wehub-resource-sync
680845cb1c
Linux build / Determine Swift version (push) Waiting to run
Linux build / Linux compile check (push) Blocked by required conditions
Build containerization / Verify commit signatures (push) Has been skipped
Build containerization / containerization (push) Successful in 0s
5676 lines
213 KiB
Swift
5676 lines
213 KiB
Swift
//===----------------------------------------------------------------------===//
|
|
// Copyright © 2025-2026 Apple Inc. and the Containerization project authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// https://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
import ArgumentParser
|
|
import Containerization
|
|
import ContainerizationEXT4
|
|
import ContainerizationError
|
|
import ContainerizationExtras
|
|
import ContainerizationOCI
|
|
import ContainerizationOS
|
|
import Crypto
|
|
import Foundation
|
|
import Logging
|
|
import SystemPackage
|
|
|
|
extension IntegrationSuite {
|
|
func testProcessTrue() async throws {
|
|
let id = "test-process-true"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/true"]
|
|
config.memoryInBytes = 250_000_000
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
}
|
|
|
|
func testProcessFalse() async throws {
|
|
let id = "test-process-false"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/false"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 1 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 1")
|
|
}
|
|
}
|
|
|
|
final class DiscardingWriter: @unchecked Sendable, Writer {
|
|
var count: Int = 0
|
|
|
|
func write(_ data: Data) throws {
|
|
count += data.count
|
|
}
|
|
|
|
func close() throws {
|
|
return
|
|
}
|
|
}
|
|
|
|
final class BufferWriter: Writer {
|
|
// `data` isn't used concurrently.
|
|
nonisolated(unsafe) var data = Data()
|
|
|
|
func write(_ data: Data) throws {
|
|
guard data.count > 0 else {
|
|
return
|
|
}
|
|
self.data.append(data)
|
|
}
|
|
|
|
func close() throws {
|
|
return
|
|
}
|
|
}
|
|
|
|
final class StdinBuffer: ReaderStream {
|
|
let data: Data
|
|
|
|
init(data: Data) {
|
|
self.data = data
|
|
}
|
|
|
|
func stream() -> AsyncStream<Data> {
|
|
let (stream, cont) = AsyncStream<Data>.makeStream()
|
|
cont.yield(self.data)
|
|
cont.finish()
|
|
return stream
|
|
}
|
|
}
|
|
|
|
final class ChunkedStdinBuffer: ReaderStream {
|
|
let chunks: [Data]
|
|
let delayMs: Int
|
|
|
|
init(chunks: [Data], delayMs: Int = 0) {
|
|
self.chunks = chunks
|
|
self.delayMs = delayMs
|
|
}
|
|
|
|
func stream() -> AsyncStream<Data> {
|
|
let chunks = self.chunks
|
|
let delayMs = self.delayMs
|
|
return AsyncStream { cont in
|
|
Task {
|
|
for chunk in chunks {
|
|
if delayMs > 0 {
|
|
try? await Task.sleep(for: .milliseconds(delayMs))
|
|
}
|
|
cont.yield(chunk)
|
|
}
|
|
cont.finish()
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func testProcessEchoHi() async throws {
|
|
let id = "test-process-echo-hi"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/echo", "hi"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 1")
|
|
}
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "hi\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout 'hi' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testProcessNoExecutable() async throws {
|
|
let id = "test-process-no-executable"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["foobarbaz"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let _ = try await container.wait()
|
|
try await container.stop()
|
|
|
|
throw IntegrationError.assert(msg: "process didn't throw 'no executable' error")
|
|
} catch {
|
|
try? await container.stop()
|
|
guard let err = error as? ContainerizationError,
|
|
err.isCode(.internalError), err.description.contains("failed to find target executable")
|
|
else {
|
|
throw error
|
|
}
|
|
}
|
|
}
|
|
|
|
func testMultipleConcurrentProcesses() async throws {
|
|
let id = "test-concurrent-processes"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
try await withThrowingTaskGroup(of: Void.self) { group in
|
|
for i in 0...80 {
|
|
let exec = try await container.exec("exec-\(i)") { config in
|
|
config.arguments = ["/bin/true"]
|
|
}
|
|
|
|
group.addTask {
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
if status.exitCode != 0 {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
try await exec.delete()
|
|
}
|
|
}
|
|
|
|
try await group.waitForAll()
|
|
|
|
try await container.stop()
|
|
}
|
|
} catch {
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testMultipleConcurrentProcessesOutputStress() async throws {
|
|
let id = "test-concurrent-processes-output-stress"
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("expected-value") { config in
|
|
config.arguments = [
|
|
"sh",
|
|
"-c",
|
|
"dd if=/dev/random of=/tmp/bytes bs=1M count=20 status=none ; sha256sum /tmp/bytes",
|
|
]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
if status.exitCode != 0 {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)!
|
|
let expected = String(output.split(separator: " ").first!)
|
|
try await withThrowingTaskGroup(of: Void.self) { group in
|
|
for i in 0...80 {
|
|
let idx = i
|
|
group.addTask {
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("exec-\(idx)") { config in
|
|
config.arguments = ["cat", "/tmp/bytes"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
|
|
let status = try await exec.wait()
|
|
if status.exitCode != 0 {
|
|
throw IntegrationError.assert(msg: "process \(idx) status \(status) != 0")
|
|
}
|
|
|
|
var hasher = SHA256()
|
|
hasher.update(data: buffer.data)
|
|
let hash = hasher.finalize().digestString.trimmingDigestPrefix
|
|
guard hash == expected else {
|
|
throw IntegrationError.assert(
|
|
msg: "process \(idx) output \(hash) != expected \(expected)")
|
|
}
|
|
try await exec.delete()
|
|
}
|
|
}
|
|
|
|
try await group.waitForAll()
|
|
}
|
|
try await exec.delete()
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
}
|
|
}
|
|
|
|
func testProcessUser() async throws {
|
|
let id = "test-process-user"
|
|
|
|
let bs = try await bootstrap(id)
|
|
var buffer = BufferWriter()
|
|
var container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/usr/bin/id"]
|
|
config.process.user = .init(uid: 1, gid: 1, additionalGids: [1])
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
var status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
var expected = "uid=1(bin) gid=1(bin) groups=1(bin)"
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
|
|
buffer = BufferWriter()
|
|
container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/usr/bin/id"]
|
|
// Try some uid that doesn't exist. This is supported.
|
|
config.process.user = .init(uid: 40000, gid: 40000)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
expected = "uid=40000 gid=40000 groups=40000"
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
|
|
buffer = BufferWriter()
|
|
container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/usr/bin/id"]
|
|
// Try some uid that doesn't exist. This is supported.
|
|
config.process.user = .init(username: "40000:40000")
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
expected = "uid=40000 gid=40000 groups=40000"
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
|
|
buffer = BufferWriter()
|
|
container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/usr/bin/id"]
|
|
// Now for our final trick, try and run a username that doesn't exist.
|
|
config.process.user = .init(username: "thisdoesntexist")
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
do {
|
|
try await container.start()
|
|
} catch {
|
|
return
|
|
}
|
|
throw IntegrationError.assert(msg: "container start should have failed")
|
|
}
|
|
|
|
// Ensure if we ask for a terminal we set TERM.
|
|
func testProcessTtyEnvvar() async throws {
|
|
let id = "test-process-tty-envvar"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["env"]
|
|
config.process.terminal = true
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let str = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(
|
|
msg: "failed to convert standard output to a UTF8 string")
|
|
}
|
|
|
|
let homeEnvvar = "TERM=xterm"
|
|
guard str.contains(homeEnvvar) else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have TERM environment variable defined")
|
|
}
|
|
}
|
|
|
|
// Make sure we set HOME by default if we can find it in /etc/passwd in the guest.
|
|
func testProcessHomeEnvvar() async throws {
|
|
let id = "test-process-home-envvar"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["env"]
|
|
config.process.user = .init(uid: 0, gid: 0)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let str = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(
|
|
msg: "failed to convert standard output to a UTF8 string")
|
|
}
|
|
|
|
let homeEnvvar = "HOME=/root"
|
|
guard str.contains(homeEnvvar) else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have HOME environment variable defined")
|
|
}
|
|
}
|
|
|
|
func testProcessCustomHomeEnvvar() async throws {
|
|
let id = "test-process-custom-home-envvar"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let customHomeEnvvar = "HOME=/tmp/custom/home"
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sh", "-c", "echo HOME=$HOME"]
|
|
config.process.environmentVariables.append(customHomeEnvvar)
|
|
config.process.user = .init(uid: 0, gid: 0)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.contains(customHomeEnvvar) else {
|
|
throw IntegrationError.assert(msg: "process should have preserved custom HOME environment variable, expected \(customHomeEnvvar), got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testHostname() async throws {
|
|
let id = "test-container-hostname"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/hostname"]
|
|
config.hostname = "foo-bar"
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
let expected = "foo-bar"
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
}
|
|
|
|
func testHostnameDefaultsToContainerID() async throws {
|
|
let id = "test-container-hostname-default"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/hostname"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(id)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "hostname should default to container id '\(id)', got '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
}
|
|
|
|
func testHostsFile() async throws {
|
|
let id = "test-container-hosts-file"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let entry = Hosts.Entry.localHostIPV4(comment: "Testaroo")
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat", "/etc/hosts"]
|
|
config.hosts = Hosts(entries: [entry])
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let expected = entry.rendered
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
}
|
|
|
|
func testProcessStdin() async throws {
|
|
let id = "test-container-stdin"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat"]
|
|
config.process.stdin = StdinBuffer(data: "Hello from test".data(using: .utf8)!)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
let expected = "Hello from test"
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "\(expected)" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned on stdout '\(expected)' != '\(String(data: buffer.data, encoding: .utf8)!)'")
|
|
}
|
|
}
|
|
|
|
func testMounts() async throws {
|
|
let id = "test-cat-mount"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
let directory = try createMountDirectory()
|
|
config.process.arguments = ["/bin/cat", "/mnt/hi.txt"]
|
|
config.mounts.append(.share(source: directory.path, destination: "/mnt"))
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let value = String(data: buffer.data, encoding: .utf8)
|
|
guard value == "hello" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned from file 'hello' != '\(String(data: buffer.data, encoding: .utf8)!)")
|
|
|
|
}
|
|
}
|
|
|
|
#if os(macOS)
|
|
func testNestedVirtualizationEnabled() async throws {
|
|
let id = "test-nested-virt"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/true"]
|
|
config.virtualization = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
} catch {
|
|
if let err = error as? ContainerizationError {
|
|
if err.code == .unsupported {
|
|
throw SkipTest(reason: err.message)
|
|
}
|
|
}
|
|
}
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
}
|
|
|
|
func testContainerManagerCreate() async throws {
|
|
let id = "test-container-manager"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
var manager = try ContainerManager(vmm: bs.vmm)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
config.process.arguments = ["/bin/echo", "ContainerManager test"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)
|
|
guard output == "ContainerManager test\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned 'ContainerManager test' != '\(output ?? "nil")'")
|
|
}
|
|
}
|
|
|
|
func testContainerStopIdempotency() async throws {
|
|
let id = "test-container-stop-idempotency"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
var manager = try ContainerManager(vmm: bs.vmm)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
config.process.arguments = ["/bin/echo", "please stop me"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
try await container.stop()
|
|
try await container.stop()
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)
|
|
guard output == "please stop me\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned 'ContainerManager test' != '\(output ?? "nil")'")
|
|
}
|
|
}
|
|
|
|
func testContainerReuse() async throws {
|
|
let id = "test-container-reuse"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
var manager = try ContainerManager(vmm: bs.vmm)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
config.process.arguments = ["/bin/echo", "ContainerManager test"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
var status = try await container.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
try await container.stop()
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Wait for completion.. again.
