Move the raw inspect response checks from integration-cli into
TestContainerInspectWithRaw.
Share one created container and API 1.24 response to verify legacy
top-level fields, the string Path, and VolumeDriver placement in
HostConfig rather than Config.
Drop the redundant bridge endpoint check because existing network
integration tests already validate and use the inspected address.
Signed-off-by: Jeston Singh <sjestonsingh@gmail.com>
Co-authored-by: Paweł Gronowski <pawel.gronowski@docker.com>
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This test's coverage (send a killing signal to a running container,
verify it stops) is already exercised by integration/container's
TestKillContainer table, which now has an explicit SIGKILL case
noting it takes a different path in daemon.ContainerKill than the
other signals.
Signed-off-by: Ogulcan Aydogan <ogulcanaydogan@gmail.com>
Expand TestImagesFilterBeforeSince to cover before and since filters
independently, using both image references and IDs.
Use images with distinct creation timestamps so the test can also verify
that matching images are returned in newest-first order. Retain coverage for
combining the before and since filters.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Add API-level coverage for images that become dangling after their tag is
reassigned.
Verify that the image is listed exactly once by default and with the
dangling=true filter, and that dangling=false excludes it. This complements
the existing integration-cli regression test for duplicate CLI rendering,
which remains separate because that behavior is specific to docker image ls.
Also document the original CLI regression in the integration-cli test and
mark it for migration to a docker/cli unit test.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Migrate TestImagesEnsureOnlyHeadsImagesShown from integration-cli to
integration/image.
The old test relied on parsing the classic builder's human-readable output
to obtain an intermediate image ID. Construct the parent/child relationship
directly through the API instead, and verify that untagged intermediate
images are hidden by default and when filtering for dangling images, but
included when listing all images.
This keeps coverage for the image parent/child semantics used by both image
store implementations without depending on classic-builder output.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
TestSwarmLockUnlockCluster checked local node state immediately or
within one second after restarting managers. The daemon API can become
ready while the swarm node is still reconnecting, so the check could
fail as a Raft cluster converged.
Poll restart state with the existing reconciliation timeout and report
the last observed state on timeout. Reuse the wait for
TestSwarmJoinPromoteLocked, which crosses the same restart boundary.
The restarts remain because loading the encrypted node key from disk
is part of the behavior under test.
This addresses the node-state timeout only. Shutdown failures with
exit status 130 have a separate cause.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This is a long-requested feature, and it solves several usability
problems with the default AppArmor profile:
1. The profile is completely opaque because we don't write to
/etc/apparmor.d anymore -- this leads to lots of headaches when
trying to run certain semi-privileged programs inside containers.
It's much nicer to be able to have a starting point for a custom
AppArmor profile.
2. Changes to AppArmor have broken backwards compatibility in the past
(leading to containers not working properly) -- the poster-child for
this problem was signal mediation. In order to fix this problem,
distributions had to patch Docker when it would've been much nicer
to provide a hotfix in the form of a custom configuration they could
apply to their hosts.
It also bridges the feature gap between the default seccomp profile
(which has been configurable for a very long time). This patch also
fixes a few minor bugs in the AppArmor profile implementation (notably,
Docker would not forcefully load its built-in profile at start time --
meaning a Docker update wouldn't actually update the profile).
This feature should probably be ported to other container runtimes
(containerd, podman/cri-o, etc) so that we can continue with the effort
to merge all of the disparate AppArmor profile implementations. Ideally
they would all use the same template variables too.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
---
The above was reapplied from the original commit on top of the current
daemon code.
The daemon already force-loads the default AppArmor profile at startup,
so this change wires the configured template into that existing reload
path instead of introducing the reload behavior itself.
The built-in profile now lives in github.com/moby/profiles/apparmor, so
the custom template data follows the current profile variables.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Swarm suite teardown stopped daemons while holding daemonsLock. A
nonzero daemon exit made Stop call Fatalf, so the test goroutine left
the mutex locked and retained stale daemons for the next test.
Snapshot and clear suite state under the lock, then stop each daemon
in its own cleanup subtest. A failed stop now releases suite state,
cleanup still runs for that daemon, and teardown continues with the
remaining daemons.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Extend the poll.WaitOn timeout for TestRunContainerWithRmFlagCannotStartContainer
and TestRunContainerWithRmFlagExitCodeNotEqualToZero on Windows from the default
10 seconds to 60 seconds.
