Skip to content

Commit 89c65db

Browse files
ChengyuZhu6ChengyuZhu6
authored
Merge pull request #4726 from JoonsooWon/issues_4613_container_run_user_linux_test.go
test: refactor container_run_user_linux_test.go to use Tigron
2 parents 8a31691 + 3174f3f commit 89c65db

1 file changed

Lines changed: 83 additions & 112 deletions

File tree

‎cmd/nerdctl/container/container_run_user_linux_test.go‎

Lines changed: 83 additions & 112 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import (
2222

2323
"gotest.tools/v3/assert"
2424

25+
"github.com/containerd/nerdctl/mod/tigron/expect"
2526
"github.com/containerd/nerdctl/mod/tigron/require"
2627
"github.com/containerd/nerdctl/mod/tigron/test"
2728
"github.com/containerd/nerdctl/mod/tigron/tig"
@@ -31,163 +32,133 @@ import (
3132
)
3233

3334
func TestRunUserGID(t *testing.T) {
34-
t.Parallel()
35-
base := testutil.NewBase(t)
36-
testCases := map[string]string{
37-
"": "root bin daemon sys adm disk wheel floppy dialout tape video",
38-
"1000": "root",
39-
"guest": "users",
40-
"nobody": "nobody",
41-
}
42-
for userStr, expected := range testCases {
43-
userStr := userStr
44-
expected := expected
45-
t.Run(userStr, func(t *testing.T) {
46-
t.Parallel()
47-
cmd := []string{"run", "--rm"}
48-
if userStr != "" {
49-
cmd = append(cmd, "--user", userStr)
50-
}
51-
cmd = append(cmd, testutil.AlpineImage, "id", "-nG")
52-
base.Cmd(cmd...).AssertOutContains(expected)
53-
})
35+
testCase := nerdtest.Setup()
36+
testCase.SubTests = []*test.Case{
37+
{
38+
Description: "Test container run as default user (root) and verify root belongs to standard system groups",
39+
Command: test.Command("run", "--rm", testutil.AlpineImage, "id", "-nG"),
40+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("root bin daemon sys adm disk wheel floppy dialout tape video")),
41+
},
42+
{
43+
Description: "Test container run with numeric UID (1000) and verify it resolves to root group inside the container",
44+
Command: test.Command("run", "--rm", "--user", "1000", testutil.AlpineImage, "id", "-nG"),
45+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("root")),
46+
},
47+
{
48+
Description: "Test container run as user (guest) and verify group membership is resolved correctly",
49+
Command: test.Command("run", "--rm", "--user", "guest", testutil.AlpineImage, "id", "-nG"),
50+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("users")),
51+
},
52+
{
53+
Description: "Test container run with well-known user 'nobody' and verify it belongs to the 'nobody' group",
54+
Command: test.Command("run", "--rm", "--user", "nobody", testutil.AlpineImage, "id", "-nG"),
55+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("nobody")),
56+
},
5457
}
58+
testCase.Run(t)
5559
}
5660

5761
func TestRunUmask(t *testing.T) {
58-
t.Parallel()
59-
base := testutil.NewBase(t)
60-
testutil.DockerIncompatible(t)
61-
base.Cmd("run", "--rm", "--umask", "0200", testutil.AlpineImage, "sh", "-c", "umask").AssertOutContains("0200")
62+
testCase := nerdtest.Setup()
63+
testCase.Require = require.Not(nerdtest.Docker)
64+
testCase.Command = test.Command("run", "--rm", "--umask", "0200", testutil.AlpineImage, "sh", "-c", "umask")
65+
testCase.Expected = test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("0200"))
66+
testCase.Run(t)
6267
}
6368