|
|
status = try await container.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)
|
|
let expected = "ContainerManager test\nContainerManager test\n"
|
|
guard output == expected else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have returned '\(expected)' != '\(output ?? "nil")'")
|
|
}
|
|
}
|
|
|
|
func testContainerDevConsole() async throws {
|
|
let id = "test-container-devconsole"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
var manager = try ContainerManager(vmm: bs.vmm)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
// We mount devtmpfs by default, and while this includes creating
|
|
// /dev/console typically that'll be pointing to /dev/hvc0 (the
|
|
// virtio serial console). This is just a character device, so a trivial
|
|
// way to check that our bind mounted console setup worked is by just
|
|
// parsing `mount`'s output and looking for /dev/console as it wouldn't
|
|
// be there normally without our dance.
|
|
config.process.arguments = ["mount"]
|
|
config.process.terminal = true
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let str = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(
|
|
msg: "failed to convert standard output to a UTF8 string")
|
|
}
|
|
|
|
let devConsole = "/dev/console"
|
|
guard str.contains(devConsole) else {
|
|
throw IntegrationError.assert(
|
|
msg: "process should have \(devConsole) in `mount` output")
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|
|
func testContainerStatistics() async throws {
|
|
let id = "test-container-statistics"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "infinity"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let stats = try await container.statistics()
|
|
|
|
guard stats.id == id else {
|
|
throw IntegrationError.assert(msg: "stats container ID '\(stats.id)' != '\(id)'")
|
|
}
|
|
|
|
guard let process = stats.process, process.current > 0 else {
|
|
throw IntegrationError.assert(msg: "process count should be > 0, got \(stats.process?.current ?? 0)")
|
|
}
|
|
|
|
guard let memory = stats.memory, memory.usageBytes > 0 else {
|
|
throw IntegrationError.assert(msg: "memory usage should be > 0, got \(stats.memory?.usageBytes ?? 0)")
|
|
}
|
|
|
|
guard let cpu = stats.cpu, cpu.usageUsec > 0 else {
|
|
throw IntegrationError.assert(msg: "CPU usage should be > 0, got \(stats.cpu?.usageUsec ?? 0)")
|
|
}
|
|
|
|
print("Container statistics:")
|
|
print(" Processes: \(process.current)")
|
|
print(" Memory: \(memory.usageBytes) bytes")
|
|
print(" CPU: \(cpu.usageUsec) usec")
|
|
print(" Networks: \(stats.networks?.count ?? 0) interfaces")
|
|
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCgroupLimits() async throws {
|
|
let id = "test-cgroup-limits"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "infinity"]
|
|
config.cpus = 2
|
|
config.memoryInBytes = 512.mib()
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Start an exec with sleep infinity
|
|
let sleepExec = try await container.exec("sleep-exec") { config in
|
|
config.arguments = ["sleep", "infinity"]
|
|
}
|
|
try await sleepExec.start()
|
|
|
|
// Verify we have 3 PIDs in cgroup.procs: init, exec sleep, and cat itself
|
|
let procsBuffer = BufferWriter()
|
|
let procsExec = try await container.exec("check-procs") { config in
|
|
config.arguments = ["cat", "/sys/fs/cgroup/cgroup.procs"]
|
|
config.stdout = procsBuffer
|
|
}
|
|
try await procsExec.start()
|
|
var status = try await procsExec.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "check-procs status \(status) != 0")
|
|
}
|
|
try await procsExec.delete()
|
|
|
|
guard let procsContent = String(data: procsBuffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to parse cgroup.procs")
|
|
}
|
|
let pids = procsContent.split(separator: "\n").filter { !$0.isEmpty }
|
|
guard pids.count == 3 else {
|
|
throw IntegrationError.assert(msg: "expected 3 PIDs in cgroup.procs, got \(pids.count): \(procsContent)")
|
|
}
|
|
|
|
// Verify memory limit
|
|
let memoryBuffer = BufferWriter()
|
|
let memoryExec = try await container.exec("check-memory") { config in
|
|
config.arguments = ["cat", "/sys/fs/cgroup/memory.max"]
|
|
config.stdout = memoryBuffer
|
|
}
|
|
try await memoryExec.start()
|
|
status = try await memoryExec.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "check-memory status \(status) != 0")
|
|
}
|
|
try await memoryExec.delete()
|
|
|
|
guard let memoryLimit = String(data: memoryBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to parse memory.max")
|
|
}
|
|
let expectedMemory = "\(512.mib())"
|
|
guard memoryLimit == expectedMemory else {
|
|
throw IntegrationError.assert(msg: "memory.max \(memoryLimit) != expected \(expectedMemory)")
|
|
}
|
|
|
|
// Verify CPU limit
|
|
let cpuBuffer = BufferWriter()
|
|
let cpuExec = try await container.exec("check-cpu") { config in
|
|
config.arguments = ["cat", "/sys/fs/cgroup/cpu.max"]
|
|
config.stdout = cpuBuffer
|
|
}
|
|
try await cpuExec.start()
|
|
status = try await cpuExec.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "check-cpu status \(status) != 0")
|
|
}
|
|
try await cpuExec.delete()
|
|
|
|
guard let cpuLimit = String(data: cpuBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to parse cpu.max")
|
|
}
|
|
let expectedCpu = "200000 100000" // 2 CPUs: quota=200000, period=100000
|
|
guard cpuLimit == expectedCpu else {
|
|
throw IntegrationError.assert(msg: "cpu.max '\(cpuLimit)' != expected '\(expectedCpu)'")
|
|
}
|
|
|
|
try await sleepExec.delete()
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testMemoryEventsOOMKill() async throws {
|
|
let id = "test-memory-events-oom-kill"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "infinity"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Run a process that will exceed the memory limit and get OOM-killed
|
|
let exec = try await container.exec("oom-trigger") { config in
|
|
// First set a 2MB memory limit on the container's cgroup, then allocate more
|
|
config.arguments = [
|
|
"sh",
|
|
"-c",
|
|
"echo 2097152 > /sys/fs/cgroup/memory.max && dd if=/dev/zero of=/dev/null bs=100M",
|
|
]
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
if status.exitCode == 0 {
|
|
throw IntegrationError.assert(msg: "expected exit code > 0")
|
|
}
|
|
try await exec.delete()
|
|
|
|
let stats = try await container.statistics(categories: .memoryEvents)
|
|
|
|
guard let events = stats.memoryEvents else {
|
|
throw IntegrationError.assert(msg: "expected memoryEvents to be present")
|
|
}
|
|
|
|
print("Memory events for container \(id):")
|
|
print(" low: \(events.low)")
|
|
print(" high: \(events.high)")
|
|
print(" max: \(events.max)")
|
|
print(" oom: \(events.oom)")
|
|
print(" oomKill: \(events.oomKill)")
|
|
|
|
guard events.oomKill > 0 else {
|
|
throw IntegrationError.assert(msg: "expected oomKill > 0, got \(events.oomKill)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testNoSerialConsole() async throws {
|
|
let id = "test-no-serial-console"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/true"]
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
}
|
|
|
|
func testUnixSocketIntoGuest() async throws {
|
|
let id = "test-unixsocket-into-guest"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostSocketPath = try createHostUnixSocket()
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.sockets = [
|
|
UnixSocketConfiguration(
|
|
source: URL(filePath: hostSocketPath),
|
|
destination: URL(filePath: "/tmp/test.sock"),
|
|
direction: .into
|
|
)
|
|
]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Execute ls -l to check the socket exists and is indeed a socket
|
|
let lsExec = try await container.exec("ls-socket") { config in
|
|
config.arguments = ["ls", "-l", "/tmp/test.sock"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await lsExec.start()
|
|
let status = try await lsExec.wait()
|
|
try await lsExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls command failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert ls output to UTF8")
|
|
}
|
|
|
|
// Socket files in ls -l output start with 's'
|
|
guard output.hasPrefix("s") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected socket file (starting with 's'), got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
// NOTE: Once upon a time our guest agent created any proxied unix sockets at
|
|
// a path that contained the container ID in it. The problem here is if the container
|
|
// ID is comically long we exceed the max length of a unix domain socket path.
