Sorry, something went wrong.
| ), | ||
| ) | ||
| def test_docker_user_rootless_docker(info_ret, expect_root): | ||
| docker._is_rootless_docker.cache_clear() |
There was a problem hiding this comment.
🤔 maybe we should clear this before and after the test run: otherwise we risk polluting following tests with whatever value we last injected (and not the real value it reads from docker)
Sorry, something went wrong.
There was a problem hiding this comment.
usually a better approach is something like this:
this bypasses the cache for the duration of the test
Sorry, something went wrong.
| retcode, out, _ = cmd_output_b( | ||
| 'docker', 'system', 'info', '--format', '{{ json .SecurityOptions }}', | ||
| ) | ||
| # some failures are to be expected, e.g. for 'podman' aliased as 'docker' | ||
| if retcode != 0: | ||
| return False | ||
|
|
||
| info = json.loads(out) | ||
| return any(opt == 'name=rootless' for opt in info) |
There was a problem hiding this comment.
this doesn't seem to work for podman :(
Sorry, something went wrong.
There was a problem hiding this comment.
this doesn't seem to work for podman :(
It looks like the invocation we need for podman is: podman system info --format '{{ json .Host.Security.Rootless }}', I guess we could either:
Trying to find a suitable command:
Sorry, something went wrong.
There was a problem hiding this comment.
Parsing the entire info response seemed the most robust: 9bc412d
Sorry, something went wrong.
| if expect_root: | ||
| assert docker.get_docker_user() == () | ||
| else: | ||
| assert docker.get_docker_user() != () |
There was a problem hiding this comment.
don't write logic in tests -- these are two separate disparate behaviours and should be tested separately
Sorry, something went wrong.
There was a problem hiding this comment.
don't write logic in tests -- these are two separate disparate behaviours and should be tested separately
909c165 also included your cache suggestion from above
Sorry, something went wrong.
By running containers in a rootless docker context as root. This is because user and group IDs are remapped in the user namespaces uses by rootless docker, and it's unlikely that the current user ID will map to the same ID under this remap (see docs[1] for some more details). Specifically, it means ownership of mounted volumes will not be for the current user and trying to write can result in permission errors.
This change borrows heavily from an existing PR[2].
The output format of docker system info I don't think is documented/guaranteed anywhere, but it should corresponding to the format of a /info API request to Docker[3]
The added test hopes to avoid regressions in this behaviour, but since tests aren't run in a rootless docker context on the PR checks (and I couldn't find an easy way to make it the case) there's still a risk of regressions sneaking in.
Link: https://docs.docker.com/engine/security/rootless/ [1]
Link: #1484 [2]
Link: https://docs.docker.com/reference/api/engine/version/v1.48/#tag/System/operation/SystemAuth [3]
resolves #1243