Skip to content

Commit a52db3e

Browse files
author
Renaud Gaubert
committed
Add integration tests for the new runc hooks
This patch adds a test based on real world usage of runc hooks (libnvidia-container). We verify that mounting a library inside a container and running ldconfig succeeds. Signed-off-by: Renaud Gaubert <[email protected]>
1 parent c29382c commit a52db3e

File tree

5 files changed

+151
-12
lines changed

5 files changed

+151
-12
lines changed

Dockerfile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,19 @@ RUN mkdir -p /usr/src/criu \
6767
&& cd - \
6868
&& rm -rf /usr/src/criu
6969

70+
# install skopeo
71+
RUN echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list \
72+
&& wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O- | sudo apt-key add - \
73+
&& apt-get update \
74+
&& apt-get install -y --no-install-recommends skopeo \
75+
&& rm -rf /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list \
76+
&& apt-get clean \
77+
&& rm -rf /var/cache/apt /var/lib/apt/lists/*;
78+
79+
# install umoci
80+
RUN curl -o /usr/local/bin/umoci -fsSL https://github.com/openSUSE/umoci/releases/download/v0.4.5/umoci.amd64 \
81+
&& chmod +x /usr/local/bin/umoci
82+
7083
COPY script/tmpmount /
7184
WORKDIR /go/src/github.com/opencontainers/runc
7285
ENTRYPOINT ["/tmpmount"]
@@ -78,4 +91,9 @@ RUN mkdir -p "${ROOTFS}"
7891
RUN . tests/integration/multi-arch.bash \
7992
&& curl -fsSL `get_busybox` | tar xfJC - "${ROOTFS}"
8093

94+
ENV DEBIAN_ROOTFS /debian
95+
RUN mkdir -p "${DEBIAN_ROOTFS}"
96+
RUN . tests/integration/multi-arch.bash \
97+
&& get_and_extract_debian "$DEBIAN_ROOTFS"
98+
8199
COPY . .

Vagrantfile.fedora32

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ Vagrant.configure("2") do |config|
1717
config exclude kernel,kernel-core
1818
config install_weak_deps false
1919
update
20-
install iptables gcc make golang-go libseccomp-devel bats jq git-core criu
20+
install iptables gcc make golang-go libseccomp-devel bats jq git-core criu skopeo
2121
ts run
2222
EOF
2323
dnf clean all
@@ -31,10 +31,15 @@ EOF
3131
cat /root/rootless.key.pub >> /home/rootless/.ssh/authorized_keys
3232
chown -R rootless.rootless /home/rootless
3333
34+
# Install umoci
35+
curl -o /usr/local/bin/umoci -fsSL https://github.com/openSUSE/umoci/releases/download/v0.4.5/umoci.amd64
36+
chmod +x /usr/local/bin/umoci
37+
3438
# Add busybox for libcontainer/integration tests
3539
. /vagrant/tests/integration/multi-arch.bash \
36-
&& mkdir /busybox \
37-
&& curl -fsSL $(get_busybox) | tar xfJC - /busybox
40+
&& mkdir /busybox /debian \
41+
&& curl -fsSL $(get_busybox) | tar xfJC - /busybox \
42+
&& get_and_extract_debian /debian
3843
3944
# Delegate cgroup v2 controllers to rootless user via --systemd-cgroup
4045
mkdir -p /etc/systemd/system/[email protected]

tests/integration/helpers.bash

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ HELLO_FILE=`get_hello`
2121
HELLO_IMAGE="$TESTDATA/$HELLO_FILE"
2222
HELLO_BUNDLE="$BATS_TMPDIR/hello-world"
2323

24+
# debian image
25+
DEBIAN_BUNDLE="$BATS_TMPDIR/debiantest"
26+
2427
# CRIU PATH
2528
CRIU="$(which criu 2>/dev/null || true)"
2629

@@ -422,6 +425,27 @@ function setup_hello() {
422425
update_config '(.. | select(.? == "sh")) |= "/hello"'
423426
}
424427

428+
function setup_debian() {
429+
# skopeo and umoci are not installed on the travis runner
430+
if [ -n "${RUNC_USE_SYSTEMD}" ]; then
431+
return
432+
fi
433+
434+
setup_recvtty
435+
run mkdir "$DEBIAN_BUNDLE"
436+
437+
if [ ! -d "$DEBIAN_ROOTFS/rootfs" ]; then
438+
get_and_extract_debian "$DEBIAN_BUNDLE"
439+
fi
440+
441+
# Use the cached version
442+
if [ ! -d "$DEBIAN_BUNDLE/rootfs" ]; then
443+
cp -r "$DEBIAN_ROOTFS"/* "$DEBIAN_BUNDLE/"
444+
fi
445+
446+
cd "$DEBIAN_BUNDLE"
447+
}
448+
425449
function teardown_running_container() {
426450
runc list
427451
# $1 should be a container name such as "test_busybox"
@@ -459,3 +483,10 @@ function teardown_hello() {
459483
teardown_running_container test_hello
460484
run rm -f -r "$HELLO_BUNDLE"
461485
}
486+
487+
function teardown_debian() {
488+
cd "$INTEGRATION_ROOT"
489+
teardown_recvtty
490+
teardown_running_container test_debian
491+
run rm -f -r "$DEBIAN_BUNDLE"
492+
}