|
|
func testUnixSocketIntoGuestLongContainerID() async throws {
|
|
let id = "test-unixsocket-long-id-" + String(repeating: "a", count: 40)
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostSocketPath = try createHostUnixSocket()
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.sockets = [
|
|
UnixSocketConfiguration(
|
|
source: URL(filePath: hostSocketPath),
|
|
destination: URL(filePath: "/tmp/test.sock"),
|
|
direction: .into
|
|
)
|
|
]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let lsExec = try await container.exec("ls-socket") { config in
|
|
config.arguments = ["ls", "-l", "/tmp/test.sock"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await lsExec.start()
|
|
let status = try await lsExec.wait()
|
|
try await lsExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls command failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert ls output to UTF8")
|
|
}
|
|
|
|
guard output.hasPrefix("s") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected socket file (starting with 's'), got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testNonClosureConstructor() async throws {
|
|
let id = "test-container-non-closure-constructor"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let config = LinuxContainer.Configuration(
|
|
process: LinuxProcessConfiguration(arguments: ["/bin/true"])
|
|
)
|
|
let container = try LinuxContainer(
|
|
id,
|
|
rootfs: bs.rootfs,
|
|
vmm: bs.vmm,
|
|
configuration: config
|
|
)
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
}
|
|
|
|
private func createHostUnixSocket() throws -> String {
|
|
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
let socketPath = dir.appendingPathComponent("test.sock").path
|
|
|
|
let socket = try Socket(type: UnixType(path: socketPath))
|
|
try socket.listen()
|
|
|
|
return socketPath
|
|
}
|
|
|
|
private func createMountDirectory() throws -> URL {
|
|
let dir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
try "hello".write(to: dir.appendingPathComponent("hi.txt"), atomically: true, encoding: .utf8)
|
|
return dir
|
|
}
|
|
|
|
func testUnixSocketIntoGuestSymlink() async throws {
|
|
let id = "test-unixsocket-into-guest-symlink"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostSocketPath = try createHostUnixSocket()
|
|
|
|
let buffer = BufferWriter()
|
|
// Use /var/run/test.sock. Alpine has /var/run -> /run symlink
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.sockets = [
|
|
UnixSocketConfiguration(
|
|
source: URL(filePath: hostSocketPath),
|
|
destination: URL(filePath: "/var/run/test.sock"),
|
|
direction: .into
|
|
)
|
|
]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let lsExec = try await container.exec("ls-socket") { config in
|
|
config.arguments = ["ls", "-l", "/var/run/test.sock"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await lsExec.start()
|
|
let status = try await lsExec.wait()
|
|
try await lsExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls command failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert ls output to UTF8")
|
|
}
|
|
|
|
// Socket files in ls -l output start with 's'
|
|
guard output.hasPrefix("s") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected socket file (starting with 's'), got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testBootLogFileHandle() async throws {
|
|
let id = "test-bootlog-filehandle"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a pipe to capture boot log data
|
|
let pipe = Pipe()
|
|
let bootLog = BootLog.fileHandle(pipe.fileHandleForWriting)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/echo", "test complete"]
|
|
config.bootLog = bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
try pipe.fileHandleForWriting.close()
|
|
let bootLogData = try pipe.fileHandleForReading.readToEnd()
|
|
guard let bootLogData = bootLogData, bootLogData.count > 0 else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected to receive boot log data from pipe, but got no data")
|
|
}
|
|
|
|
guard let bootLogString = String(data: bootLogData, encoding: .utf8) else {
|
|
throw IntegrationError.assert(
|
|
msg: "failed to convert boot log data to UTF8 string")
|
|
}
|
|
|
|
guard bootLogString.count > 100 else {
|
|
throw IntegrationError.assert(
|
|
msg: "boot log output smaller than expected: got \(bootLogString.count)")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testLargeStdioOutput() async throws {
|
|
let id = "test-large-stdout-stderr-output"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let stdoutBuffer = DiscardingWriter()
|
|
let stderrBuffer = DiscardingWriter()
|
|
|
|
let exec = try await container.exec("large-output") { config in
|
|
config.arguments = [
|
|
"sh",
|
|
"-c",
|
|
"""
|
|
dd if=/dev/zero bs=1M count=250 status=none && \
|
|
dd if=/dev/zero bs=1M count=250 status=none >&2
|
|
""",
|
|
]
|
|
config.stdout = stdoutBuffer
|
|
config.stderr = stderrBuffer
|
|
}
|
|
|
|
let started = Date().timeIntervalSinceReferenceDate
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
|
|
let lasted = Date().timeIntervalSinceReferenceDate - started
|
|
print("Test \(id) finished process ingesting stdio in \(lasted)")
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec process status \(status) != 0")
|
|
}
|
|
|
|
try await exec.delete()
|
|
|
|
let expectedSize = 250 * 1024 * 1024
|
|
guard stdoutBuffer.count == expectedSize else {
|
|
throw IntegrationError.assert(
|
|
msg: "stdout size \(stdoutBuffer.count) != expected \(expectedSize)")
|
|
}
|
|
|
|
guard stderrBuffer.count == expectedSize else {
|
|
throw IntegrationError.assert(
|
|
msg: "stderr size \(stderrBuffer.count) != expected \(expectedSize)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testProcessDeleteIdempotency() async throws {
|
|
let id = "test-process-delete-idempotency"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Create an exec process
|
|
let exec = try await container.exec("test-exec") { config in
|
|
config.arguments = ["/bin/true"]
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec process status \(status) != 0")
|
|
}
|
|
|
|
// Call delete twice to verify idempotency
|
|
try await exec.delete()
|
|
try await exec.delete() // Should be a no-op
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testMultipleExecsWithoutDelete() async throws {
|
|
let id = "test-multiple-execs-without-delete"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Create 3 exec processes without deleting them
|
|
let exec1 = try await container.exec("exec-1") { config in
|
|
config.arguments = ["/bin/true"]
|
|
}
|
|
try await exec1.start()
|
|
let status1 = try await exec1.wait()
|
|
guard status1.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec1 process status \(status1) != 0")
|
|
}
|
|
|
|
let exec2 = try await container.exec("exec-2") { config in
|
|
config.arguments = ["/bin/true"]
|
|
}
|
|
try await exec2.start()
|
|
let status2 = try await exec2.wait()
|
|
guard status2.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec2 process status \(status2) != 0")
|
|
}
|
|
|
|
let exec3 = try await container.exec("exec-3") { config in
|
|
config.arguments = ["/bin/true"]
|
|
}
|
|
try await exec3.start()
|
|
let status3 = try await exec3.wait()
|
|
guard status3.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec3 process status \(status3) != 0")
|
|
}
|
|
|
|
// Stop should handle cleanup of all exec processes gracefully
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testNonExistentBinary() async throws {
|
|
let id = "test-non-existent-binary"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["foo-bar-baz"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
do {
|
|
try await container.start()
|
|
} catch {
|
|
return
|
|
}
|
|
try await container.stop()
|
|
throw IntegrationError.assert(msg: "container start should have failed")
|
|
}
|
|
|
|
// MARK: - Capability Tests
|
|
|
|
func testCapabilitiesSysAdmin() async throws {
|
|
let id = "test-capabilities-sysadmin"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// First test: without CAP_SYS_ADMIN (should be denied)
|
|
let bufferDenied = BufferWriter()
|
|
let containerWithoutSysAdmin = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities()
|
|
config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp || echo 'mount failed as expected'"]
|
|
config.process.stdout = bufferDenied
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithoutSysAdmin.create()
|
|
try await containerWithoutSysAdmin.start()
|
|
|
|
var status = try await containerWithoutSysAdmin.wait()
|
|
try await containerWithoutSysAdmin.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container should have run successfully, got exit code \(status.exitCode)")
|
|
}
|
|
|
|
guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard outputDenied.contains("mount failed as expected") else {
|
|
throw IntegrationError.assert(msg: "expected mount failure message, got: \(outputDenied)")
|
|
}
|
|
|
|
// Second test: with CAP_SYS_ADMIN (should succeed)
|
|
let containerWithSysAdmin = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities(capabilities: [.sysAdmin])
|
|
config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithSysAdmin.create()
|
|
try await containerWithSysAdmin.start()
|
|
|
|
status = try await containerWithSysAdmin.wait()
|
|
try await containerWithSysAdmin.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container with CAP_SYS_ADMIN should mount successfully, got exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testCapabilitiesNetAdmin() async throws {
|
|
let id = "test-capabilities-netadmin"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// First test: without CAP_NET_ADMIN (should be denied)
|
|
let bufferDenied = BufferWriter()
|
|
let containerWithoutNetAdmin = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities()
|
|
config.process.arguments = ["/bin/sh", "-c", "ip link set lo down 2>/dev/null || echo 'network operation denied as expected'"]
|
|
config.process.stdout = bufferDenied
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithoutNetAdmin.create()
|
|
try await containerWithoutNetAdmin.start()
|
|
|
|
var status = try await containerWithoutNetAdmin.wait()
|
|
try await containerWithoutNetAdmin.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container should handle network denial gracefully, got exit code \(status.exitCode)")
|
|
}
|
|
|
|
guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard outputDenied.contains("network operation denied as expected") else {
|
|
throw IntegrationError.assert(msg: "expected network denial message, got: \(outputDenied)")
|
|
}
|
|
|
|
// Second test: with CAP_NET_ADMIN (should succeed)
|
|
let bufferAllowed = BufferWriter()
|
|
let containerWithNetAdmin = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities(capabilities: [.netAdmin])
|
|
config.process.arguments = ["/bin/sh", "-c", "ip link set lo down && ip link set lo up"]
|
|
config.process.stdout = bufferAllowed
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithNetAdmin.create()
|
|
try await containerWithNetAdmin.start()
|
|
|
|
status = try await containerWithNetAdmin.wait()
|
|
try await containerWithNetAdmin.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container with CAP_NET_ADMIN should perform network operations, got exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testCapabilitiesOCIDefault() async throws {
|
|
let id = "test-capabilities-OCI-default"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
// Use default capability set
|
|
config.process.capabilities = .defaultOCICapabilities
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'Running with OCI default capabilities'"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container with OCI default capabilities should run, got exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testCapabilitiesAllCapabilities() async throws {
|
|
let id = "test-capabilities-all"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = .allCapabilities
|
|
config.process.arguments = ["/bin/sh", "-c", "mount -t tmpfs tmpfs /tmp && ip link set lo down"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container with all capabilities should perform all operations, got exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testCapabilitiesFileOwnership() async throws {
|
|
let id = "test-capabilities-chown"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// First test: without CAP_CHOWN
|
|
let bufferDenied = BufferWriter()
|
|
let containerWithoutChown = try LinuxContainer("\(id)-denied", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities()
|
|
config.process.arguments = ["/bin/sh", "-c", "touch /tmp/testfile && chown 1000:1000 /tmp/testfile 2>/dev/null || echo 'chown denied as expected'"]
|
|
config.process.stdout = bufferDenied
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithoutChown.create()
|
|
try await containerWithoutChown.start()
|
|
|
|
var status = try await containerWithoutChown.wait()
|
|
try await containerWithoutChown.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container should handle chown denial gracefully, got exit code \(status.exitCode)")
|
|
}
|
|
|
|
guard let outputDenied = String(data: bufferDenied.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard outputDenied.contains("chown denied as expected") else {
|
|
throw IntegrationError.assert(msg: "expected chown denial message, got: \(outputDenied)")
|
|
}
|
|
|
|
// Second test: with CAP_CHOWN
|
|
let bufferAllowed = BufferWriter()
|
|
let containerWithChown = try LinuxContainer("\(id)-allowed", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.capabilities = LinuxCapabilities(capabilities: [.chown])
|
|
config.process.arguments = ["/bin/sh", "-c", "touch /tmp/testfile && chown 1000:1000 /tmp/testfile"]
|
|
config.process.stdout = bufferAllowed
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await containerWithChown.create()
|
|
try await containerWithChown.start()
|
|
|
|
status = try await containerWithChown.wait()
|
|
try await containerWithChown.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "container with CAP_CHOWN should succeed, got exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testDefaultMaskedAndReadonlyPaths() async throws {
|
|
let id = "test-masked-readonly-defaults"
|
|
|
|
// A default container (default capabilities + default masked/readonly
|
|
// paths) must have the OCI standard set enforced by vmexec without any
|
|
// opt-in. Probe from inside the guest:
|
|
// 1. readonlyPaths: writing under /proc/sys fails with EROFS. EROFS
|
|
// (not EPERM) proves the read-only remount rather than a mere
|
|
// capability denial — the default (restricted) caps already lack
|
|
// CAP_SYS_ADMIN, so a writable /proc/sys would fail with EPERM.
|
|
// The write is wrapped in a brace group so the shell's redirection
|
|
// failure ("can't create ...: Read-only file system") is captured:
|
|
// a trailing `2>&1` on the command misses it, because the failing
|
|
// `>` redirection aborts before `2>&1` is applied.
|
|
// 2. maskedPaths: at least one default-masked path is mounted over
|
|
// (visible in /proc/self/mountinfo). Checked via mountinfo rather
|
|
// than reading the target, since some masked paths (e.g.
|
|
// /proc/kcore) require CAP_SYS_RAWIO to read and would appear empty
|
|
// even if masking were broken, yielding a false pass.
|
|
let probe = """
|
|
set -u
|
|
rerr=$( { echo x > /proc/sys/kernel/hostname; } 2>&1 )
|
|
case "$rerr" in
|
|
*"Read-only file system"*) ;;
|
|
*) echo "RO-FAIL: writing /proc/sys expected EROFS, got: ${rerr:-<write succeeded>}"; exit 1 ;;
|
|
esac
|
|
masked=0
|
|
for p in /proc/kcore /proc/keys /proc/scsi /proc/sched_debug /sys/firmware /sys/devices/virtual/powercap; do
|
|
grep -q " $p " /proc/self/mountinfo && masked=$((masked + 1))
|
|
done
|
|
if [ "$masked" -eq 0 ]; then
|
|
echo "MASK-FAIL: no default masked path mounted"
|
|
cat /proc/self/mountinfo
|
|
exit 1
|
|
fi
|
|
echo "MASKED-RO-OK masked=$masked"
|
|
"""
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
// Intentionally leave config.maskedPaths / readonlyPaths /
|
|
// process.capabilities untouched — the point is that the defaults
|
|
// are secure out of the box.
