mirror of
https://gitea.com/Lydanne/buildx.git
synced 2025-05-18 00:47:48 +08:00
add additional test coverage for FS entitlement paths
Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
CrazyMax
parent
f1b3cf74eb
commit
2bd4aefb9b
@ -363,6 +363,48 @@ func TestValidateEntitlements(t *testing.T) {
|
|||||||
},
|
},
|
||||||
expected: EntitlementConf{},
|
expected: EntitlementConf{},
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
name: "NonExistingAllowedPathSubpath",
|
||||||
|
opt: build.Options{
|
||||||
|
ExportsLocalPathsTemporary: []string{
|
||||||
|
dir1,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
conf: EntitlementConf{
|
||||||
|
FSRead: []string{wd},
|
||||||
|
FSWrite: []string{filepath.Join(dir1, "not/exists")},
|
||||||
|
},
|
||||||
|
expected: EntitlementConf{
|
||||||
|
FSWrite: []string{expDir1}, // dir1 is still needed as only subpath was allowed
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "NonExistingAllowedPathMatches",
|
||||||
|
opt: build.Options{
|
||||||
|
ExportsLocalPathsTemporary: []string{
|
||||||
|
filepath.Join(dir1, "not/exists"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
conf: EntitlementConf{
|
||||||
|
FSRead: []string{wd},
|
||||||
|
FSWrite: []string{filepath.Join(dir1, "not/exists")},
|
||||||
|
},
|
||||||
|
expected: EntitlementConf{
|
||||||
|
FSWrite: []string{expDir1}, // dir1 is still needed as build also needs to write not/exists directory
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "NonExistingBuildPath",
|
||||||
|
opt: build.Options{
|
||||||
|
ExportsLocalPathsTemporary: []string{
|
||||||
|
filepath.Join(dir1, "not/exists"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
conf: EntitlementConf{
|
||||||
|
FSRead: []string{wd},
|
||||||
|
FSWrite: []string{dir1},
|
||||||
|
},
|
||||||
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
for _, tc := range tcases {
|
for _, tc := range tcases {
|
||||||
|
|||||||
264
tests/bake.go
264
tests/bake.go
@ -6,6 +6,7 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"os"
|
"os"
|
||||||
"path/filepath"
|
"path/filepath"
|
||||||
|
"strconv"
|
||||||
"strings"
|
"strings"
|
||||||
"testing"
|
"testing"
|
||||||
|
|
||||||
@ -46,6 +47,14 @@ var bakeTests = []func(t *testing.T, sb integration.Sandbox){
|
|||||||
testBakeRemoteDockerfileCwd,
|
testBakeRemoteDockerfileCwd,
|
||||||
testBakeRemoteLocalContextRemoteDockerfile,
|
testBakeRemoteLocalContextRemoteDockerfile,
|
||||||
testBakeEmpty,
|
testBakeEmpty,
|
||||||
|
testBakeSetNonExistingSubdirNoParallel,
|
||||||
|
testBakeSetNonExistingOutsideNoParallel,
|
||||||
|
testBakeSetExistingOutsideNoParallel,
|
||||||
|
testBakeDefinitionNotExistingSubdirNoParallel,
|
||||||
|
testBakeDefinitionNotExistingOutsideNoParallel,
|
||||||
|
testBakeDefinitionExistingOutsideNoParallel,
|
||||||
|
testBakeDefinitionSymlinkOutsideNoParallel,
|
||||||
|
testBakeDefinitionSymlinkOutsideGrantedNoParallel,
|
||||||
testBakeShmSize,
|
testBakeShmSize,
|
||||||
testBakeUlimits,
|
testBakeUlimits,
|
||||||
testBakeMetadataProvenance,
|
testBakeMetadataProvenance,
|
||||||
@ -705,6 +714,261 @@ target "default" {
|
|||||||
require.Contains(t, string(dt), `size=131072k`)
|
require.Contains(t, string(dt), `size=131072k`)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func testBakeSetNonExistingSubdirNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+filepath.Join(dir, "not/exists")))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.Contains(t, string(out), `#1 [internal] load local bake definitions`)
|
||||||
|
require.Contains(t, string(out), `#1 reading docker-bake.hcl`)
|
||||||
|
|
||||||
|
require.FileExists(t, filepath.Join(dir, "not/exists/foo"))
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
func testBakeSetNonExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
destDir := t.TempDir()
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+filepath.Join(destDir, "not/exists")))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
if ent {
|
||||||
|
require.Error(t, err, string(out))
|
||||||
|
require.Contains(t, string(out), "ERROR: additional privileges requested")
|
||||||
|
} else {