6469
func TestRunAddGroup(t *testing.T) {
65-
t.Parallel()
66-
base := testutil.NewBase(t)
67-
testCases := []struct {
68-
user string
69-
groups []string
70-
expected string
71-
}{
70+
testCase := nerdtest.Setup()
71+
testCase.SubTests = []*test.Case{
7272
{
73-
user: "",
74-
groups: []string{},
75-
expected: "root bin daemon sys adm disk wheel floppy dialout tape video",
73+
Description: "Test container run as default root user and its inherited system groups",
74+
Command: test.Command("run", "--rm", testutil.AlpineImage, "id", "-nG"),
75+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("root bin daemon sys adm disk wheel floppy dialout tape video\n")),
7676
},
7777
{
78-
user: "1000",
79-
groups: []string{},
80-
expected: "root",
78+
Description: "Test container run as numeric UID only and its fallback to root group",
79+
Command: test.Command("run", "--rm", "--user", "1000", testutil.AlpineImage, "id", "-nG"),
80+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("root\n")),
8181
},
8282
{
83-
user: "1000",
84-
groups: []string{"nogroup"},
85-
expected: "root nogroup",
83+
Description: "Test container run as numeric UID with extra group addition",
84+
Command: test.Command("run", "--rm", "--user", "1000", "--group-add", "nogroup", testutil.AlpineImage, "id", "-nG"),
85+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("root nogroup\n")),
8686
},
8787
{
88-
user: "1000:wheel",
89-
groups: []string{"nogroup"},
90-
expected: "wheel nogroup",
88+
Description: "Test container run as UID:GID pair with extra group addition",
89+
Command: test.Command("run", "--rm", "--user", "1000:wheel", "--group-add", "nogroup", testutil.AlpineImage, "id", "-nG"),
90+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("wheel nogroup\n")),
9191
},
9292
{
93-
user: "root",
94-
groups: []string{"nogroup"},
95-
expected: "root bin daemon sys adm disk wheel floppy dialout tape video nogroup",
93+
Description: "Test container run as root with extra group addition and system group persistence",
94+
Command: test.Command("run", "--rm", "--user", "root", "--group-add", "nogroup", testutil.AlpineImage, "id", "-nG"),
95+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("root bin daemon sys adm disk wheel floppy dialout tape video nogroup\n")),
9696
},
9797
{
98-
user: "root:nogroup",
99-
groups: []string{"nogroup"},
100-
expected: "nogroup",
98+
Description: "Test container run as root:group override and its effect on supplementary groups",
99+
Command: test.Command("run", "--rm", "--user", "root:nogroup", "--group-add", "nogroup", testutil.AlpineImage, "id", "-nG"),
100+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nogroup\n")),
101101
},
102102
{
103-
user: "guest",
104-
groups: []string{"root", "nogroup"},
105-
expected: "users root nogroup",
103+
Description: "Test container run as named non-root user with multiple group additions",
104+
Command: test.Command("run", "--rm", "--user", "guest", "--group-add", "root", "--group-add", "nogroup", testutil.AlpineImage, "id", "-nG"),
105+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("users root nogroup\n")),
106106
},
107107
{
108-
user: "guest:nogroup",
109-
groups: []string{"0"},
110-
expected: "nogroup root",
108+
Description: "Test container run as named user:group with numeric GID resolution",
109+
Command: test.Command("run", "--rm", "--user", "guest:nogroup", "--group-add", "0", testutil.AlpineImage, "id", "-nG"),
110+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Equals("nogroup root\n")),
111111
},
112112
}
113-
114-
for _, testCase := range testCases {
115-
testCase := testCase
116-
t.Run(testCase.user, func(t *testing.T) {
117-
t.Parallel()
118-
cmd := []string{"run", "--rm"}
119-
if testCase.user != "" {
120-
cmd = append(cmd, "--user", testCase.user)
121-
}
122-
for _, group := range testCase.groups {
123-
cmd = append(cmd, "--group-add", group)
124-
}
125-
cmd = append(cmd, testutil.AlpineImage, "id", "-nG")
126-
base.Cmd(cmd...).AssertOutExactly(testCase.expected + "\n")
127-
})
128-
}
113+
testCase.Run(t)
129114
}
130115