|
|
config.process.arguments = ["/bin/sh", "-c", probe]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8) ?? "<non-utf8 output>"
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "default masked/readonly enforcement failed (exit \(status.exitCode)): \(output)")
|
|
}
|
|
guard output.contains("MASKED-RO-OK") else {
|
|
throw IntegrationError.assert(msg: "expected MASKED-RO-OK sentinel, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testStat() async throws {
|
|
let id = "test-stat"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
func assertExec(_ container: LinuxContainer, id: String, cmd: String) async throws {
|
|
let exec = try await container.exec(id) { config in
|
|
config.arguments = ["sh", "-c", cmd]
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "\(id) failed with exit code \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// regular file: "regular file" is exactly 12 bytes
|
|
try await assertExec(container, id: "create-regular-file", cmd: "echo -n 'regular file' > /tmp/regular-file.txt")
|
|
// directory
|
|
try await assertExec(container, id: "create-dir", cmd: "mkdir /tmp/test-dir")
|
|
// relative symlink so stat() resolves the target within the same directory
|
|
try await assertExec(container, id: "create-symlink", cmd: "ln -s regular-file.txt /tmp/test-link")
|
|
// FIFO
|
|
try await assertExec(container, id: "create-fifo", cmd: "mkfifo /tmp/test-fifo")
|
|
|
|
let vsock = try await container.dialVsock(port: 1024)
|
|
let vminitd = try await Vminitd(connection: vsock, group: Self.eventLoop)
|
|
|
|
let root = URL(filePath: container.root)
|
|
|
|
// --- regular file ---
|
|
let regularStat = try await vminitd.stat(path: root.appending(path: "tmp/regular-file.txt"))
|
|
guard (regularStat.mode & UInt32(S_IFMT)) == S_IFREG else {
|
|
throw IntegrationError.assert(msg: "regular file: expected S_IFREG, got mode 0x\(String(regularStat.mode, radix: 16))")
|
|
}
|
|
guard regularStat.size == 12 else {
|
|
throw IntegrationError.assert(msg: "regular file: expected size 12, got \(regularStat.size)")
|
|
}
|
|
guard regularStat.ino > 0 else {
|
|
throw IntegrationError.assert(msg: "regular file: expected non-zero inode, got \(regularStat.ino)")
|
|
}
|
|
guard regularStat.nlink >= 1 else {
|
|
throw IntegrationError.assert(msg: "regular file: expected nlink >= 1, got \(regularStat.nlink)")
|
|
}
|
|
|
|
// --- directory ---
|
|
let dirStat = try await vminitd.stat(path: root.appending(path: "tmp/test-dir"))
|
|
guard (dirStat.mode & UInt32(S_IFMT)) == S_IFDIR else {
|
|
throw IntegrationError.assert(msg: "directory: expected S_IFDIR, got mode 0x\(String(dirStat.mode, radix: 16))")
|
|
}
|
|
// A directory always has at least 2 hard links (. and its entry in the parent)
|
|
guard dirStat.nlink >= 2 else {
|
|
throw IntegrationError.assert(msg: "directory: expected nlink >= 2, got \(dirStat.nlink)")
|
|
}
|
|
|
|
// --- symlink ---
|
|
// stat(2) follows symlinks, so the result reflects the target regular file
|
|
let symlinkStat = try await vminitd.stat(path: root.appending(path: "tmp/test-link"))
|
|
guard (symlinkStat.mode & UInt32(S_IFMT)) == S_IFREG else {
|
|
throw IntegrationError.assert(msg: "symlink (followed): expected S_IFREG, got mode 0x\(String(symlinkStat.mode, radix: 16))")
|
|
}
|
|
guard symlinkStat.size == regularStat.size else {
|
|
throw IntegrationError.assert(msg: "symlink (followed): expected size \(regularStat.size), got \(symlinkStat.size)")
|
|
}
|
|
|
|
// --- FIFO ---
|
|
let fifoStat = try await vminitd.stat(path: root.appending(path: "tmp/test-fifo"))
|
|
guard (fifoStat.mode & UInt32(S_IFMT)) == S_IFIFO else {
|
|
throw IntegrationError.assert(msg: "FIFO: expected S_IFIFO, got mode 0x\(String(fifoStat.mode, radix: 16))")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyIn() async throws {
|
|
let id = "test-copy-in"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp file on the host with known content
|
|
let testContent = "Hello from the host! This is a copyIn test."
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("test-input.txt")
|
|
try testContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy the file into the container
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/copied-file.txt")
|
|
)
|
|
|
|
// Verify the file exists and has correct content
|
|
let exec = try await container.exec("verify-copy") { config in
|
|
config.arguments = ["cat", "/tmp/copied-file.txt"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat command failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output == testContent else {
|
|
throw IntegrationError.assert(
|
|
msg: "copied file content mismatch: expected '\(testContent)', got '\(output)'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyInFileToExistingDirectory() async throws {
|
|
let id = "test-copy-in-file-to-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let testContent = "copy into an existing guest directory"
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("host-file.txt")
|
|
try testContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let mkdir = try await container.exec("create-copy-target") { config in
|
|
config.arguments = ["mkdir", "-p", "/tmp/copy-target"]
|
|
}
|
|
try await mkdir.start()
|
|
let mkdirStatus = try await mkdir.wait()
|
|
try await mkdir.delete()
|
|
|
|
guard mkdirStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "mkdir failed with status \(mkdirStatus)")
|
|
}
|
|
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/copy-target")
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let verify = try await container.exec("verify-copy-target") { config in
|
|
config.arguments = ["cat", "/tmp/copy-target/host-file.txt"]
|
|
config.stdout = buffer
|
|
}
|
|
try await verify.start()
|
|
let verifyStatus = try await verify.wait()
|
|
try await verify.delete()
|
|
|
|
guard verifyStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat copied file failed with status \(verifyStatus)")
|
|
}
|
|
guard String(data: buffer.data, encoding: .utf8) == testContent else {
|
|
throw IntegrationError.assert(msg: "copied file should land under the existing destination directory")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyInFileToMissingDirectoryFails() async throws {
|
|
let id = "test-copy-in-file-missing-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("host-file.txt")
|
|
try "missing destination directory".write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
do {
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/missing-copy-target/")
|
|
)
|
|
throw IntegrationError.assert(msg: "copyIn should fail when copying a file to a missing destination directory")
|
|
} catch let error as ContainerizationError where error.code == .invalidArgument {
|
|
guard error.description.contains("destination directory does not exist") else {
|
|
throw IntegrationError.assert(msg: "unexpected copyIn error: \(error)")
|
|
}
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyInDirectoryOverExistingFileFails() async throws {
|
|
let id = "test-copy-in-dir-over-file"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("host-dir")
|
|
try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true)
|
|
try "directory content".write(to: hostDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let createFile = try await container.exec("create-existing-file") { config in
|
|
config.arguments = ["sh", "-c", "echo -n existing > /tmp/existing-file"]
|
|
}
|
|
try await createFile.start()
|
|
let createStatus = try await createFile.wait()
|
|
try await createFile.delete()
|
|
|
|
guard createStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "failed to create existing file, status \(createStatus)")
|
|
}
|
|
|
|
do {
|
|
try await container.copyIn(
|
|
from: hostDir,
|
|
to: URL(filePath: "/tmp/existing-file")
|
|
)
|
|
throw IntegrationError.assert(msg: "copyIn should fail when copying a directory over an existing file")
|
|
} catch let error as ContainerizationError where error.code == .invalidArgument {
|
|
guard error.description.contains("cannot copy directory over existing file") else {
|
|
throw IntegrationError.assert(msg: "unexpected copyIn error: \(error)")
|
|
}
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyOut() async throws {
|
|
let id = "test-copy-out"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let testContent = "Hello from the guest! This is a copyOut test."
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("test-output.txt")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Create a file inside the container
|
|
let exec = try await container.exec("create-file") { config in
|
|
config.arguments = ["sh", "-c", "echo -n '\(testContent)' > /tmp/guest-file.txt"]
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "failed to create file in guest, status \(status)")
|
|
}
|
|
|
|
// Copy the file out of the container
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/guest-file.txt"),
|
|
to: hostDestination
|
|
)
|
|
|
|
// Verify the file was copied correctly
|
|
let copiedContent = try String(contentsOf: hostDestination, encoding: .utf8)
|
|
|
|
guard copiedContent == testContent else {
|
|
throw IntegrationError.assert(
|
|
msg: "copied file content mismatch: expected '\(testContent)', got '\(copiedContent)'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyLargeFile() async throws {
|
|
let id = "test-copy-large-file"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a 10MB file on the host with a repeating pattern
|
|
let fileSize = 10 * 1024 * 1024
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("large-file.bin")
|
|
|
|
// Generate data with a repeating pattern
|
|
let pattern = Data("ContainerizationCopyTest".utf8)
|
|
var testData = Data(capacity: fileSize)
|
|
while testData.count < fileSize {
|
|
testData.append(pattern)
|
|
}
|
|
testData = testData.prefix(fileSize)
|
|
try testData.write(to: hostFile)
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("large-file-out.bin")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy large file into the container
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/large-file.bin")
|
|
)
|
|
|
|
// Copy it back out
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/large-file.bin"),
|
|
to: hostDestination
|
|
)
|
|
|
|
// Verify the content matches
|
|
let copiedData = try Data(contentsOf: hostDestination)
|
|
|
|
guard copiedData.count == testData.count else {
|
|
throw IntegrationError.assert(
|
|
msg: "file size mismatch: expected \(testData.count), got \(copiedData.count)")
|
|
}
|
|
|
|
guard copiedData == testData else {
|
|
throw IntegrationError.assert(msg: "file content mismatch after round-trip copy")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyInDirectory() async throws {
|
|
let id = "test-copy-in-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp directory with files, a subdirectory, and a symlink.
|
|
let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("test-dir")
|
|
try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true)
|
|
try "file1 content".write(to: hostDir.appendingPathComponent("file1.txt"), atomically: true, encoding: .utf8)
|
|
|
|
let subDir = hostDir.appendingPathComponent("subdir")
|
|
try FileManager.default.createDirectory(at: subDir, withIntermediateDirectories: true)
|
|
try "file2 content".write(to: subDir.appendingPathComponent("file2.txt"), atomically: true, encoding: .utf8)
|
|
|
|
try FileManager.default.createSymbolicLink(
|
|
at: hostDir.appendingPathComponent("link.txt"),
|
|
withDestinationURL: hostDir.appendingPathComponent("file1.txt")
|
|
)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy the directory into the container.
|
|
try await container.copyIn(
|
|
from: hostDir,
|
|
to: URL(filePath: "/tmp/copied-dir")
|
|
)
|
|
|
|
// Verify file1.txt exists with correct content.
|
|
let buffer1 = BufferWriter()
|
|
let exec1 = try await container.exec("verify-file1") { config in
|
|
config.arguments = ["cat", "/tmp/copied-dir/file1.txt"]
|
|
config.stdout = buffer1
|
|
}
|
|
try await exec1.start()
|
|
let status1 = try await exec1.wait()
|
|
try await exec1.delete()
|
|
|
|
guard status1.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat file1.txt failed with status \(status1)")
|
|
}
|
|
guard String(data: buffer1.data, encoding: .utf8) == "file1 content" else {
|
|
throw IntegrationError.assert(msg: "file1.txt content mismatch")
|
|
}
|
|
|
|
// Verify subdir/file2.txt exists with correct content.
|
|
let buffer2 = BufferWriter()
|
|
let exec2 = try await container.exec("verify-file2") { config in
|
|
config.arguments = ["cat", "/tmp/copied-dir/subdir/file2.txt"]
|
|
config.stdout = buffer2
|
|
}
|
|
try await exec2.start()
|
|
let status2 = try await exec2.wait()
|
|
try await exec2.delete()
|
|
|
|
guard status2.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat subdir/file2.txt failed with status \(status2)")
|
|
}
|
|
guard String(data: buffer2.data, encoding: .utf8) == "file2 content" else {
|
|
throw IntegrationError.assert(msg: "subdir/file2.txt content mismatch")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyOutDirectory() async throws {
|
|
let id = "test-copy-out-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("copied-out-dir")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Create a directory structure inside the container.
|
|
let exec = try await container.exec("create-dir") { config in
|
|
config.arguments = [
|
|
"sh", "-c",
|
|
"mkdir -p /tmp/guest-dir/subdir && echo -n 'guest file1' > /tmp/guest-dir/file1.txt && echo -n 'guest file2' > /tmp/guest-dir/subdir/file2.txt",
|
|
]
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "failed to create directory in guest, status \(status)")
|
|
}
|
|
|
|
// Copy the directory out of the container.
