath.Join(tmpDir, ".docker") 332 os.Mkdir(dotDocker, 0600) 333 tmpCfg := filepath.Join(dotDocker, "config.json") 334 335 defer func() { os.Setenv(homeKey, homeVal) }() 336 os.Setenv(homeKey, tmpDir) 337 338 data := `{ 339 "detachKeys": "ctrl-e,e" 340 }` 341 342 err = ioutil.WriteFile(tmpCfg, []byte(data), 0600) 343 c.Assert(err, checker.IsNil) 344 345 // Then do the work 346 name := "attach-detach" 347 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat") 348 349 cmd := exec.Command(dockerBinary, "attach", "--detach-keys=ctrl-a,a", name) 350 stdout, err := cmd.StdoutPipe() 351 if err != nil { 352 c.Fatal(err) 353 } 354 cpty, tty, err := pty.Open() 355 if err != nil { 356 c.Fatal(err) 357 } 358 defer cpty.Close() 359 cmd.Stdin = tty 360 if err := cmd.Start(); err != nil { 361 c.Fatal(err) 362 } 363 c.Assert(waitRun(name), check.IsNil) 364 365 if _, err := cpty.Write([]byte("hello\n")); err != nil { 366 c.Fatal(err) 367 } 368 369 out, err := bufio.NewReader(stdout).ReadString('\n') 370 if err != nil { 371 c.Fatal(err) 372 } 373 if strings.TrimSpace(out) != "hello" { 374 c.Fatalf("expected 'hello', got %q", out) 375 } 376 377 // escape sequence 378 if _, err := cpty.Write(keyCtrlA); err != nil { 379 c.Fatal(err) 380 } 381 time.Sleep(100 * time.Millisecond) 382 if _, err := cpty.Write(keyA); err != nil { 383 c.Fatal(err) 384 } 385 386 ch := make(chan struct{}) 387 go func() { 388 cmd.Wait() 389 ch <- struct{}{} 390 }() 391 392 select { 393 case <-ch: 394 case <-time.After(10 * time.Second): 395 c.Fatal("timed out waiting for container to exit") 396 } 397 398 running := inspectField(c, name, "State.Running") 399 c.Assert(running, checker.Equals, "true", check.Commentf("expected container to still be running")) 400 } 401 402 func (s *DockerSuite) TestRunAttachInvalidDetachKeySequencePreserved(c *check.C) { 403 name := "attach-detach" 404 keyA := []byte{97} 405 keyB := []byte{98} 406 407 dockerCmd(c, "run", "--name", name, "-itd", "busybox", "cat") 408 409 cmd := exec.Command(dockerBinary, "attach", "--detach-keys=a,b,c", name) 410 stdout, err := cmd.StdoutPipe() 411 if err != nil { 412 c.Fatal(err) 413 } 414 cpty, tty, err := pty.Open() 415 if err != nil { 416 c.Fatal(err) 417 } 418 defer cpty.Close() 419 cmd.Stdin = tty 420 if err := cmd.Start(); err != nil { 421 c.Fatal(err) 422 } 423 c.Assert(waitRun(name), check.IsNil) 424 425 // Invalid escape sequence aba, should print aba in output 426 if _, err := cpty.Write(keyA); err != nil { 427 c.Fatal(err) 428 } 429 time.Sleep(100 * time.Millisecond) 430 if _, err := cpty.Write(keyB); err != nil { 431 c.Fatal(err) 432 } 433 time.Sleep(100 * time.Millisecond) 434 if _, err := cpty.Write(keyA); err != nil { 435 c.Fatal(err) 436 } 437 time.Sleep(100 * time.Millisecond) 438 if _, err := cpty.Write([]byte("\n")); err != nil { 439 c.Fatal(err) 440 } 441 442 out, err := bufio.NewReader(stdout).ReadString('\n') 443 if err != nil { 444 c.Fatal(err) 445 } 446 if strings.TrimSpace(out) != "aba" { 447 c.Fatalf("expected 'aba', got %q", out) 448 } 449 } 450 451 // "test" should be printed 452 func (s *DockerSuite) TestRunWithCPUQuota(c *check.C) { 453 testRequires(c, cpuCfsQuota) 454 455 file := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us" 456 out, _ := dockerCmd(c, "run", "--cpu-quota", "8000", "--name", "test", "busybox", "cat", file) 457 c.Assert(strings.TrimSpace(out), checker.Equals, "8000") 458 459 out = inspectField(c, "test", "HostConfig.CpuQuota") 460 c.Assert(out, checker.Equals, "8000", check.Commentf("setting the CPU CFS quota failed")) 461 } 462 463 func (s *DockerSuite) TestRunWithCpuPeriod(c *check.C) { 464 testRequires(c, cpuCfsPeriod) 465 466 file := "/sys/fs/cgroup/cpu/cpu.cfs_period_us" 467 out, _ := dockerCmd(c, "run", "--cpu-period", "50000", "--name", "test", "busybox", "cat", file) 468 c.Assert(strings.TrimSpace(out), checker.Equals, "50000") 469 470 out, _ = dockerCmd(c, "run", "--cpu-period", "0", "busybox", "cat", file) 471 c.Assert(strings.TrimSpace(out), checker.Equals, "100000") 472 473 out = inspectField(c, "test", "HostConfig.CpuPeriod") 474 c.Assert(out, checker.Equals, "50000", check.Commentf("setting the CPU CFS period failed")) 475 } 476 477 func (s *DockerSuite) TestRunWithInvalidCpuPeriod(c *check.C) { 478 testRequires(c, cpuCfsPeriod) 479 out, _, err := dockerCmdWithError("run", "--cpu-period", "900", "busybox", "true") 480 c.Assert(err, check.NotNil) 481 expected := "CPU cfs period can not be less than 1ms (i.e. 1000) or larger than 1s (i.e. 1000000)" 482 c.Assert(out, checker.Contains, expected) 483 484 out, _, err = dockerCmdWithError("run", "--cpu-period", "2000000", "busybox", "true") 485 c.Assert(err, check.NotNil) 486 c.Assert(out, checker.Contains, expected) 487 488 out, _, err = dockerCmdWithError("run", "--cpu-period", "-3", "busybox", "true") 489 c.Assert(err, check.NotNil) 490 c.Assert(out, checker.Contains, expected) 491 } 492 493 func (s *DockerSuite) TestRunWithKernelMemory(c *check.C) { 494 testRequires(c, kernelMemorySupport) 495 496 file := "/sys/fs/cgroup/memory/memory.kmem.limit_in_bytes" 497 stdout, _, _ := dockerCmdWithStdoutStderr(c, "run", "--kernel-memory", "50M", "--name", "test1", "busybox", "cat", file) 498 c.Assert(strings.TrimSpace(stdout), checker.Equals, "52428800") 499 500 out := inspectField(c, "test1", "HostConfig.KernelMemory") 501 c.Assert(out, check.Equals, "52428800") 502 } 503 504 func (s *DockerSuite) TestRunWithInvalidKernelMemory(c *check.C) { 505 testRequires(c, kernelMemorySupport) 506 507 out, _, err := dockerCmdWithError("run", "--kernel-memory", "2M", "busybox", "true") 508 c.Assert(err, check.NotNil) 509 expected := "Minimum kernel memory limit allowed is 4MB" 510 c.Assert(out, checker.Contains, expected) 511 512 out, _, err = dockerCmdWithError("run", "--kernel-memory", "-16m", "--name", "test2", "busybox", "echo", "test") 513 c.Assert(err, check.NotNil) 514 expected = "invalid size" 515 c.Assert(out, checker.Contains, expected) 516 } 517 518 func (s *DockerSuite) TestRunWithCPUShares(c *check.C) { 519 testRequires(c, cpuShare) 520 521 file := "/sys/fs/cgroup/cpu/cpu.shares" 522 out, _ := dockerCmd(c, "run", "--cpu-shares", "1000", "--name", "test", "busybox", "cat", file) 523 c.Assert(strings.TrimSpace(out), checker.Equals, "1000") 524 525 out = inspectField(c, "test", "HostConfig.CPUShares") 526 c.Assert(out, check.Equals, "1000") 527 } 528 529 // "test" should be printed 530 func (s *DockerSuite) TestRunEchoStdoutWithCPUSharesAndMemoryLimit(c *check.C) { 531 testRequires(c, cpuShare) 532 testRequires(c, memoryLimitSupport) 533 out, _, _ := dockerCmdWithStdoutStderr(c, "run", "--cpu-shares", "1000", "-m", "32m", "busybox", "echo", "test") 534 c.Assert(out, checker.Equals, "test\n", check.Commentf("container should've printed 'test'")) 535 } 536 537 func (s *DockerSuite) TestRunWithCpusetCpus(c *check.C) { 538 testRequires(c, cgroupCpuset) 539 540 file := "/sys/fs/cgroup/cpuset/cpuset.cpus" 541 out, _ := dockerCmd(c, "run", "--cpuset-cpus", "0", "--name", "test", "busybox", "cat", file) 542 c.Assert(strings.TrimSpace(out), checker.Equals, "0") 543 544 out = inspectField(c, "test", "HostConfig.CpusetCpus") 545 c.Assert(out, check.Equals, "0") 546 } 547 548 func (s *DockerSuite) TestRunWithCpusetMems(c *check.C) { 549 testRequires(c, cgroupCpuset) 550 551 file := "/sys/fs/cgroup/cpuset/cpuset.mems" 552 out, _ := dockerCmd(c, "run", "--cpuset-mems", "0", "--name", "test", "busybox", "cat", file) 553 c.Assert(strings.TrimSpace(out), checker.Equals, "0") 554 555 out = inspectField(c, "test", "HostConfig.CpusetMems") 556 c.Assert(out, check.Equals, "0") 557 } 558 559 func (s *DockerSuite) TestRunWithBlkioWeight(c *check.C) { 560 testRequires(c, blkioWeight) 561 562 file := "/sys/fs/cgroup/blkio/blkio.weight" 563 out, _ := dockerCmd(c, "run", "--blkio-weight", "300", "--name", "test", "busybox", "cat", file) 564 c.Assert(strings.TrimSpace(out), checker.Equals, "300") 565 566 out = inspectField(c, "test", "HostConfig.BlkioWeight") 567 c.Assert(out, check.Equals, "300") 568 } 569 570 func (s *DockerSuite) TestRunWithInvalidBlkioWeight(c *check.C) { 571 testRequires(c, blkioWeight) 572 out, _, err := dockerCmdWithError("run", "--blkio-weight", "5", "busybox", "true") 573 c.Assert(err, check.NotNil, check.Commentf(out)) 574 expected := "Range of blkio weight is from 10 to 1000" 575 c.Assert(out, checker.Contains, expected) 576 } 577 578 func (s *DockerSuite) TestRunWithInvalidPathforBlkioWeightDevice(c *check.C) { 579 testRequires(c, blkioWeight) 580 out, _, err := dockerCmdWithError("run", "--blkio-weight-device", "/dev/sdX:100", "busybox", "true") 581 c.Assert(err, check.NotNil, check.Commentf(out)) 582 } 583 584 func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadBps(c *check.C) { 585 testRequires(c, blkioWeight) 586 out, _, err := dockerCmdWithError("run", "--device-read-bps", "/dev/sdX:500", "busybox", "true") 587 c.Assert(err, check.NotNil, check.Commentf(out)) 588 } 589 590 func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteBps(c *check.C) { 591 testRequires(c, blkioWeight) 592 out, _, err := dockerCmdWithError("run", "--device-write-bps", "/dev/sdX:500", "busybox", "true") 593 c.Assert(err, check.NotNil, check.Commentf(out)) 594 } 595 596 func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceReadIOps(c *check.C) { 597 testRequires(c, blkioWeight) 598 out, _, err := dockerCmdWithError("run", "--device-read-iops", "/dev/sdX:500", "busybox", "true") 599 c.Assert(err, check.NotNil, check.Commentf(out)) 600 } 601 602 func (s *DockerSuite) TestRunWithInvalidPathforBlkioDeviceWriteIOps(c *check.C) { 603 testRequires(c, blkioWeight) 604 out, _, err := dockerCmdWithError("run", "--device-write-iops", "/dev/sdX:500", "busybox", "true") 605 c.Assert(err, check.NotNil, check.Commentf(out)) 606 } 607 608 func (s *DockerSuite) TestRunOOMExitCode(c *check.C) { 609 testRequires(c, memoryLimitSupport, swapMemorySupport) 610 errChan := make(chan error) 611 go func() { 612 defer close(errChan) 613 out, exitCode, _ := dockerCmdWithError("run", "-m", "4MB", "busybox", "sh", "-c", "x=a; while true; do x=$x$x$x$x; done") 614 if expected := 137; exitCode != expected { 615 errChan <- fmt.Errorf("wrong exit code for OOM container: expected %d, got %d (output: %q)", expected, exitCode, out) 616 } 617 }() 618 619 select { 620 case err := <-errChan: 621 c.Assert(err, check.IsNil) 622 case <-time.After(600 * time.Second): 623 c.Fatal("Timeout waiting for container to die on OOM") 624 } 625 } 626 627 func (s *DockerSuite) TestRunWithMemoryLimit(c *check.C) { 628 testRequires(c, memoryLimitSupport) 629 630 file := "/sys/fs/cgroup/memory/memory.limit_in_bytes" 631 stdout, _, _ := dockerCmdWithStdoutStderr(c, "run", "-m", "32M", "--name", "test", "busybox", "cat", file) 632 c.Assert(strings.TrimSpace(stdout), checker.Equals, "33554432") 633 634 out := inspectField(c, "test", "HostConfig.Memory") 635 c.Assert(out, check.Equals, "33554432") 636 } 637 638 // TestRunWithoutMemoryswapLimit sets memory limit and disables swap 639 // memory limit, this means the processes in the container can use 640 // 16M memory and as much swap memory as they need (if the host 641 // supports swap memory). 642 func (s *DockerSuite) TestRunWithoutMemoryswapLimit(c *check.C) { 643 testRequires(c, DaemonIsLinux) 644 testRequires(c, memoryLimitSupport) 645 testRequires(c, swapMemorySupport) 646 dockerCmd(c, "run", "-m", "32m", "--memory-swap", "-1", "busybox", "true") 647 } 648 649 func (s *DockerSuite) TestRunWithSwappiness(c *check.C) { 650 testRequires(c, memorySwappinessSupport) 651 file := "/sys/fs/cgroup/memory/memory.swappiness" 652 out, _ := dockerCmd(c, "run", "--memory-swappiness", "0", "--name", "test", "busybox", "cat", file) 653 c.Assert(strings.TrimSpace(out), checker.Equals, "0") 654 655 out = inspectField(c, "test", "HostConfig.MemorySwappiness") 656 c.Assert(out, check.Equals, "0") 657 } 658 659 func (s *DockerSuite) TestRunWithSwappinessInvalid(c *check.C) { 660 testRequires(c, memorySwappinessSupport) 661 out, _, err := dockerCmdWithError("run", "--memory-swappiness", "101", "busybox", "true") 662 c.Assert(err, check.NotNil) 663 expected := "Valid memory swappiness range is 0-100" 664 c.Assert(out, checker.Contains, expected, check.Commentf("Expected output to contain %q, not %q", out, expected)) 665 666 out, _, err = dockerCmdWithError("run", "--memory-swappiness", "-10", "busybox", "true") 667 c.Assert(err, check.NotNil) 668 c.Assert(out, checker.Contains, expected, check.Commentf("Expected output to contain %q, not %q", out, expected)) 669 } 670 671 func (s *DockerSuite) TestRunWithMemoryReservation(c *check.C) { 672 testRequires(c, memoryReservationSupport) 673 674 file := "/sys/fs/cgroup/memory/memory.soft_limit_in_bytes" 675 out, _ := dockerCmd(c, "run", "--memory-reservation", "200M", "--name", "test", "busybox", "cat", file) 676 