From 1363849b034a1daf58a4d677e758124d7ea7087e Mon Sep 17 00:00:00 2001
From: Divya <ranidivya063@gmail.com>
Date: Thu, 19 Dec 2024 11:00:12 +0000
Subject: [PATCH] Add integration test

Signed-off-by: Divya <ranidivya063@gmail.com>
---
 .../container_cgroup_writable_linux_test.go   | 141 ++++++++++++++++++
 1 file changed, 141 insertions(+)
 create mode 100644 integration/container_cgroup_writable_linux_test.go

diff --git a/integration/container_cgroup_writable_linux_test.go b/integration/container_cgroup_writable_linux_test.go
new file mode 100644
index 000000000..21755b800
--- /dev/null
+++ b/integration/container_cgroup_writable_linux_test.go
@@ -0,0 +1,141 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package integration
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/containerd/cgroups/v3"
+	"github.com/containerd/containerd/v2/integration/images"
+	"github.com/containerd/containerd/v2/integration/remote"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
+)
+
+func newContainerdProcess(t *testing.T, cgroupWritable bool) *ctrdProc {
+	configDir := t.TempDir()
+	configPath := filepath.Join(configDir, "config.toml")
+	config := fmt.Sprintf(`
+version = 3
+
+[plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
+  cgroup_writable = %t
+`,
+		cgroupWritable)
+
+	err := os.WriteFile(configPath, []byte(config), 0600)
+	require.NoError(t, err)
+
+	currentProc := newCtrdProc(t, "containerd", configDir, nil)
+	require.NoError(t, currentProc.isReady())
+
+	return currentProc
+}
+
+func TestContainerCgroupWritable(t *testing.T) {
+	t.Parallel()
+
+	if cgroups.Mode() != cgroups.Unified {
+		t.Skip("requires cgroup v2")
+	}
+
+	testCases := []struct {
+		name           string
+		cgroupWritable bool
+	}{
+		{
+			name:           "writable cgroup",
+			cgroupWritable: true,
+		},
+		{
+			name:           "readonly cgroup",
+			cgroupWritable: false,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			currentProc := newContainerdProcess(t, testCase.cgroupWritable)
+
+			// Get the runtime service
+			runtimeService, err := remote.NewRuntimeService(currentProc.grpcAddress(), 1*time.Minute)
+			require.NoError(t, err)
+
+			t.Cleanup(func() {
+				cleanupPods(t, runtimeService)
+				t.Log("Stopping containerd process")
+				require.NoError(t, currentProc.kill(syscall.SIGTERM))
+				require.NoError(t, currentProc.wait(5*time.Minute))
+			})
+
+			imageName := images.Get(images.BusyBox)
+			pullImagesByCRI(t, currentProc.criImageService(t), imageName)
+
+			// Create a test sandbox
+			sbConfig := &runtime.PodSandboxConfig{
+				Metadata: &runtime.PodSandboxMetadata{
+					Name:      "sandbox",
+					Namespace: "cgroup-writable",
+				},
+			}
+			sb, err := runtimeService.RunPodSandbox(sbConfig, "")
+			require.NoError(t, err)
+
+			containerName := "cgroup-writable-test"
+			cnConfig := &runtime.ContainerConfig{
+				Metadata: &runtime.ContainerMetadata{
+					Name: containerName,
+				},
+				Image: &runtime.ImageSpec{
+					Image: imageName,
+				},
+				Command: []string{"sh", "-c", "sleep 1d"},
+			}
+
+			cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
+			require.NoError(t, err)
+			defer func() {
+				assert.NoError(t, runtimeService.RemoveContainer(cn))
+			}()
+
+			require.NoError(t, runtimeService.StartContainer(cn))
+			defer func() {
+				assert.NoError(t, runtimeService.StopContainer(cn, 30))
+			}()
+
+			status, err := runtimeService.ContainerStatus(cn)
+			require.NoError(t, err)
+			assert.Equal(t, status.GetState(), runtime.ContainerState_CONTAINER_RUNNING)
+
+			// Execute a command to verify if cgroup is writable
+			_, stderr, err := runtimeService.ExecSync(cn, []string{"mkdir", "sys/fs/cgroup/dummy-group"}, 2)
+			if testCase.cgroupWritable {
+				require.NoError(t, err)
+				require.Empty(t, stderr)
+			} else {
+				require.Error(t, err)
+				require.Contains(t, string(stderr), "mkdir: can't create directory 'sys/fs/cgroup/dummy-group': Read-only file system")
+			}
+		})
+	}
+}