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "not/exists/foo"))
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeSetExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
destDir := t.TempDir()
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--set", "*.output=type=local,dest="+destDir))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
// existing directory via --set is always allowed
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "foo"))
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeDefinitionNotExistingSubdirNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
output = ["type=local,dest=not/exists"]
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
// subdirs of working directory are always allowed
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(dir, "not/exists/foo"))
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeDefinitionNotExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
destDir := t.TempDir()
|
||||||
|
bakefile := []byte(fmt.Sprintf(`
|
||||||
|
target "default" {
|
||||||
|
output = ["type=local,dest=%s/not/exists"]
|
||||||
|
}
|
||||||
|
`, destDir))
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
if ent {
|
||||||
|
require.Error(t, err, string(out))
|
||||||
|
require.Contains(t, string(out), "ERROR: additional privileges requested")
|
||||||
|
} else {
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "not/exists/foo"))
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeDefinitionExistingOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
destDir := t.TempDir()
|
||||||
|
bakefile := []byte(fmt.Sprintf(`
|
||||||
|
target "default" {
|
||||||
|
output = ["type=local,dest=%s"]
|
||||||
|
}
|
||||||
|
`, destDir))
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
if ent {
|
||||||
|
require.Error(t, err, string(out))
|
||||||
|
require.Contains(t, string(out), "ERROR: additional privileges requested")
|
||||||
|
} else {
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "foo"))
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeDefinitionSymlinkOutsideNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
destDir := t.TempDir()
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
output = ["type=local,dest=out"]
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
fstest.Symlink(destDir, "out"),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain"))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
if ent {
|
||||||
|
require.Error(t, err, string(out))
|
||||||
|
require.Contains(t, string(out), "ERROR: additional privileges requested")
|
||||||
|
} else {
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "foo"))
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func testBakeDefinitionSymlinkOutsideGrantedNoParallel(t *testing.T, sb integration.Sandbox) {
|
||||||
|
for _, ent := range []bool{true, false} {
|
||||||
|
t.Run(fmt.Sprintf("ent=%v", ent), func(t *testing.T) {
|
||||||
|
t.Setenv("BUILDX_BAKE_ENTITLEMENTS_FS", strconv.FormatBool(ent))
|
||||||
|
dockerfile := []byte(`
|
||||||
|
FROM scratch
|
||||||
|
COPY foo /foo
|
||||||
|
`)
|
||||||
|
destDir := t.TempDir()
|
||||||
|
bakefile := []byte(`
|
||||||
|
target "default" {
|
||||||
|
output = ["type=local,dest=out"]
|
||||||
|
}
|
||||||
|
`)
|
||||||
|
dir := tmpdir(
|
||||||
|
t,
|
||||||
|
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
|
||||||
|
fstest.CreateFile("Dockerfile", dockerfile, 0600),
|
||||||
|
fstest.CreateFile("foo", []byte("foo"), 0600),
|
||||||
|
fstest.Symlink(destDir, "out"),
|
||||||
|
)
|
||||||
|
|
||||||
|
cmd := buildxCmd(sb, withDir(dir), withArgs("bake", "--progress=plain", "--allow", "fs.write="+destDir))
|
||||||
|
out, err := cmd.CombinedOutput()
|
||||||
|
require.NoError(t, err, string(out))
|
||||||
|
require.FileExists(t, filepath.Join(destDir, "foo"))
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func testBakeUlimits(t *testing.T, sb integration.Sandbox) {
|
func testBakeUlimits(t *testing.T, sb integration.Sandbox) {
|
||||||
dockerfile := []byte(`
|
dockerfile := []byte(`
|
||||||
FROM busybox AS build
|
FROM busybox AS build
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user