c.Assert(strings.TrimSpace(out), checker.Equals, "209715200") 677 678 out = inspectField(c, "test", "HostConfig.MemoryReservation") 679 c.Assert(out, check.Equals, "209715200") 680 } 681 682 func (s *DockerSuite) TestRunWithMemoryReservationInvalid(c *check.C) { 683 testRequires(c, memoryLimitSupport) 684 testRequires(c, memoryReservationSupport) 685 out, _, err := dockerCmdWithError("run", "-m", "500M", "--memory-reservation", "800M", "busybox", "true") 686 c.Assert(err, check.NotNil) 687 expected := "Minimum memory limit can not be less than memory reservation limit" 688 c.Assert(strings.TrimSpace(out), checker.Contains, expected, check.Commentf("run container should fail with invalid memory reservation")) 689 690 out, _, err = dockerCmdWithError("run", "--memory-reservation", "1k", "busybox", "true") 691 c.Assert(err, check.NotNil) 692 expected = "Minimum memory reservation allowed is 4MB" 693 c.Assert(strings.TrimSpace(out), checker.Contains, expected, check.Commentf("run container should fail with invalid memory reservation")) 694 } 695 696 func (s *DockerSuite) TestStopContainerSignal(c *check.C) { 697 out, _ := dockerCmd(c, "run", "--stop-signal", "SIGUSR1", "-d", "busybox", "/bin/sh", "-c", `trap 'echo "exit trapped"; exit 0' USR1; while true; do sleep 1; done`) 698 containerID := strings.TrimSpace(out) 699 700 c.Assert(waitRun(containerID), checker.IsNil) 701 702 dockerCmd(c, "stop", containerID) 703 out, _ = dockerCmd(c, "logs", containerID) 704 705 c.Assert(out, checker.Contains, "exit trapped", check.Commentf("Expected `exit trapped` in the log")) 706 } 707 708 func (s *DockerSuite) TestRunSwapLessThanMemoryLimit(c *check.C) { 709 testRequires(c, memoryLimitSupport) 710 testRequires(c, swapMemorySupport) 711 out, _, err := dockerCmdWithError("run", "-m", "16m", "--memory-swap", "15m", "busybox", "echo", "test") 712 expected := "Minimum memoryswap limit should be larger than memory limit" 713 c.Assert(err, check.NotNil) 714 715 c.Assert(out, checker.Contains, expected) 716 } 717 718 func (s *DockerSuite) TestRunInvalidCpusetCpusFlagValue(c *check.C) { 719 testRequires(c, cgroupCpuset, SameHostDaemon) 720 721 sysInfo := sysinfo.New(true) 722 cpus, err := parsers.ParseUintList(sysInfo.Cpus) 723 c.Assert(err, check.IsNil) 724 var invalid int 725 for i := 0; i <= len(cpus)+1; i++ { 726 if !cpus[i] { 727 invalid = i 728 break 729 } 730 } 731 out, _, err := dockerCmdWithError("run", "--cpuset-cpus", strconv.Itoa(invalid), "busybox", "true") 732 c.Assert(err, check.NotNil) 733 expected := fmt.Sprintf("Error response from daemon: Requested CPUs are not available - requested %s, available: %s", strconv.Itoa(invalid), sysInfo.Cpus) 734 c.Assert(out, checker.Contains, expected) 735 } 736 737 func (s *DockerSuite) TestRunInvalidCpusetMemsFlagValue(c *check.C) { 738 testRequires(c, cgroupCpuset) 739 740 sysInfo := sysinfo.New(true) 741 mems, err := parsers.ParseUintList(sysInfo.Mems) 742 c.Assert(err, check.IsNil) 743 var invalid int 744 for i := 0; i <= len(mems)+1; i++ { 745 if !mems[i] { 746 invalid = i 747 break 748 } 749 } 750 out, _, err := dockerCmdWithError("run", "--cpuset-mems", strconv.Itoa(invalid), "busybox", "true") 751 c.Assert(err, check.NotNil) 752 expected := fmt.Sprintf("Error response from daemon: Requested memory nodes are not available - requested %s, available: %s", strconv.Itoa(invalid), sysInfo.Mems) 753 c.Assert(out, checker.Contains, expected) 754 } 755 756 func (s *DockerSuite) TestRunInvalidCPUShares(c *check.C) { 757 testRequires(c, cpuShare, DaemonIsLinux) 758 out, _, err := dockerCmdWithError("run", "--cpu-shares", "1", "busybox", "echo", "test") 759 c.Assert(err, check.NotNil, check.Commentf(out)) 760 expected := "The minimum allowed cpu-shares is 2" 761 c.Assert(out, checker.Contains, expected) 762 763 out, _, err = dockerCmdWithError("run", "--cpu-shares", "-1", "busybox", "echo", "test") 764 c.Assert(err, check.NotNil, check.Commentf(out)) 765 expected = "shares: invalid argument" 766 c.Assert(out, checker.Contains, expected) 767 768 out, _, err = dockerCmdWithError("run", "--cpu-shares", "99999999", "busybox", "echo", "test") 769 c.Assert(err, check.NotNil, check.Commentf(out)) 770 expected = "The maximum allowed cpu-shares is" 771 c.Assert(out, checker.Contains, expected) 772 } 773 774 func (s *DockerSuite) TestRunWithDefaultShmSize(c *check.C) { 775 testRequires(c, DaemonIsLinux) 776 777 name := "shm-default" 778 out, _ := dockerCmd(c, "run", "--name", name, "busybox", "mount") 779 shmRegex := regexp.MustCompile(`shm on /dev/shm type tmpfs(.*)size=65536k`) 780 if !shmRegex.MatchString(out) { 781 c.Fatalf("Expected shm of 64MB in mount command, got %v", out) 782 } 783 shmSize := inspectField(c, name, "HostConfig.ShmSize") 784 c.Assert(shmSize, check.Equals, "67108864") 785 } 786 787 func (s *DockerSuite) TestRunWithShmSize(c *check.C) { 788 testRequires(c, DaemonIsLinux) 789 790 name := "shm" 791 out, _ := dockerCmd(c, "run", "--name", name, "--shm-size=1G", "busybox", "mount") 792 shmRegex := regexp.MustCompile(`shm on /dev/shm type tmpfs(.*)size=1048576k`) 793 if !shmRegex.MatchString(out) { 794 c.Fatalf("Expected shm of 1GB in mount command, got %v", out) 795 } 796 shmSize := inspectField(c, name, "HostConfig.ShmSize") 797 c.Assert(shmSize, check.Equals, "1073741824") 798 } 799 800 func (s *DockerSuite) TestRunTmpfsMountsEnsureOrdered(c *check.C) { 801 tmpFile, err := ioutil.TempFile("", "test") 802 c.Assert(err, check.IsNil) 803 defer tmpFile.Close() 804 out, _ := dockerCmd(c, "run", "--tmpfs", "/run", "-v", tmpFile.Name()+":/run/test", "busybox", "ls", "/run") 805 c.Assert(out, checker.Contains, "test") 806 } 807 808 func (s *DockerSuite) TestRunTmpfsMounts(c *check.C) { 809 // TODO Windows (Post TP5): This test cannot run on a Windows daemon as 810 // Windows does not support tmpfs mounts. 