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/guest-dir"),
|
|
to: hostDestination
|
|
)
|
|
|
|
// Verify file1.txt was copied correctly.
|
|
let file1Content = try String(contentsOf: hostDestination.appendingPathComponent("file1.txt"), encoding: .utf8)
|
|
guard file1Content == "guest file1" else {
|
|
throw IntegrationError.assert(
|
|
msg: "file1.txt content mismatch: expected 'guest file1', got '\(file1Content)'")
|
|
}
|
|
|
|
// Verify subdir/file2.txt was copied correctly.
|
|
let file2Content = try String(
|
|
contentsOf: hostDestination.appendingPathComponent("subdir").appendingPathComponent("file2.txt"),
|
|
encoding: .utf8
|
|
)
|
|
guard file2Content == "guest file2" else {
|
|
throw IntegrationError.assert(
|
|
msg: "subdir/file2.txt content mismatch: expected 'guest file2', got '\(file2Content)'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyEmptyFile() async throws {
|
|
let id = "test-copy-empty-file"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("empty.txt")
|
|
try Data().write(to: hostFile)
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("empty-out.txt")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy empty file in.
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/empty.txt")
|
|
)
|
|
|
|
// Verify it exists and is empty in the guest.
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("verify-empty") { config in
|
|
config.arguments = ["stat", "-c", "%s", "/tmp/empty.txt"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "stat failed with status \(status)")
|
|
}
|
|
let sizeStr = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
guard sizeStr == "0" else {
|
|
throw IntegrationError.assert(msg: "empty file should have size 0, got '\(sizeStr ?? "nil")'")
|
|
}
|
|
|
|
// Copy it back out.
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/empty.txt"),
|
|
to: hostDestination
|
|
)
|
|
|
|
let copiedData = try Data(contentsOf: hostDestination)
|
|
guard copiedData.isEmpty else {
|
|
throw IntegrationError.assert(msg: "round-tripped empty file should be empty, got \(copiedData.count) bytes")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyEmptyDirectory() async throws {
|
|
let id = "test-copy-empty-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("empty-dir")
|
|
try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy empty directory in.
|
|
try await container.copyIn(
|
|
from: hostDir,
|
|
to: URL(filePath: "/tmp/empty-dir")
|
|
)
|
|
|
|
// Verify it exists and is a directory.
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("verify-empty-dir") { config in
|
|
config.arguments = ["sh", "-c", "test -d /tmp/empty-dir && ls -a /tmp/empty-dir | wc -l"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "empty dir check failed with status \(status)")
|
|
}
|
|
|
|
// ls -a shows . and .. so count should be 2 for an empty dir.
|
|
let countStr = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
guard countStr == "2" else {
|
|
throw IntegrationError.assert(msg: "empty dir should have 2 entries (. and ..), got '\(countStr ?? "nil")'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyBinaryFile() async throws {
|
|
let id = "test-copy-binary"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a file with all 256 byte values to test binary safety.
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("binary.bin")
|
|
var binaryData = Data(count: 256 * 64)
|
|
for i in 0..<binaryData.count {
|
|
binaryData[i] = UInt8(i % 256)
|
|
}
|
|
try binaryData.write(to: hostFile)
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("binary-out.bin")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/binary.bin")
|
|
)
|
|
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/binary.bin"),
|
|
to: hostDestination
|
|
)
|
|
|
|
let copiedData = try Data(contentsOf: hostDestination)
|
|
|
|
guard copiedData.count == binaryData.count else {
|
|
throw IntegrationError.assert(
|
|
msg: "binary file size mismatch: expected \(binaryData.count), got \(copiedData.count)")
|
|
}
|
|
guard copiedData == binaryData else {
|
|
throw IntegrationError.assert(msg: "binary file content mismatch after round-trip")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyMultipleFiles() async throws {
|
|
let id = "test-copy-multiple"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let tmpDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
let files = (0..<5).map { i in
|
|
(
|
|
host: tmpDir.appendingPathComponent("file\(i).txt"),
|
|
guest: URL(filePath: "/tmp/multi/file\(i).txt"),
|
|
content: "Content of file \(i) with some padding: \(String(repeating: "x", count: i * 1000))"
|
|
)
|
|
}
|
|
|
|
for file in files {
|
|
try file.content.write(to: file.host, atomically: true, encoding: .utf8)
|
|
}
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy all files in sequentially.
|
|
for file in files {
|
|
try await container.copyIn(
|
|
from: file.host,
|
|
to: file.guest,
|
|
createParents: true
|
|
)
|
|
}
|
|
|
|
// Verify each file.
|
|
for (i, file) in files.enumerated() {
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("verify-\(i)") { config in
|
|
config.arguments = ["cat", file.guest.path]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat file\(i).txt failed with status \(status)")
|
|
}
|
|
let output = String(data: buffer.data, encoding: .utf8)
|
|
guard output == file.content else {
|
|
throw IntegrationError.assert(msg: "file\(i).txt content mismatch")
|
|
}
|
|
}
|
|
|
|
// Copy all files back out and verify.
|
|
for (i, file) in files.enumerated() {
|
|
let outPath = tmpDir.appendingPathComponent("out-file\(i).txt")
|
|
try await container.copyOut(
|
|
from: file.guest,
|
|
to: outPath
|
|
)
|
|
let copiedContent = try String(contentsOf: outPath, encoding: .utf8)
|
|
guard copiedContent == file.content else {
|
|
throw IntegrationError.assert(msg: "file\(i).txt round-trip content mismatch")
|
|
}
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyDirectoryRoundTrip() async throws {
|
|
let id = "test-copy-dir-rt"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a directory tree with varied content: nested dirs, different sizes, binary data.
|
|
let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("dir-rt")
|
|
try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true)
|
|
|
|
// Top-level files.
|
|
try "top level".write(to: hostDir.appendingPathComponent("root.txt"), atomically: true, encoding: .utf8)
|
|
try Data(repeating: 0xAB, count: 4096).write(to: hostDir.appendingPathComponent("binary.bin"))
|
|
|
|
// Nested 3 levels deep.
|
|
let deep = hostDir.appendingPathComponent("a").appendingPathComponent("b").appendingPathComponent("c")
|
|
try FileManager.default.createDirectory(at: deep, withIntermediateDirectories: true)
|
|
try "deep file".write(to: deep.appendingPathComponent("deep.txt"), atomically: true, encoding: .utf8)
|
|
|
|
// Empty subdirectory.
|
|
let emptySubdir = hostDir.appendingPathComponent("empty-sub")
|
|
try FileManager.default.createDirectory(at: emptySubdir, withIntermediateDirectories: true)
|
|
|
|
// File with special characters in content (not name).
|
|
try "line1\nline2\ttab\r\nwindows\0null".write(
|
|
to: hostDir.appendingPathComponent("special.txt"), atomically: true, encoding: .utf8)
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("dir-rt-out")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy in.
|
|
try await container.copyIn(
|
|
from: hostDir,
|
|
to: URL(filePath: "/tmp/dir-rt")
|
|
)
|
|
|
|
// Copy back out.
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/dir-rt"),
|
|
to: hostDestination
|
|
)
|
|
|
|
// Verify root.txt.
|
|
let rootContent = try String(contentsOf: hostDestination.appendingPathComponent("root.txt"), encoding: .utf8)
|
|
guard rootContent == "top level" else {
|
|
throw IntegrationError.assert(msg: "root.txt mismatch: '\(rootContent)'")
|
|
}
|
|
|
|
// Verify binary.bin.
|
|
let binaryContent = try Data(contentsOf: hostDestination.appendingPathComponent("binary.bin"))
|
|
guard binaryContent == Data(repeating: 0xAB, count: 4096) else {
|
|
throw IntegrationError.assert(msg: "binary.bin mismatch")
|
|
}
|
|
|
|
// Verify deep nested file.
|
|
let deepOut =
|
|
hostDestination
|
|
.appendingPathComponent("a")
|
|
.appendingPathComponent("b")
|
|
.appendingPathComponent("c")
|
|
.appendingPathComponent("deep.txt")
|
|
let deepContent = try String(contentsOf: deepOut, encoding: .utf8)
|
|
guard deepContent == "deep file" else {
|
|
throw IntegrationError.assert(msg: "deep.txt mismatch: '\(deepContent)'")
|
|
}
|
|
|
|
// Verify empty subdirectory exists.
|
|
var isDir: ObjCBool = false
|
|
let emptySubdirExists = FileManager.default.fileExists(
|
|
atPath: hostDestination.appendingPathComponent("empty-sub").path,
|
|
isDirectory: &isDir
|
|
)
|
|
guard emptySubdirExists && isDir.boolValue else {
|
|
throw IntegrationError.assert(msg: "empty-sub directory should exist after round trip")
|
|
}
|
|
|
|
// Verify special characters file.
|
|
let specialContent = try String(
|
|
contentsOf: hostDestination.appendingPathComponent("special.txt"), encoding: .utf8)
|
|
guard specialContent == "line1\nline2\ttab\r\nwindows\0null" else {
|
|
throw IntegrationError.assert(msg: "special.txt mismatch")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyInCreateParents() async throws {
|
|
let id = "test-copy-parents"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let testContent = "create parents test"
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("parents-test.txt")
|
|
try testContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy to a deeply nested path that doesn't exist yet.
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/a/b/c/d/e/file.txt"),
|
|
createParents: true
|
|
)
|
|
|
|
// Verify the file got there.
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("verify-parents") { config in
|
|
config.arguments = ["cat", "/tmp/a/b/c/d/e/file.txt"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat failed with status \(status)")
|
|
}
|
|
guard String(data: buffer.data, encoding: .utf8) == testContent else {
|
|
throw IntegrationError.assert(msg: "content mismatch after copy with createParents")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyFilePermissions() async throws {
|
|
let id = "test-copy-perms"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("perms-test.sh")
|
|
try "#!/bin/sh\necho hello".write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Copy with executable permissions.
|
|
try await container.copyIn(
|
|
from: hostFile,
|
|
to: URL(filePath: "/tmp/perms-test.sh"),
|
|
mode: 0o755
|
|
)
|
|
|
|
// Verify the file is executable by running it.
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("run-script") { config in
|
|
config.arguments = ["/tmp/perms-test.sh"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "script execution failed with status \(status)")
|
|
}
|
|
let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
guard output == "hello" else {
|
|
throw IntegrationError.assert(msg: "script output mismatch: '\(output ?? "nil")'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testCopyLargeDirectory() async throws {
|
|
let id = "test-copy-large-dir"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a directory with many files to stress the archive path.
|
|
let hostDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("large-dir")
|
|
try FileManager.default.createDirectory(at: hostDir, withIntermediateDirectories: true)
|
|
|
|
let fileCount = 100
|
|
for i in 0..<fileCount {
|
|
let content = "File \(i): \(String(repeating: String(i), count: 512))"
|
|
try content.write(
|
|
to: hostDir.appendingPathComponent("file-\(String(format: "%03d", i)).txt"),
|
|
atomically: true,
|
|
encoding: .utf8
|
|
)
|
|
}
|
|
|
|
let hostDestination = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("large-dir-out")
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
try await container.copyIn(
|
|
from: hostDir,
|
|
to: URL(filePath: "/tmp/large-dir")
|
|
)
|
|
|
|
// Verify file count in the guest.
