TestSwarmLockUnlockCluster checked local node state immediately or
within one second after restarting managers. The daemon API can become
ready while the swarm node is still reconnecting, so the check could
fail as a Raft cluster converged.
Poll restart state with the existing reconciliation timeout and report
the last observed state on timeout. Reuse the wait for
TestSwarmJoinPromoteLocked, which crosses the same restart boundary.
The restarts remain because loading the encrypted node key from disk
is part of the behavior under test.
This addresses the node-state timeout only. Shutdown failures with
exit status 130 have a separate cause.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This is a long-requested feature, and it solves several usability
problems with the default AppArmor profile:
1. The profile is completely opaque because we don't write to
/etc/apparmor.d anymore -- this leads to lots of headaches when
trying to run certain semi-privileged programs inside containers.
It's much nicer to be able to have a starting point for a custom
AppArmor profile.
2. Changes to AppArmor have broken backwards compatibility in the past
(leading to containers not working properly) -- the poster-child for
this problem was signal mediation. In order to fix this problem,
distributions had to patch Docker when it would've been much nicer
to provide a hotfix in the form of a custom configuration they could
apply to their hosts.
It also bridges the feature gap between the default seccomp profile
(which has been configurable for a very long time). This patch also
fixes a few minor bugs in the AppArmor profile implementation (notably,
Docker would not forcefully load its built-in profile at start time --
meaning a Docker update wouldn't actually update the profile).
This feature should probably be ported to other container runtimes
(containerd, podman/cri-o, etc) so that we can continue with the effort
to merge all of the disparate AppArmor profile implementations. Ideally
they would all use the same template variables too.
Signed-off-by: Aleksa Sarai <asarai@suse.de>
---
The above was reapplied from the original commit on top of the current
daemon code.
The daemon already force-loads the default AppArmor profile at startup,
so this change wires the configured template into that existing reload
path instead of introducing the reload behavior itself.
The built-in profile now lives in github.com/moby/profiles/apparmor, so
the custom template data follows the current profile variables.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Swarm suite teardown stopped daemons while holding daemonsLock. A
nonzero daemon exit made Stop call Fatalf, so the test goroutine left
the mutex locked and retained stale daemons for the next test.
Snapshot and clear suite state under the lock, then stop each daemon
in its own cleanup subtest. A failed stop now releases suite state,
cleanup still runs for that daemon, and teardown continues with the
remaining daemons.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Extend the poll.WaitOn timeout for TestRunContainerWithRmFlagCannotStartContainer
and TestRunContainerWithRmFlagExitCodeNotEqualToZero on Windows from the default
10 seconds to 60 seconds.
On Windows, container teardown after docker run --rm involves:
1. HCS layer unmount (ReleaseLayer call via HCSSHIM)
2. EnsureRemoveAll with up to 50 retries × 100ms sleep on ERROR_ACCESS_DENIED /
ERROR_SHARING_VIOLATION / ERROR_LOCK_VIOLATION / ERROR_DIR_NOT_EMPTY
Under CI load this can exceed the default 10-second poll budget, causing:
timeout hit after 10s: waiting for container 'sparkles' to be removed
This fix applies the same pattern already used in TestRunStdinBlockedAfterContainerExit
(added in a81aa78ceb) to the two --rm flag tests.
Signed-off-by: Gordon <GordonTheTurtle@users.noreply.github.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Pull a large image into a tiny 3 MiB ext4 filesystem to trigger ENOSPC.
Use a local registry instead of Docker Hub to eliminate Docker Hub rate
limits and transient internet network errors as sources of flakiness.
127.0.0.0/8 is automatically treated as insecure by the Docker daemon,
so no extra --insecure-registry flags are needed.
A synthetic 4 MiB image is created via the host daemon (using the
specialimage test utility and the Docker API) and pushed to a local V2
registry before the test daemon starts; the test daemon's 3 MiB data-root
is too small to store images, so the host daemon handles setup.
Signed-off-by: Gordon <GordonTheTurtle@users.noreply.github.com>
The legacy test raced cmd.Wait against reads from its stderr pipe and
only asserted the bundled CLI's generic HTTP upgrade error.
Rewrite it into a pure API integration test.
The cli side is already covered by
`TestNewAttachCommandErrors/invalid-detach-keys` test in docker/cli.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Run containerd inside dockerd when the experimental
`embedded-containerd` feature is enabled through `--feature` or the
daemon configuration.
Serve containerd's gRPC API on a Unix socket, or a named pipe on
Windows, for the plugin executor and external tools.
Use an in-memory listener for dockerd's own containerd client. Serve
TTRPC on a platform endpoint so task shims can publish events.
Register only the containerd plugins dockerd needs. Leave CRI, sandbox,
streaming, transfer, NRI, and the restart monitor out of the embedded
server.