811 testRequires(c, DaemonIsLinux) 812 if out, _, err := dockerCmdWithError("run", "--tmpfs", "/run", "busybox", "touch", "/run/somefile"); err != nil { 813 c.Fatalf("/run directory not mounted on tmpfs %q %s", err, out) 814 } 815 if out, _, err := dockerCmdWithError("run", "--tmpfs", "/run:noexec", "busybox", "touch", "/run/somefile"); err != nil { 816 c.Fatalf("/run directory not mounted on tmpfs %q %s", err, out) 817 } 818 if out, _, err := dockerCmdWithError("run", "--tmpfs", "/run:noexec,nosuid,rw,size=5k,mode=700", "busybox", "touch", "/run/somefile"); err != nil { 819 c.Fatalf("/run failed to mount on tmpfs with valid options %q %s", err, out) 820 } 821 if _, _, err := dockerCmdWithError("run", "--tmpfs", "/run:foobar", "busybox", "touch", "/run/somefile"); err == nil { 822 c.Fatalf("/run mounted on tmpfs when it should have vailed within invalid mount option") 823 } 824 if _, _, err := dockerCmdWithError("run", "--tmpfs", "/run", "-v", "/run:/run", "busybox", "touch", "/run/somefile"); err == nil { 825 c.Fatalf("Should have generated an error saying Duplicate mount points") 826 } 827 } 828 829 func (s *DockerSuite) TestRunTmpfsMountsOverrideImageVolumes(c *check.C) { 830 name := "img-with-volumes" 831 buildImageSuccessfully(c, name, withDockerfile(` 832 FROM busybox 833 VOLUME /run 834 RUN touch /run/stuff 835 `)) 836 out, _ := dockerCmd(c, "run", "--tmpfs", "/run", name, "ls", "/run") 837 c.Assert(out, checker.Not(checker.Contains), "stuff") 838 } 839 840 // Test case for #22420 841 func (s *DockerSuite) TestRunTmpfsMountsWithOptions(c *check.C) { 842 testRequires(c, DaemonIsLinux) 843 844 expectedOptions := []string{"rw", "nosuid", "nodev", "noexec", "relatime"} 845 out, _ := dockerCmd(c, "run", "--tmpfs", "/tmp", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'") 846 for _, option := range expectedOptions { 847 c.Assert(out, checker.Contains, option) 848 } 849 c.Assert(out, checker.Not(checker.Contains), "size=") 850 851 expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime"} 852 out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'") 853 for _, option := range expectedOptions { 854 c.Assert(out, checker.Contains, option) 855 } 856 c.Assert(out, checker.Not(checker.Contains), "size=") 857 858 expectedOptions = []string{"rw", "nosuid", "nodev", "relatime", "size=8192k"} 859 out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,exec,size=8192k", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'") 860 for _, option := range expectedOptions { 861 c.Assert(out, checker.Contains, option) 862 } 863 864 expectedOptions = []string{"rw", "nosuid", "nodev", "noexec", "relatime", "size=4096k"} 865 out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:rw,size=8192k,exec,size=4096k,noexec", "busybox", "sh", "-c", "mount | grep 'tmpfs on /tmp'") 866 for _, option := range expectedOptions { 867 c.Assert(out, checker.Contains, option) 868 } 869 870 // We use debian:jessie as there is no findmnt in busybox. Also the output will be in the format of 871 // TARGET PROPAGATION 872 // /tmp shared 873 // so we only capture `shared` here. 874 expectedOptions = []string{"shared"} 875 out, _ = dockerCmd(c, "run", "--tmpfs", "/tmp:shared", "debian:jessie", "findmnt", "-o", "TARGET,PROPAGATION", "/tmp") 876 for _, option := range expectedOptions { 877 c.Assert(out, checker.Contains, option) 878 } 879 } 880 881 func (s *DockerSuite) TestRunSysctls(c *check.C) { 882 testRequires(c, DaemonIsLinux) 883 var err error 884 885 out, _ := dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=1", "--name", "test", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward") 886 c.Assert(strings.TrimSpace(out), check.Equals, "1") 887 888 out = inspectFieldJSON(c, "test", "HostConfig.Sysctls") 889 890 sysctls := make(map[string]string) 891 err = json.Unmarshal([]byte(out), &sysctls) 892 c.Assert(err, check.IsNil) 893 c.Assert(sysctls["net.ipv4.ip_forward"], check.Equals, "1") 894 895 out, _ = dockerCmd(c, "run", "--sysctl", "net.ipv4.ip_forward=0", "--name", "test1", "busybox", "cat", "/proc/sys/net/ipv4/ip_forward") 896 c.Assert(strings.TrimSpace(out), check.Equals, "0") 897 898 out = inspectFieldJSON(c, "test1", "HostConfig.Sysctls") 899 900 err = json.Unmarshal([]byte(out), &sysctls) 901 c.Assert(err, check.IsNil) 902 c.Assert(sysctls["net.ipv4.ip_forward"], check.Equals, "0") 903 904 icmd.RunCommand(dockerBinary, "run", "--sysctl", "kernel.foobar=1", "--name", "test2", 905 "busybox", "cat", "/proc/sys/kernel/foobar").Assert(c, icmd.Expected{ 906 ExitCode: 125, 907 Err: "invalid argument", 908 }) 909 } 910 911 // TestRunSeccompProfileDenyUnshare checks that 'docker run --security-opt seccomp=/tmp/profile.json debian:jessie unshare' exits with operation not permitted. 912 func (s *DockerSuite) TestRunSeccompProfileDenyUnshare(c *check.C) { 913 testRequires(c, SameHostDaemon, seccompEnabled, NotArm, Apparmor) 914 jsonData := `{ 915 "defaultAction": "SCMP_ACT_ALLOW", 916 "syscalls": [ 917 { 918 "name": "unshare", 919 "action": "SCMP_ACT_ERRNO" 920 } 921 ] 922 }` 923 tmpFile, err := ioutil.TempFile("", "profile.json") 924 if err != nil { 925 c.Fatal(err) 926 } 927 defer tmpFile.Close() 928 929 if _, err := tmpFile.Write([]byte(jsonData)); err != nil { 930 c.Fatal(err) 931 } 932 icmd.RunCommand(dockerBinary, "run", "--security-opt", "apparmor=unconfined", 933 "--security-opt", "seccomp="+tmpFile.Name(), 934 "debian:jessie", "unshare", "-p", "-m", "-f", "-r", "mount", "-t", "proc", "none", "/proc").Assert(c, icmd.Expected{ 935 ExitCode: 1, 936 Err: "Operation not permitted", 937 }) 938 } 939 940 // TestRunSeccompProfileDenyChmod checks that 'docker run --security-opt seccomp=/tmp/profile.json busybox chmod 400 /etc/hostname' exits with operation not permitted. 941 func (s *DockerSuite) TestRunSeccompProfileDenyChmod(c *check.C) { 942 testRequires(c, SameHostDaemon, seccompEnabled) 943 jsonData := `{ 944 "defaultAction": "SCMP_ACT_ALLOW", 945 "syscalls": [ 946 { 947 "name": "chmod", 948 "action": "SCMP_ACT_ERRNO" 949 }, 950 { 951 "name":"fchmod", 952 "action": "SCMP_ACT_ERRNO" 953 }, 954 { 955 "name": "fchmodat", 956 "action":"SCMP_ACT_ERRNO" 957 } 958 ] 959 }` 960 tmpFile, err := ioutil.TempFile("", "profile.json") 961 c.Assert(err, check.IsNil) 962 defer tmpFile.Close() 963 964 if _, err := tmpFile.Write([]byte(jsonData)); err != nil { 965 c.Fatal(err) 966 } 967 icmd.RunCommand(dockerBinary, "run", "--security-opt", "seccomp="+tmpFile.Name(), 968 "busybox", "chmod", "400", "/etc/hostname").Assert(c, icmd.Expected{ 969 ExitCode: 1, 970 Err: "Operation not permitted", 971 }) 972 } 973 974 // TestRunSeccompProfileDenyUnshareUserns checks that 'docker run debian:jessie unshare --map-root-user --user sh -c whoami' with a specific profile to 975 // deny unshare of a userns exits with operation not permitted. 