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("count-files") { config in
|
|
config.arguments = ["sh", "-c", "ls /tmp/large-dir/*.txt | wc -l"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls | wc -l failed with status \(status)")
|
|
}
|
|
let countStr = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
guard countStr == "\(fileCount)" else {
|
|
throw IntegrationError.assert(msg: "expected \(fileCount) files in guest, got '\(countStr ?? "nil")'")
|
|
}
|
|
|
|
// Copy back out.
|
|
try await container.copyOut(
|
|
from: URL(filePath: "/tmp/large-dir"),
|
|
to: hostDestination
|
|
)
|
|
|
|
// Spot-check a few files.
|
|
for i in [0, fileCount / 2, fileCount - 1] {
|
|
let expectedContent = "File \(i): \(String(repeating: String(i), count: 512))"
|
|
let actualContent = try String(
|
|
contentsOf: hostDestination.appendingPathComponent("file-\(String(format: "%03d", i)).txt"),
|
|
encoding: .utf8
|
|
)
|
|
guard actualContent == expectedContent else {
|
|
throw IntegrationError.assert(msg: "file-\(String(format: "%03d", i)).txt content mismatch after round trip")
|
|
}
|
|
}
|
|
|
|
// Verify total file count on host.
|
|
let outFiles = try FileManager.default.contentsOfDirectory(atPath: hostDestination.path)
|
|
guard outFiles.count == fileCount else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected \(fileCount) files on host after copyOut, got \(outFiles.count)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testReadOnlyRootfs() async throws {
|
|
let id = "test-readonly-rootfs"
|
|
|
|
let bs = try await bootstrap(id)
|
|
var rootfs = bs.rootfs
|
|
rootfs.options.append("ro")
|
|
let container = try LinuxContainer(id, rootfs: rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["touch", "/testfile"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
// touch should fail on a read-only rootfs
|
|
guard status.exitCode != 0 else {
|
|
throw IntegrationError.assert(msg: "touch should have failed on read-only rootfs")
|
|
}
|
|
}
|
|
|
|
func testReadOnlyRootfsHostsFileWritten() async throws {
|
|
let id = "test-readonly-rootfs-hosts"
|
|
|
|
let bs = try await bootstrap(id)
|
|
var rootfs = bs.rootfs
|
|
rootfs.options.append("ro")
|
|
let buffer = BufferWriter()
|
|
let entry = Hosts.Entry.localHostIPV4(comment: "ReadOnlyTest")
|
|
let container = try LinuxContainer(id, rootfs: rootfs, vmm: bs.vmm) { config in
|
|
// Verify /etc/hosts was written before rootfs was remounted read-only
|
|
config.process.arguments = ["cat", "/etc/hosts"]
|
|
config.process.stdout = buffer
|
|
config.hosts = Hosts(entries: [entry])
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat /etc/hosts failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.contains("ReadOnlyTest") else {
|
|
throw IntegrationError.assert(msg: "expected /etc/hosts to contain our entry, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testReadOnlyRootfsDNSConfigured() async throws {
|
|
let id = "test-readonly-rootfs-dns"
|
|
|
|
let bs = try await bootstrap(id)
|
|
var rootfs = bs.rootfs
|
|
rootfs.options.append("ro")
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: rootfs, vmm: bs.vmm) { config in
|
|
// Verify /etc/resolv.conf was written before rootfs was remounted read-only
|
|
config.process.arguments = ["cat", "/etc/resolv.conf"]
|
|
config.process.stdout = buffer
|
|
config.dns = DNS(nameservers: ["8.8.8.8", "8.8.4.4"])
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "cat /etc/resolv.conf failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.contains("8.8.8.8") && output.contains("8.8.4.4") else {
|
|
throw IntegrationError.assert(msg: "expected /etc/resolv.conf to contain DNS servers, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testLargeStdinInput() async throws {
|
|
let id = "test-large-stdin-input"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let inputSize = 128 * 1024
|
|
let inputData = Data(repeating: 0x41, count: inputSize) // 'A' repeated
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat"]
|
|
config.process.stdin = StdinBuffer(data: inputData)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard buffer.data.count == inputSize else {
|
|
throw IntegrationError.assert(
|
|
msg: "output size \(buffer.data.count) != input size \(inputSize)")
|
|
}
|
|
|
|
guard buffer.data == inputData else {
|
|
throw IntegrationError.assert(msg: "output data does not match input data")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testExecLargeStdinInput() async throws {
|
|
let id = "test-exec-large-stdin-input"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let inputSize = 128 * 1024
|
|
let inputData = Data(repeating: 0x42, count: inputSize)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("large-stdin-exec") { config in
|
|
config.arguments = ["cat"]
|
|
config.stdin = StdinBuffer(data: inputData)
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec status \(status) != 0")
|
|
}
|
|
|
|
guard buffer.data.count == inputSize else {
|
|
throw IntegrationError.assert(msg: "output size \(buffer.data.count) != \(inputSize)")
|
|
}
|
|
|
|
guard buffer.data == inputData else {
|
|
throw IntegrationError.assert(msg: "output data mismatch")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testExecCustomPathResolution() async throws {
|
|
let id = "test-exec-custom-path"
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Create a script in a non-standard directory
|
|
let setup = try await container.exec("setup") { config in
|
|
config.arguments = [
|
|
"sh", "-c",
|
|
"mkdir -p /tmp/custom-bin && printf '#!/bin/sh\\necho CUSTOM_PATH_OK' > /tmp/custom-bin/mytest && chmod +x /tmp/custom-bin/mytest",
|
|
]
|
|
}
|
|
try await setup.start()
|
|
let setupStatus = try await setup.wait()
|
|
try await setup.delete()
|
|
guard setupStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "setup failed: \(setupStatus)")
|
|
}
|
|
|
|
// Exec bare command with custom PATH — this exercises ExecCommand.swift
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("custom-path") { config in
|
|
config.arguments = ["mytest"]
|
|
config.environmentVariables = ["PATH=/tmp/custom-bin"]
|
|
config.stdout = buffer
|
|
}
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec with custom PATH failed: \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to read output")
|
|
}
|
|
guard output.contains("CUSTOM_PATH_OK") else {
|
|
throw IntegrationError.assert(msg: "expected CUSTOM_PATH_OK, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testStdinExplicitClose() async throws {
|
|
let id = "test-stdin-explicit-close"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let inputData = "explicit close test\n".data(using: .utf8)!
|
|
let buffer = BufferWriter()
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let exec = try await container.exec("stdin-close-exec") { config in
|
|
config.arguments = ["head", "-n", "1"]
|
|
config.stdin = StdinBuffer(data: inputData)
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec status \(status) != 0")
|
|
}
|
|
|
|
guard buffer.data == inputData else {
|
|
throw IntegrationError.assert(msg: "output mismatch")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testStdinBinaryData() async throws {
|
|
let id = "test-stdin-binary-data"
|
|
let bs = try await bootstrap(id)
|
|
|
|
var inputData = Data()
|
|
for i: UInt8 in 0...255 {
|
|
inputData.append(contentsOf: [UInt8](repeating: i, count: 256))
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat"]
|
|
config.process.stdin = StdinBuffer(data: inputData)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard buffer.data == inputData else {
|
|
throw IntegrationError.assert(msg: "binary data mismatch")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testStdinMultipleChunks() async throws {
|
|
let id = "test-stdin-multiple-chunks"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let chunks = (0..<10).map { i in
|
|
Data(repeating: UInt8(0x30 + i), count: 10 * 1024)
|
|
}
|
|
let expectedData = chunks.reduce(Data()) { $0 + $1 }
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat"]
|
|
config.process.stdin = ChunkedStdinBuffer(chunks: chunks, delayMs: 10)
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard buffer.data == expectedData else {
|
|
throw IntegrationError.assert(msg: "chunked data mismatch")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testStdinVeryLarge() async throws {
|
|
let id = "test-stdin-very-large"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let inputSize = 10 * 1024 * 1024
|
|
let inputData = Data(repeating: 0x58, count: inputSize)
|
|
|
|
let stdout = DiscardingWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["wc", "-c"]
|
|
config.process.stdin = StdinBuffer(data: inputData)
|
|
config.process.stdout = stdout
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard stdout.count > 0 else {
|
|
throw IntegrationError.assert(msg: "no output from wc")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
#if os(macOS)
|
|
@available(macOS 26.0, *)
|
|
func testInterfaceMTU() async throws {
|
|
let id = "test-interface-mtu"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let customMTU: UInt32 = 1400
|
|
var network = try VmnetNetwork()
|
|
defer {
|
|
try? network.releaseInterface(id)
|
|
}
|
|
|
|
guard let interface = try network.createInterface(id, mtu: customMTU) else {
|
|
throw IntegrationError.assert(msg: "failed to create network interface")
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Check the MTU of eth0
|
|
let exec = try await container.exec("check-mtu") { config in
|
|
config.arguments = ["ip", "link", "show", "eth0"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip link show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// Output should contain "mtu 1400"
|
|
guard output.contains("mtu \(customMTU)") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected MTU \(customMTU) in output, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|
|
func testSingleFileMount() async throws {
|
|
let id = "test-single-file-mount"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp file with known content
|
|
let testContent = "Hello from single file mount!"