On Windows, container teardown after docker run --rm involves:
1. HCS layer unmount (ReleaseLayer call via HCSSHIM)
2. EnsureRemoveAll with up to 50 retries × 100ms sleep on ERROR_ACCESS_DENIED /
ERROR_SHARING_VIOLATION / ERROR_LOCK_VIOLATION / ERROR_DIR_NOT_EMPTY
Under CI load this can exceed the default 10-second poll budget, causing:
timeout hit after 10s: waiting for container 'sparkles' to be removed
This fix applies the same pattern already used in TestRunStdinBlockedAfterContainerExit
(added in a81aa78ceb) to the two --rm flag tests.
Signed-off-by: Gordon <GordonTheTurtle@users.noreply.github.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pull a large image into a tiny 3 MiB ext4 filesystem to trigger ENOSPC.
Use a local registry instead of Docker Hub to eliminate Docker Hub rate
limits and transient internet network errors as sources of flakiness.
127.0.0.0/8 is automatically treated as insecure by the Docker daemon,
so no extra --insecure-registry flags are needed.
A synthetic 4 MiB image is created via the host daemon (using the
specialimage test utility and the Docker API) and pushed to a local V2
registry before the test daemon starts; the test daemon's 3 MiB data-root
is too small to store images, so the host daemon handles setup.
Signed-off-by: Gordon <GordonTheTurtle@users.noreply.github.com>
The legacy test raced cmd.Wait against reads from its stderr pipe and
only asserted the bundled CLI's generic HTTP upgrade error.
Rewrite it into a pure API integration test.
The cli side is already covered by
`TestNewAttachCommandErrors/invalid-detach-keys` test in docker/cli.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Run containerd inside dockerd when the experimental
`embedded-containerd` feature is enabled through `--feature` or the
daemon configuration.
Serve containerd's gRPC API on a Unix socket, or a named pipe on
Windows, for the plugin executor and external tools.
Use an in-memory listener for dockerd's own containerd client. Serve
TTRPC on a platform endpoint so task shims can publish events.
Register only the containerd plugins dockerd needs. Leave CRI, sandbox,
streaming, transfer, NRI, and the restart monitor out of the embedded
server.
Reject `--cri-containerd` when embedded mode is enabled instead of
silently ignoring the requested CRI support.
Check the feature before `ContainerdAddr` so it can override the default
containerd socket supplied by packaged service units. Continue to use
the configured external containerd when the feature is disabled.
Derive the Windows named-pipe address from the daemon state directory so
multiple daemons can run on the same host. Restrict the pipes to the
built-in Administrators group and LocalSystem with the same protected
DACL as dockerd's API pipe, as the default security descriptor depends
on the process token and can expose the containerd endpoints more
broadly than intended. Treat embedded mode as a containerd runtime in
the Windows test environment.
Add the `no_embedded_containerd` build tag so distributors can omit the
embedded plugin graph and its dependencies.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When the daemon uses the containerd runtime (io.containerd.runhcs.v1),
the runhcs shim emits container metrics as the typeurl
`containerd.runhcs.stats.v1.Statistics`. moby never imported the package
that registers this type, so `typeurl.UnmarshalAny` failed with "type not
found" and `docker stats` reported all zeros for running Windows
containers.
Import the hcsshim runhcs stats package so its proto init registers the
typeurl, and handle `*wstats.Statistics` in `InterfaceToStats`, converting
the Windows container statistics (processor time is reported in
nanoseconds and converted to the 100ns units used by hcsshim.Statistics)
into the shape consumed by stats_windows.go. Also replace the bare type
assertion with a type switch so unexpected payloads no longer panic.
Un-skip TestStatsAllNoStream and TestStatsAllRunningNoStream, and add a
unit test for the conversion.
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
Before this commit containerd-backed pulls and pushes ignored the
daemon's max concurrent transfer settings, so each operation can
independently consume the full configured concurrency.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Increase stop timeout on Windows and split container and CLI exit waits.
Wait for the container to reach `exited` before timing how long the
`docker run -i` process takes to exit with stdin still open.
This keeps the regression check focused on the post-exit CLI behavior
instead of combining it with container startup time. Use a unique
container name to avoid collisions with leftovers from previous runs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
These tests were skipped because "Windows does not support stats",
which should no longer be the case.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- use math/rand/v2
- change the util to only produce lowercase; some tests only could
use lowercase, and we don't need uppercase here, as long as it's
random.
- drop the Uniqueness test; it was effectively just testing stdlib
functionality (math/rand/v2 to be random).
- rename to RandomAlpha while we had to update call-sites
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The runSleepingContainerInImage (and runSleepingContainer) utils are
expected to return the container's ID (or name). They already assert
the command executed successfully, so let's avoid capturing output
from stderr (which could be warnings or logs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