976 func (s *DockerSuite) TestRunSeccompProfileDenyUnshareUserns(c *check.C) { 977 testRequires(c, SameHostDaemon, seccompEnabled, NotArm, Apparmor) 978 // from sched.h 979 jsonData := fmt.Sprintf(`{ 980 "defaultAction": "SCMP_ACT_ALLOW", 981 "syscalls": [ 982 { 983 "name": "unshare", 984 "action": "SCMP_ACT_ERRNO", 985 "args": [ 986 { 987 "index": 0, 988 "value": %d, 989 "op": "SCMP_CMP_EQ" 990 } 991 ] 992 } 993 ] 994 }`, uint64(0x10000000)) 995 tmpFile, err := ioutil.TempFile("", "profile.json") 996 if err != nil { 997 c.Fatal(err) 998 } 999 defer tmpFile.Close() 1000 1001 if _, err := tmpFile.Write([]byte(jsonData)); err != nil { 1002 c.Fatal(err) 1003 } 1004 icmd.RunCommand(dockerBinary, "run", 1005 "--security-opt", "apparmor=unconfined", "--security-opt", "seccomp="+tmpFile.Name(), 1006 "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami").Assert(c, icmd.Expected{ 1007 ExitCode: 1, 1008 Err: "Operation not permitted", 1009 }) 1010 } 1011 1012 // TestRunSeccompProfileDenyUnusualSocketFamilies checks that rarely used socket families such as Appletalk are blocked by the default profile 1013 func (s *DockerSuite) TestRunSeccompProfileDenyUnusualSocketFamilies(c *check.C) { 1014 testRequires(c, SameHostDaemon, seccompEnabled) 1015 ensureSyscallTest(c) 1016 1017 runCmd := exec.Command(dockerBinary, "run", "syscall-test", "appletalk-test") 1018 _, _, err := runCommandWithOutput(runCmd) 1019 if err != nil { 1020 c.Fatal("expected opening appletalk socket family to fail") 1021 } 1022 } 1023 1024 // TestRunSeccompProfileDenyCloneUserns checks that 'docker run syscall-test' 1025 // with a the default seccomp profile exits with operation not permitted. 1026 func (s *DockerSuite) TestRunSeccompProfileDenyCloneUserns(c *check.C) { 1027 testRequires(c, SameHostDaemon, seccompEnabled) 1028 ensureSyscallTest(c) 1029 1030 icmd.RunCommand(dockerBinary, "run", "syscall-test", "userns-test", "id").Assert(c, icmd.Expected{ 1031 ExitCode: 1, 1032 Err: "clone failed: Operation not permitted", 1033 }) 1034 } 1035 1036 // TestRunSeccompUnconfinedCloneUserns checks that 1037 // 'docker run --security-opt seccomp=unconfined syscall-test' allows creating a userns. 1038 func (s *DockerSuite) TestRunSeccompUnconfinedCloneUserns(c *check.C) { 1039 testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace, unprivilegedUsernsClone) 1040 ensureSyscallTest(c) 1041 1042 // make sure running w privileged is ok 1043 icmd.RunCommand(dockerBinary, "run", "--security-opt", "seccomp=unconfined", 1044 "syscall-test", "userns-test", "id").Assert(c, icmd.Expected{ 1045 Out: "nobody", 1046 }) 1047 } 1048 1049 // TestRunSeccompAllowPrivCloneUserns checks that 'docker run --privileged syscall-test' 1050 // allows creating a userns. 1051 func (s *DockerSuite) TestRunSeccompAllowPrivCloneUserns(c *check.C) { 1052 testRequires(c, SameHostDaemon, seccompEnabled, UserNamespaceInKernel, NotUserNamespace) 1053 ensureSyscallTest(c) 1054 1055 // make sure running w privileged is ok 1056 icmd.RunCommand(dockerBinary, "run", "--privileged", "syscall-test", "userns-test", "id").Assert(c, icmd.Expected{ 1057 Out: "nobody", 1058 }) 1059 } 1060 1061 // TestRunSeccompProfileAllow32Bit checks that 32 bit code can run on x86_64 1062 // with the default seccomp profile. 1063 func (s *DockerSuite) TestRunSeccompProfileAllow32Bit(c *check.C) { 1064 testRequires(c, SameHostDaemon, seccompEnabled, IsAmd64) 1065 ensureSyscallTest(c) 1066 1067 icmd.RunCommand(dockerBinary, "run", "syscall-test", "exit32-test", "id").Assert(c, icmd.Success) 1068 } 1069 1070 // TestRunSeccompAllowSetrlimit checks that 'docker run debian:jessie ulimit -v 1048510' succeeds. 1071 func (s *DockerSuite) TestRunSeccompAllowSetrlimit(c *check.C) { 1072 testRequires(c, SameHostDaemon, seccompEnabled) 1073 1074 // ulimit uses setrlimit, so we want to make sure we don't break it 1075 icmd.RunCommand(dockerBinary, "run", "debian:jessie", "bash", "-c", "ulimit -v 1048510").Assert(c, icmd.Success) 1076 } 1077 1078 func (s *DockerSuite) TestRunSeccompDefaultProfileAcct(c *check.C) { 1079 testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace) 1080 ensureSyscallTest(c) 1081 1082 out, _, err := dockerCmdWithError("run", "syscall-test", "acct-test") 1083 if err == nil || !strings.Contains(out, "Operation not permitted") { 1084 c.Fatalf("test 0: expected Operation not permitted, got: %s", out) 1085 } 1086 1087 out, _, err = dockerCmdWithError("run", "--cap-add", "sys_admin", "syscall-test", "acct-test") 1088 if err == nil || !strings.Contains(out, "Operation not permitted") { 1089 c.Fatalf("test 1: expected Operation not permitted, got: %s", out) 1090 } 1091 1092 out, _, err = dockerCmdWithError("run", "--cap-add", "sys_pacct", "syscall-test", "acct-test") 1093 if err == nil || !strings.Contains(out, "No such file or directory") { 1094 c.Fatalf("test 2: expected No such file or directory, got: %s", out) 1095 } 1096 1097 out, _, err = dockerCmdWithError("run", "--cap-add", "ALL", "syscall-test", "acct-test") 1098 if err == nil || !strings.Contains(out, "No such file or directory") { 1099 c.Fatalf("test 3: expected No such file or directory, got: %s", out) 1100 } 1101 1102 out, _, err = dockerCmdWithError("run", "--cap-drop", "ALL", "--cap-add", "sys_pacct", "syscall-test", "acct-test") 1103 if err == nil || !strings.Contains(out, "No such file or directory") { 1104 c.Fatalf("test 4: expected No such file or directory, got: %s", out) 1105 } 1106 } 1107 1108 func (s *DockerSuite) TestRunSeccompDefaultProfileNS(c *check.C) { 1109 testRequires(c, SameHostDaemon, seccompEnabled, NotUserNamespace) 1110 ensureSyscallTest(c) 1111 1112 out, _, err := dockerCmdWithError("run", "syscall-test", "ns-test", "echo", "hello0") 1113 if err == nil || !strings.Contains(out, "Operation not permitted") { 1114 c.Fatalf("test 0: expected Operation not permitted, got: %s", out) 1115 } 1116 1117 out, _, err = dockerCmdWithError("run", "--cap-add", "sys_admin", "syscall-test", "ns-test", "echo", "hello1") 1118 if err != nil || !strings.Contains(out, "hello1") { 1119 c.Fatalf("test 1: expected hello1, got: %s, %v", out, err) 1120 } 1121 1122 out, _, err = dockerCmdWithError("run", "--cap-drop", "all", "--cap-add", "sys_admin", "syscall-test", "ns-test", "echo", "hello2") 1123 if err != nil || !strings.Contains(out, "hello2") { 1124 c.Fatalf("test 2: expected hello2, got: %s, %v", out, err) 1125 } 1126 1127 out, _, err = dockerCmdWithError("run", "--cap-add", "ALL", "syscall-test", "ns-test", "echo", "hello3") 1128 if err != nil || !strings.Contains(out, "hello3") { 1129 c.Fatalf("test 3: expected hello3, got: %s, %v", out, err) 1130 } 1131 1132 out, _, err = dockerCmdWithError("run", "--cap-add", "ALL", "--security-opt", "seccomp=unconfined", "syscall-test", "acct-test") 1133 if err == nil || !strings.Contains(out, "No such file or directory") { 1134 c.Fatalf("test 4: expected No such file or directory, got: %s", out) 1135 } 1136 1137 out, _, err = dockerCmdWithError("run", "--cap-add", "ALL", "--security-opt", "seccomp=unconfined", "syscall-test", "ns-test", "echo", "hello4") 1138 if err != nil || !strings.Contains(out, "hello4") { 1139 c.Fatalf("test 5: expected hello4, got: %s, %v", out, err) 1140 } 1141 } 1142 1143 // TestRunNoNewPrivSetuid checks that --security-opt='no-new-privileges=true' prevents 1144 // effective uid transtions on executing setuid binaries. 