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("config.txt")
|
|
try testContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat", "/etc/myconfig.txt"]
|
|
// Mount a single file using virtiofs share
|
|
config.mounts.append(.share(source: hostFile.path, destination: "/etc/myconfig.txt"))
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output == testContent else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected '\(testContent)', got '\(output)'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testSingleFileMountReadOnly() async throws {
|
|
let id = "test-single-file-mount-readonly"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp file with known content
|
|
let testContent = "Read-only file content"
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("readonly.txt")
|
|
try testContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
// Mount a single file as read-only
|
|
config.mounts.append(.share(source: hostFile.path, destination: "/etc/readonly.txt", options: ["ro"]))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// First verify we can read the file
|
|
let readBuffer = BufferWriter()
|
|
let readExec = try await container.exec("read-file") { config in
|
|
config.arguments = ["cat", "/etc/readonly.txt"]
|
|
config.stdout = readBuffer
|
|
}
|
|
try await readExec.start()
|
|
var status = try await readExec.wait()
|
|
try await readExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read status \(status) != 0")
|
|
}
|
|
|
|
guard String(data: readBuffer.data, encoding: .utf8) == testContent else {
|
|
throw IntegrationError.assert(msg: "file content mismatch")
|
|
}
|
|
|
|
// Now try to write to the file - should fail
|
|
let writeExec = try await container.exec("write-file") { config in
|
|
config.arguments = ["sh", "-c", "echo 'modified' > /etc/readonly.txt"]
|
|
}
|
|
try await writeExec.start()
|
|
status = try await writeExec.wait()
|
|
try await writeExec.delete()
|
|
|
|
// Write should fail on a read-only mount
|
|
guard status.exitCode != 0 else {
|
|
throw IntegrationError.assert(msg: "write should have failed on read-only mount")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testSingleFileMountWriteBack() async throws {
|
|
let id = "test-single-file-mount-write-back"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp file with initial content
|
|
let initialContent = "initial content"
|
|
let hostFile = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
.appendingPathComponent("writeable.txt")
|
|
try initialContent.write(to: hostFile, atomically: true, encoding: .utf8)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
// Mount a single file (writable by default)
|
|
config.mounts.append(.share(source: hostFile.path, destination: "/etc/writeable.txt"))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Write new content from inside the container
|
|
let newContent = "modified from container"
|
|
let writeExec = try await container.exec("write-file") { config in
|
|
config.arguments = ["sh", "-c", "echo -n '\(newContent)' > /etc/writeable.txt"]
|
|
}
|
|
try await writeExec.start()
|
|
let status = try await writeExec.wait()
|
|
try await writeExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "write status \(status) != 0")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
|
|
let hostContent = try String(contentsOf: hostFile, encoding: .utf8)
|
|
guard hostContent == newContent else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected '\(newContent)' on host, got '\(hostContent)'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testSingleFileMountSymlink() async throws {
|
|
let id = "test-single-file-mount-symlink"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp directory with a real file and a symlink to it
|
|
let tempDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
let realFile = tempDir.appendingPathComponent("realfile.txt")
|
|
let symlinkFile = tempDir.appendingPathComponent("symlink.txt")
|
|
|
|
let initialContent = "content via symlink"
|
|
try initialContent.write(to: realFile, atomically: true, encoding: .utf8)
|
|
try FileManager.default.createSymbolicLink(at: symlinkFile, withDestinationURL: realFile)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
// Mount the symlink (should resolve to real file)
|
|
config.mounts.append(.share(source: symlinkFile.path, destination: "/etc/config.txt"))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Read the file to verify content
|
|
let readBuffer = BufferWriter()
|
|
let readExec = try await container.exec("read-file") { config in
|
|
config.arguments = ["cat", "/etc/config.txt"]
|
|
config.stdout = readBuffer
|
|
}
|
|
try await readExec.start()
|
|
var status = try await readExec.wait()
|
|
try await readExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read status \(status) != 0")
|
|
}
|
|
|
|
guard String(data: readBuffer.data, encoding: .utf8) == initialContent else {
|
|
throw IntegrationError.assert(msg: "content mismatch on read")
|
|
}
|
|
|
|
// Write new content from container
|
|
let newContent = "modified via symlink mount"
|
|
let writeExec = try await container.exec("write-file") { config in
|
|
config.arguments = ["sh", "-c", "echo -n '\(newContent)' > /etc/config.txt"]
|
|
}
|
|
try await writeExec.start()
|
|
status = try await writeExec.wait()
|
|
try await writeExec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "write status \(status) != 0")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
|
|
// Verify the REAL file (not symlink) was modified on the host
|
|
let hostContent = try String(contentsOf: realFile, encoding: .utf8)
|
|
guard hostContent == newContent else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected '\(newContent)' in real file, got '\(hostContent)'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testRLimitOpenFiles() async throws {
|
|
let id = "test-rlimit-open-files"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sh", "-c", "ulimit -n"]
|
|
config.process.rlimits = [
|
|
LinuxRLimit(kind: .openFiles, hard: 2048, soft: 1024)
|
|
]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
// ulimit -n returns the soft limit
|
|
guard output == "1024" else {
|
|
throw IntegrationError.assert(msg: "expected soft limit '1024', got '\(output)'")
|
|
}
|
|
}
|
|
|
|
func testRLimitMultiple() async throws {
|
|
let id = "test-rlimit-multiple"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
// Read /proc/self/limits to verify multiple rlimits are set
|
|
config.process.arguments = ["cat", "/proc/self/limits"]
|
|
config.process.rlimits = [
|
|
LinuxRLimit(kind: .openFiles, hard: 4096, soft: 2048),
|
|
LinuxRLimit(kind: .stackSize, hard: 16_777_216, soft: 8_388_608),
|
|
LinuxRLimit(kind: .coreFileSize, hard: 0, soft: 0),
|
|
]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
// Parse /proc/self/limits and verify the values
|
|
// Format: "Limit Name Soft Limit Hard Limit Units"
|
|
let lines = output.split(separator: "\n")
|
|
|
|
// Helper to find and verify a limit line
|
|
func verifyLimit(name: String, expectedSoft: String, expectedHard: String) throws {
|
|
guard let line = lines.first(where: { $0.contains(name) }) else {
|
|
throw IntegrationError.assert(msg: "limit '\(name)' not found in output")
|
|
}
|
|
let parts = line.split(whereSeparator: { $0.isWhitespace }).map(String.init)
|
|
// The line format varies, but soft and hard are typically the last numeric values before units
|
|
guard parts.contains(expectedSoft) && parts.contains(expectedHard) else {
|
|
throw IntegrationError.assert(
|
|
msg: "limit '\(name)' expected soft=\(expectedSoft) hard=\(expectedHard), got: \(line)")
|
|
}
|
|
}
|
|
|
|
try verifyLimit(name: "Max open files", expectedSoft: "2048", expectedHard: "4096")
|
|
try verifyLimit(name: "Max stack size", expectedSoft: "8388608", expectedHard: "16777216")
|
|
try verifyLimit(name: "Max core file size", expectedSoft: "0", expectedHard: "0")
|
|
}
|
|
|
|
func testRLimitExec() async throws {
|
|
let id = "test-rlimit-exec"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Exec a process with rlimits set
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("rlimit-exec") { config in
|
|
config.arguments = ["sh", "-c", "ulimit -n"]
|
|
config.rlimits = [
|
|
LinuxRLimit(kind: .openFiles, hard: 512, soft: 256)
|
|
]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output == "256" else {
|
|
throw IntegrationError.assert(msg: "expected soft limit '256', got '\(output)'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testDuplicateVirtiofsMount() async throws {
|
|
let id = "test-duplicate-virtiofs-mount"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp directory with a file
|
|
let sharedDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
try "shared content".write(to: sharedDir.appendingPathComponent("data.txt"), atomically: true, encoding: .utf8)
|
|
|
|
let buffer1 = BufferWriter()
|
|
let buffer2 = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
// Mount the same source directory to two different destinations
|
|
config.mounts.append(.share(source: sharedDir.path, destination: "/mnt1"))
|
|
config.mounts.append(.share(source: sharedDir.path, destination: "/mnt2"))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Verify both mounts work. Read from /mnt1, then /mnt2
|
|
let exec1 = try await container.exec("read-mnt1") { config in
|
|
config.arguments = ["cat", "/mnt1/data.txt"]
|
|
config.stdout = buffer1
|
|
}
|
|
try await exec1.start()
|
|
var status = try await exec1.wait()
|
|
try await exec1.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read from /mnt1 failed with status \(status)")
|
|
}
|
|
|
|
guard String(data: buffer1.data, encoding: .utf8) == "shared content" else {
|
|
throw IntegrationError.assert(msg: "unexpected content from /mnt1")
|
|
}
|
|
|
|
let exec2 = try await container.exec("read-mnt2") { config in
|
|
config.arguments = ["cat", "/mnt2/data.txt"]
|
|
config.stdout = buffer2
|
|
}
|
|
try await exec2.start()
|
|
status = try await exec2.wait()
|
|
try await exec2.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read from /mnt2 failed with status \(status)")
|
|
}
|
|
|
|
guard String(data: buffer2.data, encoding: .utf8) == "shared content" else {
|
|
throw IntegrationError.assert(msg: "unexpected content from /mnt2")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testDuplicateVirtiofsMountViaSymlink() async throws {
|
|
let id = "test-duplicate-virtiofs-mount-symlink"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a temp directory with a file, and a symlink to the same directory
|
|
let tempDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
let realDir = tempDir.appendingPathComponent("realdir")
|
|
let symlinkDir = tempDir.appendingPathComponent("symlinkdir")
|
|
|
|
try FileManager.default.createDirectory(at: realDir, withIntermediateDirectories: true)
|
|
try "symlink test content".write(to: realDir.appendingPathComponent("file.txt"), atomically: true, encoding: .utf8)
|
|
try FileManager.default.createSymbolicLink(at: symlinkDir, withDestinationURL: realDir)
|
|
|
|
let buffer1 = BufferWriter()
|
|
let buffer2 = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.mounts.append(.share(source: realDir.path, destination: "/mnt1"))
|
|
config.mounts.append(.share(source: symlinkDir.path, destination: "/mnt2"))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
// This should succeed as the symlink should resolve to the same directory
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let exec1 = try await container.exec("read-mnt1") { config in
|
|
config.arguments = ["cat", "/mnt1/file.txt"]
|
|
config.stdout = buffer1
|
|
}
|
|
try await exec1.start()
|
|
var status = try await exec1.wait()
|
|
try await exec1.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read from /mnt1 failed with status \(status)")
|
|
}
|
|
|
|
guard String(data: buffer1.data, encoding: .utf8) == "symlink test content" else {
|
|
throw IntegrationError.assert(msg: "unexpected content from /mnt1")
|
|
}
|
|
|
|
// Verify mount via symlink works now
|
|
let exec2 = try await container.exec("read-mnt2") { config in
|
|
config.arguments = ["cat", "/mnt2/file.txt"]
|
|
config.stdout = buffer2
|
|
}
|
|
try await exec2.start()
|
|
status = try await exec2.wait()
|
|
try await exec2.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "read from /mnt2 failed with status \(status)")
|
|
}
|
|
|
|
guard String(data: buffer2.data, encoding: .utf8) == "symlink test content" else {
|
|
throw IntegrationError.assert(msg: "unexpected content from /mnt2")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testWritableLayer() async throws {
|
|
let id = "test-writable-layer"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib())
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
// Write a file, then read it back to verify writes work
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'writable layer test' > /tmp/testfile && cat /tmp/testfile"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "writable layer test" else {
|
|
throw IntegrationError.assert(msg: "unexpected output: \(output)")
|
|
}
|
|
}
|
|
|
|
// Validates the on-disk structure of a journaled EXT4 image on the host before
|
|
// attempting a container mount. This catches geometry mismatches (superblock block
|
|
// count vs. physical file size) and missing journal metadata without requiring
|
|
// e2fsck to be present in the container image.
|
|
//
|
|
// Uses raw values for internal constants because integration tests cannot use
|
|
// @testable import: CompatFeature.hasJournal = 0x4, EXT4.JournalInode = 8.
