github.com/uriddle/docker@v0.0.0-20210926094723-4072e6aeb013/integration-cli/docker_cli_experimental_test.go (about)

     1  // +build experimental
     2  
     3  package main
     4  
     5  import (
     6  	"fmt"
     7  	"io/ioutil"
     8  	"os"
     9  	"os/exec"
    10  	"path/filepath"
    11  	"strconv"
    12  	"strings"
    13  
    14  	"github.com/docker/docker/pkg/integration/checker"
    15  	"github.com/docker/docker/pkg/system"
    16  	"github.com/go-check/check"
    17  )
    18  
    19  func (s *DockerSuite) TestExperimentalVersion(c *check.C) {
    20  	out, _ := dockerCmd(c, "version")
    21  	for _, line := range strings.Split(out, "\n") {
    22  		if strings.HasPrefix(line, "Experimental (client):") || strings.HasPrefix(line, "Experimental (server):") {
    23  			c.Assert(line, checker.Matches, "*true")
    24  		}
    25  	}
    26  
    27  	out, _ = dockerCmd(c, "-v")
    28  	c.Assert(out, checker.Contains, ", experimental", check.Commentf("docker version did not contain experimental"))
    29  }
    30  
    31  // user namespaces test: run daemon with remapped root setting
    32  // 1. validate uid/gid maps are set properly
    33  // 2. verify that files created are owned by remapped root
    34  func (s *DockerDaemonSuite) TestDaemonUserNamespaceRootSetting(c *check.C) {
    35  	testRequires(c, DaemonIsLinux, SameHostDaemon)
    36  
    37  	c.Assert(s.d.StartWithBusybox("--userns-remap", "default"), checker.IsNil)
    38  
    39  	tmpDir, err := ioutil.TempDir("", "userns")
    40  	c.Assert(err, checker.IsNil)
    41  	defer os.RemoveAll(tmpDir)
    42  
    43  	// we need to find the uid and gid of the remapped root from the daemon's root dir info
    44  	uidgid := strings.Split(filepath.Base(s.d.root), ".")
    45  	c.Assert(uidgid, checker.HasLen, 2, check.Commentf("Should have gotten uid/gid strings from root dirname: %s", filepath.Base(s.d.root)))
    46  	uid, err := strconv.Atoi(uidgid[0])
    47  	c.Assert(err, checker.IsNil, check.Commentf("Can't parse uid"))
    48  	gid, err := strconv.Atoi(uidgid[1])
    49  	c.Assert(err, checker.IsNil, check.Commentf("Can't parse gid"))
    50  
    51  	//writeable by the remapped root UID/GID pair
    52  	c.Assert(os.Chown(tmpDir, uid, gid), checker.IsNil)
    53  
    54  	out, err := s.d.Cmd("run", "-d", "--name", "userns", "-v", tmpDir+":/goofy", "busybox", "sh", "-c", "touch /goofy/testfile; top")
    55  	c.Assert(err, checker.IsNil, check.Commentf("Output: %s", out))
    56  
    57  	pid, err := s.d.Cmd("inspect", "--format='{{.State.Pid}}'", "userns")
    58  	c.Assert(err, checker.IsNil, check.Commentf("Could not inspect running container: out: %q", pid))
    59  	// check the uid and gid maps for the PID to ensure root is remapped
    60  	// (cmd = cat /proc/<pid>/uid_map | grep -E '0\s+9999\s+1')
    61  	out, rc1, err := runCommandPipelineWithOutput(
    62  		exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/uid_map"),
    63  		exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", uid)))
    64  	c.Assert(rc1, checker.Equals, 0, check.Commentf("Didn't match uid_map: output: %s", out))
    65  
    66  	out, rc2, err := runCommandPipelineWithOutput(
    67  		exec.Command("cat", "/proc/"+strings.TrimSpace(pid)+"/gid_map"),
    68  		exec.Command("grep", "-E", fmt.Sprintf("0[[:space:]]+%d[[:space:]]+", gid)))
    69  	c.Assert(rc2, checker.Equals, 0, check.Commentf("Didn't match gid_map: output: %s", out))
    70  
    71  	// check that the touched file is owned by remapped uid:gid
    72  	stat, err := system.Stat(filepath.Join(tmpDir, "testfile"))
    73  	c.Assert(err, checker.IsNil)
    74  	c.Assert(stat.UID(), checker.Equals, uint32(uid), check.Commentf("Touched file not owned by remapped root UID"))
    75  	c.Assert(stat.GID(), checker.Equals, uint32(gid), check.Commentf("Touched file not owned by remapped root GID"))
    76  }