1145 func (s *DockerSuite) TestRunNoNewPrivSetuid(c *check.C) { 1146 testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon) 1147 ensureNNPTest(c) 1148 1149 // test that running a setuid binary results in no effective uid transition 1150 icmd.RunCommand(dockerBinary, "run", "--security-opt", "no-new-privileges=true", "--user", "1000", 1151 "nnp-test", "/usr/bin/nnp-test").Assert(c, icmd.Expected{ 1152 Out: "EUID=1000", 1153 }) 1154 } 1155 1156 // TestLegacyRunNoNewPrivSetuid checks that --security-opt=no-new-privileges prevents 1157 // effective uid transtions on executing setuid binaries. 1158 func (s *DockerSuite) TestLegacyRunNoNewPrivSetuid(c *check.C) { 1159 testRequires(c, DaemonIsLinux, NotUserNamespace, SameHostDaemon) 1160 ensureNNPTest(c) 1161 1162 // test that running a setuid binary results in no effective uid transition 1163 icmd.RunCommand(dockerBinary, "run", "--security-opt", "no-new-privileges", "--user", "1000", 1164 "nnp-test", "/usr/bin/nnp-test").Assert(c, icmd.Expected{ 1165 Out: "EUID=1000", 1166 }) 1167 } 1168 1169 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChown(c *check.C) { 1170 testRequires(c, DaemonIsLinux) 1171 ensureSyscallTest(c) 1172 1173 // test that a root user has default capability CAP_CHOWN 1174 dockerCmd(c, "run", "busybox", "chown", "100", "/tmp") 1175 // test that non root user does not have default capability CAP_CHOWN 1176 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chown", "100", "/tmp").Assert(c, icmd.Expected{ 1177 ExitCode: 1, 1178 Err: "Operation not permitted", 1179 }) 1180 // test that root user can drop default capability CAP_CHOWN 1181 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "chown", "busybox", "chown", "100", "/tmp").Assert(c, icmd.Expected{ 1182 ExitCode: 1, 1183 Err: "Operation not permitted", 1184 }) 1185 } 1186 1187 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesDacOverride(c *check.C) { 1188 testRequires(c, DaemonIsLinux) 1189 ensureSyscallTest(c) 1190 1191 // test that a root user has default capability CAP_DAC_OVERRIDE 1192 dockerCmd(c, "run", "busybox", "sh", "-c", "echo test > /etc/passwd") 1193 // test that non root user does not have default capability CAP_DAC_OVERRIDE 1194 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "sh", "-c", "echo test > /etc/passwd").Assert(c, icmd.Expected{ 1195 ExitCode: 1, 1196 Err: "Permission denied", 1197 }) 1198 } 1199 1200 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesFowner(c *check.C) { 1201 testRequires(c, DaemonIsLinux) 1202 ensureSyscallTest(c) 1203 1204 // test that a root user has default capability CAP_FOWNER 1205 dockerCmd(c, "run", "busybox", "chmod", "777", "/etc/passwd") 1206 // test that non root user does not have default capability CAP_FOWNER 1207 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chmod", "777", "/etc/passwd").Assert(c, icmd.Expected{ 1208 ExitCode: 1, 1209 Err: "Operation not permitted", 1210 }) 1211 // TODO test that root user can drop default capability CAP_FOWNER 1212 } 1213 1214 // TODO CAP_KILL 1215 1216 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetuid(c *check.C) { 1217 testRequires(c, DaemonIsLinux) 1218 ensureSyscallTest(c) 1219 1220 // test that a root user has default capability CAP_SETUID 1221 dockerCmd(c, "run", "syscall-test", "setuid-test") 1222 // test that non root user does not have default capability CAP_SETUID 1223 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "setuid-test").Assert(c, icmd.Expected{ 1224 ExitCode: 1, 1225 Err: "Operation not permitted", 1226 }) 1227 // test that root user can drop default capability CAP_SETUID 1228 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "setuid", "syscall-test", "setuid-test").Assert(c, icmd.Expected{ 1229 ExitCode: 1, 1230 Err: "Operation not permitted", 1231 }) 1232 } 1233 1234 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesSetgid(c *check.C) { 1235 testRequires(c, DaemonIsLinux) 1236 ensureSyscallTest(c) 1237 1238 // test that a root user has default capability CAP_SETGID 1239 dockerCmd(c, "run", "syscall-test", "setgid-test") 1240 // test that non root user does not have default capability CAP_SETGID 1241 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "setgid-test").Assert(c, icmd.Expected{ 1242 ExitCode: 1, 1243 Err: "Operation not permitted", 1244 }) 1245 // test that root user can drop default capability CAP_SETGID 1246 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "setgid", "syscall-test", "setgid-test").Assert(c, icmd.Expected{ 1247 ExitCode: 1, 1248 Err: "Operation not permitted", 1249 }) 1250 } 1251 1252 // TODO CAP_SETPCAP 1253 1254 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetBindService(c *check.C) { 1255 testRequires(c, DaemonIsLinux) 1256 ensureSyscallTest(c) 1257 1258 // test that a root user has default capability CAP_NET_BIND_SERVICE 1259 dockerCmd(c, "run", "syscall-test", "socket-test") 1260 // test that non root user does not have default capability CAP_NET_BIND_SERVICE 1261 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "socket-test").Assert(c, icmd.Expected{ 1262 ExitCode: 1, 1263 Err: "Permission denied", 1264 }) 1265 // test that root user can drop default capability CAP_NET_BIND_SERVICE 1266 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "net_bind_service", "syscall-test", "socket-test").Assert(c, icmd.Expected{ 1267 ExitCode: 1, 1268 Err: "Permission denied", 1269 }) 1270 } 1271 1272 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesNetRaw(c *check.C) { 1273 testRequires(c, DaemonIsLinux) 1274 ensureSyscallTest(c) 1275 1276 // test that a root user has default capability CAP_NET_RAW 1277 dockerCmd(c, "run", "syscall-test", "raw-test") 1278 // test that non root user does not have default capability CAP_NET_RAW 1279 