tests/integration/hooks.bats

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/usr/bin/env bats
2+
3+
load helpers
4+
5+
# CR = CreateRuntime
6+
# CC = CreataContainer
7+
HOOKLIBCR=librunc-hooks-create-runtime.so
8+
HOOKLIBCC=librunc-hooks-create-container.so
9+
LIBPATH="$DEBIAN_BUNDLE/rootfs/lib/"
10+
11+
function setup() {
12+
umount $LIBPATH/$HOOKLIBCR.1.0.0 &> /dev/null || true
13+
umount $LIBPATH/$HOOKLIBCC.1.0.0 &> /dev/null || true
14+
15+
teardown_debian
16+
setup_debian
17+
}
18+
19+
function teardown() {
20+
umount $LIBPATH/$HOOKLIBCR.1.0.0 &> /dev/null || true
21+
umount $LIBPATH/$HOOKLIBCC.1.0.0 &> /dev/null || true
22+
23+
rm -f $HOOKLIBCR.1.0.0 $HOOKLIBCC.1.0.0
24+
teardown_debian
25+
}
26+
27+
@test "runc run (hooks library tests)" {
28+
requires root
29+
requires no_systemd
30+
31+
# setup some dummy libs
32+
gcc -shared -Wl,-soname,librunc-hooks-create-runtime.so.1 -o "$HOOKLIBCR.1.0.0"
33+
gcc -shared -Wl,-soname,librunc-hooks-create-container.so.1 -o "$HOOKLIBCC.1.0.0"
34+
35+
current_pwd="$(pwd)"
36+
37+
# To mount $HOOKLIBCR we need to do that in the container namespace
38+
create_runtime_hook=$(cat <<-EOF
39+
pid=\$(cat - | jq -r '.pid')
40+
touch "$LIBPATH/$HOOKLIBCR.1.0.0"
41+
nsenter -m \$ns -t \$pid mount --bind "$current_pwd/$HOOKLIBCR.1.0.0" "$LIBPATH/$HOOKLIBCR.1.0.0"
42+
EOF)
43+
44+
create_container_hook="touch ./lib/$HOOKLIBCC.1.0.0 && mount --bind $current_pwd/$HOOKLIBCC.1.0.0 ./lib/$HOOKLIBCC.1.0.0"
45+
46+
CONFIG=$(jq --arg create_runtime_hook "$create_runtime_hook" --arg create_container_hook "$create_container_hook" '
47+
.hooks |= . + {"createRuntime": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", $create_runtime_hook]}]} |
48+
.hooks |= . + {"createContainer": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", $create_container_hook]}]} |
49+
.hooks |= . + {"startContainer": [{"path": "/bin/sh", "args": ["/bin/sh", "-c", "ldconfig"]}]} |
50+
.process.args = ["/bin/sh", "-c", "ldconfig -p | grep librunc"]' $DEBIAN_BUNDLE/config.json)
51+
echo "${CONFIG}" > config.json
52+
53+
runc run test_debian
54+
[ "$status" -eq 0 ]
55+
56+
echo "Checking create-runtime library"
57+
echo $output | grep $HOOKLIBCR
58+
[ "$?" -eq 0 ]
59+
60+
echo "Checking create-container library"
61+
echo $output | grep $HOOKLIBCC
62+
[ "$?" -eq 0 ]
63+
}

tests/integration/multi-arch.bash

Lines changed: 31 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/bin/bash
2-
get_busybox(){
2+
get_busybox() {
33
case $(go env GOARCH) in
44
arm64)
55
echo 'https://github.com/docker-library/busybox/raw/dist-arm64v8/glibc/busybox.tar.xz'
@@ -10,13 +10,35 @@ get_busybox(){
1010
esac
1111
}
1212

13-
get_hello(){
13+
get_hello() {
1414
case $(go env GOARCH) in
15-
arm64)
16-
echo 'hello-world-aarch64.tar'
17-
;;
18-
*)
19-
echo 'hello-world.tar'
20-
;;
21-
esac
15+
arm64)
16+
echo 'hello-world-aarch64.tar'
17+
;;
18+
*)
19+
echo 'hello-world.tar'
20+
;;
21+
esac
22+
}
23+
24+
get_and_extract_debian() {
25+
tmp=$(mktemp -d)
26+
cd "$tmp"
27+
28+
debian="debian:3.11.6"
29+
30+
case $(go env GOARCH) in
31+
arm64)
32+
skopeo copy docker://arm64v8/debian:buster "oci:$debian"
33+
;;
34+
*)
35+
skopeo copy docker://amd64/debian:buster "oci:$debian"
36+
;;
37+
esac
38+
39+
args="$([ -z "${ROOTLESS_TESTPATH+x}" ] && echo "--rootless")"
40+
umoci unpack $args --image "$debian" "$1"
41+
42+
cd -
43+
rm -rf "$tmp"
2244
}

0 commit comments

Comments
 (0)