131116
// TestRunAddGroup_CVE_2023_25173 tests https://github.com/advisories/GHSA-hmfx-3pcx-653p
132117
//
133118
// Equates to https://github.com/containerd/containerd/commit/286a01f350a2298b4fdd7e2a0b31c04db3937ea8
134119
func TestRunAddGroup_CVE_2023_25173(t *testing.T) {
135-
t.Parallel()
136-
base := testutil.NewBase(t)
137-
testCases := []struct {
138-
user string
139-
groups []string
140-
expected string
141-
}{
120+
testCase := nerdtest.Setup()
121+
testCase.Setup = func(data test.Data, helpers test.Helpers) {
122+
helpers.Ensure("pull", "--quiet", testutil.BusyboxImage)
123+
}
124+
testCase.SubTests = []*test.Case{
142125
{
143-
user: "",
144-
groups: nil,
145-
expected: "groups=0(root),10(wheel)",
126+
Description: "Test container run as default root user",
127+
Command: test.Command("run", "--rm", testutil.BusyboxImage, "id"),
128+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=0(root),10(wheel)\n")),
146129
},
147130
{
148-
user: "",
149-
groups: []string{"1", "1234"},
150-
expected: "groups=0(root),1(daemon),10(wheel),1234",
131+
Description: "Test container run as root with additional groups",
132+
Command: test.Command("run", "--rm", "--group-add", "1", "--group-add", "1234", testutil.BusyboxImage, "id"),
133+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=0(root),1(daemon),10(wheel),1234\n")),
151134
},
152135
{
153-
user: "1234",
154-
groups: nil,
155-
expected: "groups=0(root)",
136+
Description: "Test container run as custom UID with inherited root group",
137+
Command: test.Command("run", "--rm", "--user", "1234", testutil.BusyboxImage, "id"),
138+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=0(root)\n")),
156139
},
157140
{
158-
user: "1234:1234",
159-
groups: nil,
160-
expected: "groups=1234",
141+
Description: "Test container run as custom UID and GID pair",
142+
Command: test.Command("run", "--rm", "--user", "1234:1234", testutil.BusyboxImage, "id"),
143+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=1234\n")),
161144
},
162145
{
163-
user: "1234",
164-
groups: []string{"1234"},
165-
expected: "groups=0(root),1234",
146+
Description: "Test container run as custom UID with explicit group add",
147+
Command: test.Command("run", "--rm", "--user", "1234", "--group-add", "1234", testutil.BusyboxImage, "id"),
148+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=0(root),1234\n")),
166149
},
167150
{
168-
user: "daemon",
169-
groups: nil,
170-
expected: "groups=1(daemon)",
151+
Description: "Test container run as named non-root user (daemon)",
152+
Command: test.Command("run", "--rm", "--user", "daemon", testutil.BusyboxImage, "id"),
153+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=1(daemon)\n")),
171154
},
172155
{
173-
user: "daemon",
174-
groups: []string{"1234"},
175-
expected: "groups=1(daemon),1234",
156+
Description: "Test container run as named user with extra groups",
157+
Command: test.Command("run", "--rm", "--user", "daemon", "--group-add", "1234", testutil.BusyboxImage, "id"),
158+
Expected: test.Expects(expect.ExitCodeSuccess, nil, expect.Contains("groups=1(daemon),1234\n")),
176159
},
177160
}
178-
179-
base.Cmd("pull", "--quiet", testutil.BusyboxImage).AssertOK()
180-
for _, testCase := range testCases {
181-
cmd := []string{"run", "--rm"}
182-
if testCase.user != "" {
183-
cmd = append(cmd, "--user", testCase.user)
184-
}
185-
for _, group := range testCase.groups {
186-
cmd = append(cmd, "--group-add", group)
187-
}
188-
cmd = append(cmd, testutil.BusyboxImage, "id")
189-
base.Cmd(cmd...).AssertOutContains(testCase.expected + "\n")
190-
}
161+
testCase.Run(t)
191162
}
192163

193164
func TestUsernsMappingRunCmd(t *testing.T) {

0 commit comments

Comments
 (0)