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "syscall-test", "raw-test").Assert(c, icmd.Expected{ 1280 ExitCode: 1, 1281 Err: "Operation not permitted", 1282 }) 1283 // test that root user can drop default capability CAP_NET_RAW 1284 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "net_raw", "syscall-test", "raw-test").Assert(c, icmd.Expected{ 1285 ExitCode: 1, 1286 Err: "Operation not permitted", 1287 }) 1288 } 1289 1290 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesChroot(c *check.C) { 1291 testRequires(c, DaemonIsLinux) 1292 ensureSyscallTest(c) 1293 1294 // test that a root user has default capability CAP_SYS_CHROOT 1295 dockerCmd(c, "run", "busybox", "chroot", "/", "/bin/true") 1296 // test that non root user does not have default capability CAP_SYS_CHROOT 1297 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "chroot", "/", "/bin/true").Assert(c, icmd.Expected{ 1298 ExitCode: 1, 1299 Err: "Operation not permitted", 1300 }) 1301 // test that root user can drop default capability CAP_SYS_CHROOT 1302 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "sys_chroot", "busybox", "chroot", "/", "/bin/true").Assert(c, icmd.Expected{ 1303 ExitCode: 1, 1304 Err: "Operation not permitted", 1305 }) 1306 } 1307 1308 func (s *DockerSuite) TestUserNoEffectiveCapabilitiesMknod(c *check.C) { 1309 testRequires(c, DaemonIsLinux, NotUserNamespace) 1310 ensureSyscallTest(c) 1311 1312 // test that a root user has default capability CAP_MKNOD 1313 dockerCmd(c, "run", "busybox", "mknod", "/tmp/node", "b", "1", "2") 1314 // test that non root user does not have default capability CAP_MKNOD 1315 // test that root user can drop default capability CAP_SYS_CHROOT 1316 icmd.RunCommand(dockerBinary, "run", "--user", "1000:1000", "busybox", "mknod", "/tmp/node", "b", "1", "2").Assert(c, icmd.Expected{ 1317 ExitCode: 1, 1318 Err: "Operation not permitted", 1319 }) 1320 // test that root user can drop default capability CAP_MKNOD 1321 icmd.RunCommand(dockerBinary, "run", "--cap-drop", "mknod", "busybox", "mknod", "/tmp/node", "b", "1", "2").Assert(c, icmd.Expected{ 1322 ExitCode: 1, 1323 Err: "Operation not permitted", 1324 }) 1325 } 1326 1327 // TODO CAP_AUDIT_WRITE 1328 // TODO CAP_SETFCAP 1329 1330 func (s *DockerSuite) TestRunApparmorProcDirectory(c *check.C) { 1331 testRequires(c, SameHostDaemon, Apparmor) 1332 1333 // running w seccomp unconfined tests the apparmor profile 1334 result := icmd.RunCommand(dockerBinary, "run", "--security-opt", "seccomp=unconfined", "busybox", "chmod", "777", "/proc/1/cgroup") 1335 result.Assert(c, icmd.Expected{ExitCode: 1}) 1336 if !(strings.Contains(result.Combined(), "Permission denied") || strings.Contains(result.Combined(), "Operation not permitted")) { 1337 c.Fatalf("expected chmod 777 /proc/1/cgroup to fail, got %s: %v", result.Combined(), result.Error) 1338 } 1339 1340 result = icmd.RunCommand(dockerBinary, "run", "--security-opt", "seccomp=unconfined", "busybox", "chmod", "777", "/proc/1/attr/current") 1341 result.Assert(c, icmd.Expected{ExitCode: 1}) 1342 if !(strings.Contains(result.Combined(), "Permission denied") || strings.Contains(result.Combined(), "Operation not permitted")) { 1343 c.Fatalf("expected chmod 777 /proc/1/attr/current to fail, got %s: %v", result.Combined(), result.Error) 1344 } 1345 } 1346 1347 // make sure the default profile can be successfully parsed (using unshare as it is 1348 // something which we know is blocked in the default profile) 1349 func (s *DockerSuite) TestRunSeccompWithDefaultProfile(c *check.C) { 1350 testRequires(c, SameHostDaemon, seccompEnabled) 1351 1352 out, _, err := dockerCmdWithError("run", "--security-opt", "seccomp=../profiles/seccomp/default.json", "debian:jessie", "unshare", "--map-root-user", "--user", "sh", "-c", "whoami") 1353 c.Assert(err, checker.NotNil, check.Commentf(out)) 1354 c.Assert(strings.TrimSpace(out), checker.Equals, "unshare: unshare failed: Operation not permitted") 1355 } 1356 1357 // TestRunDeviceSymlink checks run with device that follows symlink (#13840 and #22271) 1358 func (s *DockerSuite) TestRunDeviceSymlink(c *check.C) { 1359 testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm, SameHostDaemon) 1360 if _, err := os.Stat("/dev/zero"); err != nil { 1361 c.Skip("Host does not have /dev/zero") 1362 } 1363 1364 // Create a temporary directory to create symlink 1365 tmpDir, err := ioutil.TempDir("", "docker_device_follow_symlink_tests") 1366 c.Assert(err, checker.IsNil) 1367 1368 defer os.RemoveAll(tmpDir) 1369 1370 // Create a symbolic link to /dev/zero 1371 symZero := filepath.Join(tmpDir, "zero") 1372 err = os.Symlink("/dev/zero", symZero) 1373 c.Assert(err, checker.IsNil) 1374 1375 // Create a temporary file "temp" inside tmpDir, write some data to "tmpDir/temp", 1376 // then create a symlink "tmpDir/file" to the temporary file "tmpDir/temp". 1377 tmpFile := filepath.Join(tmpDir, "temp") 1378 err = ioutil.WriteFile(tmpFile, []byte("temp"), 0666) 1379 c.Assert(err, checker.IsNil) 1380 symFile := filepath.Join(tmpDir, "file") 1381 err = os.Symlink(tmpFile, symFile) 1382 c.Assert(err, checker.IsNil) 1383 1384 // Create a symbolic link to /dev/zero, this time with a relative path (#22271) 1385 err = os.Symlink("zero", "/dev/symzero") 1386 if err != nil { 1387 c.Fatal("/dev/symzero creation failed") 1388 } 1389 // We need to remove this symbolic link here as it is created in /dev/, not temporary directory as above 1390 defer os.Remove("/dev/symzero") 1391 1392 // md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23 1393 out, _ := dockerCmd(c, "run", "--device", symZero+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum") 1394 c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "bb7df04e1b0a2570657527a7e108ae23", check.Commentf("expected output bb7df04e1b0a2570657527a7e108ae23")) 1395 1396 // symlink "tmpDir/file" to a file "tmpDir/temp" will result in an error as it is not a device. 