Reject `--cri-containerd` when embedded mode is enabled instead of
silently ignoring the requested CRI support.
Check the feature before `ContainerdAddr` so it can override the default
containerd socket supplied by packaged service units. Continue to use
the configured external containerd when the feature is disabled.
Derive the Windows named-pipe address from the daemon state directory so
multiple daemons can run on the same host. Restrict the pipes to the
built-in Administrators group and LocalSystem with the same protected
DACL as dockerd's API pipe, as the default security descriptor depends
on the process token and can expose the containerd endpoints more
broadly than intended. Treat embedded mode as a containerd runtime in
the Windows test environment.
Add the `no_embedded_containerd` build tag so distributors can omit the
embedded plugin graph and its dependencies.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When the daemon uses the containerd runtime (io.containerd.runhcs.v1),
the runhcs shim emits container metrics as the typeurl
`containerd.runhcs.stats.v1.Statistics`. moby never imported the package
that registers this type, so `typeurl.UnmarshalAny` failed with "type not
found" and `docker stats` reported all zeros for running Windows
containers.
Import the hcsshim runhcs stats package so its proto init registers the
typeurl, and handle `*wstats.Statistics` in `InterfaceToStats`, converting
the Windows container statistics (processor time is reported in
nanoseconds and converted to the 100ns units used by hcsshim.Statistics)
into the shape consumed by stats_windows.go. Also replace the bare type
assertion with a type switch so unexpected payloads no longer panic.
Un-skip TestStatsAllNoStream and TestStatsAllRunningNoStream, and add a
unit test for the conversion.
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
Before this commit containerd-backed pulls and pushes ignored the
daemon's max concurrent transfer settings, so each operation can
independently consume the full configured concurrency.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Increase stop timeout on Windows and split container and CLI exit waits.
Wait for the container to reach `exited` before timing how long the
`docker run -i` process takes to exit with stdin still open.
This keeps the regression check focused on the post-exit CLI behavior
instead of combining it with container startup time. Use a unique
container name to avoid collisions with leftovers from previous runs.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
These tests were skipped because "Windows does not support stats",
which should no longer be the case.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
- use math/rand/v2
- change the util to only produce lowercase; some tests only could
use lowercase, and we don't need uppercase here, as long as it's
random.
- drop the Uniqueness test; it was effectively just testing stdlib
functionality (math/rand/v2 to be random).
- rename to RandomAlpha while we had to update call-sites
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The runSleepingContainerInImage (and runSleepingContainer) utils are
expected to return the container's ID (or name). They already assert
the command executed successfully, so let's avoid capturing output
from stderr (which could be warnings or logs).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Migrate test api images search json content type from integration cli to integration tests
Signed-off-by: Abubacarr Ceesay <abubacarr671@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
Move the useful Mounts API create coverage out of integration-cli and
into the container integration tests that own the behavior.
Add volume mount inspect assertions to TestContainerVolumeAnonymous for
destination normalization, read-only named volumes, explicit driver
configuration, and NoCopy mounts.
Add a focused bind mount inspect test for read-only bind mounts and
shared propagation.
Do not port the full integration-cli matrix. Existing integration tests
already cover anonymous volume creation and labeling, anonymous volume
removal with RemoveVolumes, and generic bind propagation handling.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Replace flaky legacy CLI restart-policy tests with container API
integration coverage.
The CLI tests poll inspect output after short-lived detached containers
exit, which can observe transient daemon monitor state while cleanup or
restart-policy handling is still settling.
On Windows this can race a manual restart against an `on-failure:3`
container that has not exhausted its automatic retries.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
TestDaemonRestartWithNames in the DockerDaemonSuite has been broken
since commit 72ec7cd6cc. The test takes
the combined output of a `docker run` command as the ID of the created
container. This works fine so long as the command emits no warnings,
otherwise it will corrupt the ID that the test captures. Modify the test
to read the ID from the command's stdout to make the test robust to
warnings being printed.
Signed-off-by: Cory Snider <csnider@mirantis.com>
The cp integration fixture only needs a stopped container with prepared
filesystem content.
Running the container detached and immediately calling `docker wait`
adds an extra daemon wait request that can race with short-lived fixture
containers and fail before the copy behavior is exercised.
Run the fixture command in the foreground and capture the resulting
container ID with a cidfile so the container remains available for later
cp assertions without the separate wait endpoint.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Implement a `dPath()` utility function that converts paths to Windows paths
(add `c:` drive-letter, and convert to backslashes) if the daemon is running
on Windows.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The test queried `docker events` without `--until` and relied on a 300ms
timeout to collect output.
On slow CI, events may not stream back within that window, resulting in
empty stdout and assertion failures.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Paweł Gronowski