1397 out, _, err = dockerCmdWithError("run", "--device", symFile+":/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum") 1398 c.Assert(err, check.NotNil) 1399 c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "not a device node", check.Commentf("expected output 'not a device node'")) 1400 1401 // md5sum of 'dd if=/dev/zero bs=4K count=8' is bb7df04e1b0a2570657527a7e108ae23 (this time check with relative path backed, see #22271) 1402 out, _ = dockerCmd(c, "run", "--device", "/dev/symzero:/dev/symzero", "busybox", "sh", "-c", "dd if=/dev/symzero bs=4K count=8 | md5sum") 1403 c.Assert(strings.Trim(out, "\r\n"), checker.Contains, "bb7df04e1b0a2570657527a7e108ae23", check.Commentf("expected output bb7df04e1b0a2570657527a7e108ae23")) 1404 } 1405 1406 // TestRunPIDsLimit makes sure the pids cgroup is set with --pids-limit 1407 func (s *DockerSuite) TestRunPIDsLimit(c *check.C) { 1408 testRequires(c, pidsLimit) 1409 1410 file := "/sys/fs/cgroup/pids/pids.max" 1411 out, _ := dockerCmd(c, "run", "--name", "skittles", "--pids-limit", "4", "busybox", "cat", file) 1412 c.Assert(strings.TrimSpace(out), checker.Equals, "4") 1413 1414 out = inspectField(c, "skittles", "HostConfig.PidsLimit") 1415 c.Assert(out, checker.Equals, "4", check.Commentf("setting the pids limit failed")) 1416 } 1417 1418 func (s *DockerSuite) TestRunPrivilegedAllowedDevices(c *check.C) { 1419 testRequires(c, DaemonIsLinux, NotUserNamespace) 1420 1421 file := "/sys/fs/cgroup/devices/devices.list" 1422 out, _ := dockerCmd(c, "run", "--privileged", "busybox", "cat", file) 1423 c.Logf("out: %q", out) 1424 c.Assert(strings.TrimSpace(out), checker.Equals, "a *:* rwm") 1425 } 1426 1427 func (s *DockerSuite) TestRunUserDeviceAllowed(c *check.C) { 1428 testRequires(c, DaemonIsLinux) 1429 1430 fi, err := os.Stat("/dev/snd/timer") 1431 if err != nil { 1432 c.Skip("Host does not have /dev/snd/timer") 1433 } 1434 stat, ok := fi.Sys().(*syscall.Stat_t) 1435 if !ok { 1436 c.Skip("Could not stat /dev/snd/timer") 1437 } 1438 1439 file := "/sys/fs/cgroup/devices/devices.list" 1440 out, _ := dockerCmd(c, "run", "--device", "/dev/snd/timer:w", "busybox", "cat", file) 1441 c.Assert(out, checker.Contains, fmt.Sprintf("c %d:%d w", stat.Rdev/256, stat.Rdev%256)) 1442 } 1443 1444 func (s *DockerDaemonSuite) TestRunSeccompJSONNewFormat(c *check.C) { 1445 testRequires(c, SameHostDaemon, seccompEnabled) 1446 1447 s.d.StartWithBusybox(c) 1448 1449 jsonData := `{ 1450 "defaultAction": "SCMP_ACT_ALLOW", 1451 "syscalls": [ 1452 { 1453 "names": ["chmod", "fchmod", "fchmodat"], 1454 "action": "SCMP_ACT_ERRNO" 1455 } 1456 ] 1457 }` 1458 tmpFile, err := ioutil.TempFile("", "profile.json") 1459 c.Assert(err, check.IsNil) 1460 defer tmpFile.Close() 1461 _, err = tmpFile.Write([]byte(jsonData)) 1462 c.Assert(err, check.IsNil) 1463 1464 out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".") 1465 c.Assert(err, check.NotNil) 1466 c.Assert(out, checker.Contains, "Operation not permitted") 1467 } 1468 1469 func (s *DockerDaemonSuite) TestRunSeccompJSONNoNameAndNames(c *check.C) { 1470 testRequires(c, SameHostDaemon, seccompEnabled) 1471 1472 s.d.StartWithBusybox(c) 1473 1474 jsonData := `{ 1475 "defaultAction": "SCMP_ACT_ALLOW", 1476 "syscalls": [ 1477 { 1478 "name": "chmod", 1479 "names": ["fchmod", "fchmodat"], 1480 "action": "SCMP_ACT_ERRNO" 1481 } 1482 ] 1483 }` 1484 tmpFile, err := ioutil.TempFile("", "profile.json") 1485 c.Assert(err, check.IsNil) 1486 defer tmpFile.Close() 1487 _, err = tmpFile.Write([]byte(jsonData)) 1488 c.Assert(err, check.IsNil) 1489 1490 out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".") 1491 c.Assert(err, check.NotNil) 1492 c.Assert(out, checker.Contains, "'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'") 1493 } 1494 1495 func (s *DockerDaemonSuite) TestRunSeccompJSONNoArchAndArchMap(c *check.C) { 1496 testRequires(c, SameHostDaemon, seccompEnabled) 1497 1498 s.d.StartWithBusybox(c) 1499 1500 jsonData := `{ 1501 "archMap": [ 1502 { 1503 "architecture": "SCMP_ARCH_X86_64", 1504 "subArchitectures": [ 1505 "SCMP_ARCH_X86", 1506 "SCMP_ARCH_X32" 1507 ] 1508 } 1509 ], 1510 "architectures": [ 1511 "SCMP_ARCH_X32" 1512 ], 1513 "defaultAction": "SCMP_ACT_ALLOW", 1514 "syscalls": [ 1515 { 1516 "names": ["chmod", "fchmod", "fchmodat"], 1517 "action": "SCMP_ACT_ERRNO" 1518 } 1519 ] 1520 }` 1521 tmpFile, err := ioutil.TempFile("", "profile.json") 1522 c.Assert(err, check.IsNil) 1523 defer tmpFile.Close() 1524 _, err = tmpFile.Write([]byte(jsonData)) 1525 c.Assert(err, check.IsNil) 1526 1527 out, err := s.d.Cmd("run", "--security-opt", "seccomp="+tmpFile.Name(), "busybox", "chmod", "777", ".") 1528 c.Assert(err, check.NotNil) 1529 c.Assert(out, checker.Contains, "'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'") 1530 } 1531 1532 func (s *DockerDaemonSuite) TestRunWithDaemonDefaultSeccompProfile(c *check.C) { 1533 testRequires(c, SameHostDaemon, seccompEnabled) 1534 1535 s.d.StartWithBusybox(c) 1536 1537 // 1) verify I can run containers with the Docker default shipped profile which allows chmod 1538 _, err := s.d.Cmd("run", "busybox", "chmod", "777", ".") 1539 c.Assert(err, check.IsNil) 1540 1541 jsonData := `{ 1542 "defaultAction": "SCMP_ACT_ALLOW", 1543 "syscalls": [ 1544 { 1545 "name": "chmod", 1546 "action": "SCMP_ACT_ERRNO" 1547 } 1548 ] 1549 }` 1550 tmpFile, err := ioutil.TempFile("", "profile.json") 1551 c.Assert(err, check.IsNil) 1552 defer tmpFile.Close() 1553 _, err = tmpFile.Write([]byte(jsonData)) 1554 c.Assert(err, check.IsNil) 1555 1556 // 2) restart the daemon and add a custom seccomp profile in which we deny chmod 1557 s.d.Restart(c, "--seccomp-profile="+tmpFile.Name()) 1558 1559 out, err := s.d.Cmd("run", "busybox", "chmod", "777", ".") 1560 c.Assert(err, check.NotNil) 1561 c.Assert(out, checker.Contains, "Operation not permitted") 1562 } 1563 1564 func (s *DockerSuite) TestRunWithNanoCPUs(c *check.C) { 1565 testRequires(c, cpuCfsQuota, cpuCfsPeriod) 1566 1567 file1 := "/sys/fs/cgroup/cpu/cpu.cfs_quota_us" 1568 file2 := "/sys/fs/cgroup/cpu/cpu.cfs_period_us" 1569 out, _ := dockerCmd(c, "run", "--cpus", "0.5", "--name", "test", "busybox", "sh", "-c", fmt.Sprintf("cat %s && cat %s", file1, file2)) 1570 c.Assert(strings.TrimSpace(out), checker.Equals, "50000\n100000") 1571 1572 out = inspectField(c, "test", "HostConfig.NanoCpus") 1573 c.Assert(out, checker.Equals, "5e+08", check.Commentf("setting the Nano CPUs failed")) 1574 out = inspectField(c, "test", "HostConfig.CpuQuota") 1575 c.Assert(out, checker.Equals, "0", check.Commentf("CPU CFS quota should be 0")) 1576 out = inspectField(c, "test", "HostConfig.CpuPeriod") 1577 c.Assert(out, checker.Equals, "0", check.Commentf("CPU CFS period should be 0")) 1578 1579 out, _, err := dockerCmdWithError("run", "--cpus", "0.5", "--cpu-quota", "50000", "--cpu-period", "100000", "busybox", "sh") 1580 c.Assert(err, check.NotNil) 1581 c.Assert(out, checker.Contains, "Conflicting options: Nano CPUs and CPU Period cannot both be set") 1582 }