|
|
private func verifyJournalFilesystem(
|
|
at path: URL,
|
|
minDiskSize: UInt64,
|
|
expectedMountOpts: UInt32
|
|
) throws {
|
|
let attrs = try FileManager.default.attributesOfItem(atPath: path.absolutePath())
|
|
guard let fileSize = attrs[.size] as? UInt64 else {
|
|
throw IntegrationError.assert(msg: "could not read file size for \(path.lastPathComponent)")
|
|
}
|
|
let reader = try EXT4.EXT4Reader(blockDevice: FilePath(path.absolutePath()))
|
|
let sb = reader.superBlock
|
|
let blocksCount = UInt64(sb.blocksCountLow) | (UInt64(sb.blocksCountHigh) << 32)
|
|
let blockSize = UInt64(sb.blockSize)
|
|
guard fileSize == blocksCount * blockSize else {
|
|
throw IntegrationError.assert(
|
|
msg: "geometry mismatch: fileSize=\(fileSize), blocksCount=\(blocksCount), blockSize=\(blockSize)")
|
|
}
|
|
guard fileSize > minDiskSize else {
|
|
throw IntegrationError.assert(
|
|
msg: "journal did not grow the image: fileSize=\(fileSize), minDiskSize=\(minDiskSize)")
|
|
}
|
|
guard sb.featureCompat & 0x4 != 0 else {
|
|
throw IntegrationError.assert(
|
|
msg: "COMPAT_HAS_JOURNAL not set in featureCompat (0x\(String(sb.featureCompat, radix: 16)))")
|
|
}
|
|
guard sb.journalInum == 8 else {
|
|
throw IntegrationError.assert(msg: "journalInum=\(sb.journalInum), expected 8")
|
|
}
|
|
guard sb.defaultMountOpts == expectedMountOpts else {
|
|
throw IntegrationError.assert(
|
|
msg: "defaultMountOpts=0x\(String(sb.defaultMountOpts, radix: 16)), expected 0x\(String(expectedMountOpts, radix: 16)))")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerJournalWriteback() async throws {
|
|
let id = "test-writable-layer-journal-writeback"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(
|
|
FilePath(writableLayerPath.absolutePath()),
|
|
minDiskSize: 512.mib(),
|
|
journal: .init(defaultMode: .writeback)
|
|
)
|
|
try filesystem.close()
|
|
// 0x0060 = data=writeback | barrier
|
|
try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0060)
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'journal writeback' > /tmp/testfile && cat /tmp/testfile"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal writeback" else {
|
|
throw IntegrationError.assert(msg: "unexpected output: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerJournalOrdered() async throws {
|
|
let id = "test-writable-layer-journal-ordered"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(
|
|
FilePath(writableLayerPath.absolutePath()),
|
|
minDiskSize: 512.mib(),
|
|
journal: .init(defaultMode: .ordered)
|
|
)
|
|
try filesystem.close()
|
|
// 0x0040 = data=ordered | barrier
|
|
try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0040)
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'journal ordered' > /tmp/testfile && cat /tmp/testfile"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal ordered" else {
|
|
throw IntegrationError.assert(msg: "unexpected output: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerJournalData() async throws {
|
|
let id = "test-writable-layer-journal-data"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(
|
|
FilePath(writableLayerPath.absolutePath()),
|
|
minDiskSize: 512.mib(),
|
|
journal: .init(defaultMode: .journal)
|
|
)
|
|
try filesystem.close()
|
|
// 0x0020 = data=journal | barrier
|
|
try verifyJournalFilesystem(at: writableLayerPath, minDiskSize: 512.mib(), expectedMountOpts: 0x0020)
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'journal data' > /tmp/testfile && cat /tmp/testfile"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "journal data" else {
|
|
throw IntegrationError.assert(msg: "unexpected output: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerPreservesLowerLayer() async throws {
|
|
let id = "test-writable-layer-preserves-lower"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib())
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
// Get the size of /bin/sh before any modifications
|
|
let buffer1 = BufferWriter()
|
|
let container1 = try LinuxContainer("\(id)-1", rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
// Modify a file in /bin. This should go in the writable layer.
|
|
config.process.arguments = ["/bin/sh", "-c", "ls -la /bin/sh && echo 'modified' > /bin/test-file"]
|
|
config.process.stdout = buffer1
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container1.create()
|
|
try await container1.start()
|
|
let status1 = try await container1.wait()
|
|
try await container1.stop()
|
|
|
|
guard status1.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "first container failed with status \(status1)")
|
|
}
|
|
|
|
// Now run a second container with the SAME rootfs but without the writable layer
|
|
// The /bin/test-file should NOT exist because it was written to the writable layer
|
|
let buffer2 = BufferWriter()
|
|
let container2 = try LinuxContainer("\(id)-2", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "test -f /bin/test-file && echo 'exists' || echo 'not-exists'"]
|
|
config.process.stdout = buffer2
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container2.create()
|
|
try await container2.start()
|
|
let status2 = try await container2.wait()
|
|
try await container2.stop()
|
|
|
|
guard status2.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "second container failed with status \(status2)")
|
|
}
|
|
|
|
guard let output2 = String(data: buffer2.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output2.trimmingCharacters(in: .whitespacesAndNewlines) == "not-exists" else {
|
|
throw IntegrationError.assert(msg: "expected 'not-exists' but got: \(output2)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerReadsFromLower() async throws {
|
|
let id = "test-writable-layer-reads-lower"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib())
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["head", "-1", "/etc/passwd"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
// Alpine's first line of /etc/passwd should be root
|
|
guard output.hasPrefix("root:") else {
|
|
throw IntegrationError.assert(msg: "expected /etc/passwd to start with 'root:', got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerWithReadOnlyLower() async throws {
|
|
let id = "test-writable-layer-ro-lower"
|
|
|
|
let bs = try await bootstrap(id)
|
|
var rootfs = bs.rootfs
|
|
rootfs.options.append("ro")
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib())
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
// Even though lower layer is ro, writes should succeed via overlay
|
|
config.process.arguments = ["/bin/sh", "-c", "echo 'overlay write test' > /tmp/test && cat /tmp/test"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.trimmingCharacters(in: .whitespacesAndNewlines) == "overlay write test" else {
|
|
throw IntegrationError.assert(msg: "unexpected output: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerSize() async throws {
|
|
let id = "test-writable-layer-size"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Create a 1 GiB writable layer
|
|
let expectedSizeBytes: UInt64 = 1.gib()
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: expectedSizeBytes)
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
// Use df to check the available space on the root filesystem
|
|
// The overlay will report the size of the upper layer's backing store
|
|
config.process.arguments = ["/bin/sh", "-c", "df -B1 / | tail -1 | awk '{print $2}'"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard let reportedSize = UInt64(output.trimmingCharacters(in: .whitespacesAndNewlines)) else {
|
|
throw IntegrationError.assert(msg: "failed to parse df output as UInt64: \(output)")
|
|
}
|
|
|
|
// The reported size should be close to our expected size (within 10%)
|
|
let minExpected: UInt64 = (expectedSizeBytes * 90) / 100
|
|
let maxExpected: UInt64 = (expectedSizeBytes * 110) / 100
|
|
|
|
guard reportedSize >= minExpected && reportedSize <= maxExpected else {
|
|
throw IntegrationError.assert(msg: "expected size ~\(expectedSizeBytes) bytes, but df reported \(reportedSize) bytes")
|
|
}
|
|
}
|
|
|
|
func testWritableLayerWithDNSAndHosts() async throws {
|
|
let id = "test-writable-layer-dns-hosts"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
let writableLayerPath = Self.testDir.appending(component: "\(id)-writable.ext4")
|
|
try? FileManager.default.removeItem(at: writableLayerPath)
|
|
let filesystem = try EXT4.Formatter(FilePath(writableLayerPath.absolutePath()), minDiskSize: 512.mib())
|
|
try filesystem.close()
|
|
let writableLayer = Mount.block(
|
|
format: "ext4",
|
|
source: writableLayerPath.absolutePath(),
|
|
destination: "/",
|
|
options: []
|
|
)
|
|
|
|
let buffer = BufferWriter()
|
|
let dnsEntry = "8.8.8.8"
|
|
let hostsEntry = Hosts.Entry.localHostIPV4(comment: "WritableLayerTest")
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, writableLayer: writableLayer, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "cat /etc/resolv.conf && echo '---' && cat /etc/hosts"]
|
|
config.process.stdout = buffer
|
|
config.dns = DNS(nameservers: [dnsEntry])
|
|
config.hosts = Hosts(entries: [hostsEntry])
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.contains(dnsEntry) else {
|
|
throw IntegrationError.assert(msg: "expected /etc/resolv.conf to contain \(dnsEntry), got: \(output)")
|
|
}
|
|
|
|
guard output.contains("WritableLayerTest") else {
|
|
throw IntegrationError.assert(msg: "expected /etc/hosts to contain our entry, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testFrozenExt4Clone() async throws {
|
|
let id = "test-frozen-ext4-clone"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let diskImageURL = Self.testDir.appending(component: "\(id)-data.ext4")
|
|
try? FileManager.default.removeItem(at: diskImageURL)
|
|
|
|
let filesystem = try EXT4.Formatter(FilePath(diskImageURL.absolutePath()), minDiskSize: 64.mib())
|
|
try filesystem.close()
|
|
|
|
let cloneImageURL = Self.testDir.appending(component: "\(id)-data-clone.ext4")
|
|
try? FileManager.default.removeItem(at: cloneImageURL)
|
|
|
|
let writerContainer = try LinuxContainer("\(id)-writer", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.mounts.append(
|
|
Mount.block(
|
|
format: "ext4",
|
|
source: diskImageURL.absolutePath(),
|
|
destination: "/data"
|
|
))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await writerContainer.create()
|
|
try await writerContainer.start()
|
|
|
|
try await writerContainer.filesystemOperation(operation: .freeze, path: "/data")
|
|
|
|
let writeExec = try await writerContainer.exec("write-hello") { config in
|
|
config.arguments = ["/bin/sh", "-c", "echo hello > /data/hello.txt"]
|
|
}
|
|
try await writeExec.start()
|
|
let writeStatus = try await writeExec.wait()
|
|
try await writeExec.delete()
|
|
guard writeStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "write exec failed with status \(writeStatus)")
|
|
}
|
|
|
|
try FileManager.default.copyItem(at: diskImageURL, to: cloneImageURL)
|
|
|
|
try await writerContainer.filesystemOperation(operation: .thaw, path: "/data")
|
|
|
|
try await writerContainer.kill(.kill)
|
|
_ = try await writerContainer.wait()
|
|
try await writerContainer.stop()
|
|
} catch {
|
|
try? await writerContainer.filesystemOperation(operation: .thaw, path: "/data")
|
|
try? await writerContainer.stop()
|
|
throw error
|
|
}
|
|
|
|
let verifyContainer = try LinuxContainer("\(id)-reader", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.mounts.append(
|
|
Mount.block(
|
|
format: "ext4",
|
|
source: cloneImageURL.absolutePath(),
|
|
destination: "/data"
|
|
))
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await verifyContainer.create()
|
|
try await verifyContainer.start()
|
|
|
|
let mountBuffer = BufferWriter()
|
|
let mountExec = try await verifyContainer.exec("verify-mount") { config in
|
|
config.arguments = ["/bin/sh", "-c", "grep ' /data ' /proc/mounts"]
|
|
config.stdout = mountBuffer
|
|
}
|
|
try await mountExec.start()
|
|
var status = try await mountExec.wait()
|
|
try await mountExec.delete()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "failed to verify /data mount, status \(status)")
|
|
}
|
|
|
|
let mountOutput = String(decoding: mountBuffer.data, as: UTF8.self)
|
|
guard mountOutput.contains(" /data ") && mountOutput.contains(" ext4 ") else {
|
|
throw IntegrationError.assert(msg: "expected ext4 mount at /data, got: \(mountOutput)")
|
|
}
|
|
|
|
let lsBuffer = BufferWriter()
|
|
let lsExec = try await verifyContainer.exec("verify-no-hello") { config in
|
|
config.arguments = ["ls", "-1", "/data"]
|
|
config.stdout = lsBuffer
|
|
}
|
|
try await lsExec.start()
|
|
status = try await lsExec.wait()
|
|
try await lsExec.delete()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls /data failed with status \(status)")
|
|
}
|
|
|
|
let lsOutput = String(decoding: lsBuffer.data, as: UTF8.self)
|
|
let listedFiles = Set(lsOutput.split(whereSeparator: \.isNewline).map(String.init))
|
|
guard !listedFiles.contains("hello.txt") else {
|
|
throw IntegrationError.assert(msg: "expected cloned /data to not contain hello.txt, got: \(lsOutput)")
|
|
}
|
|
|
|
try await verifyContainer.kill(.kill)
|
|
_ = try await verifyContainer.wait()
|
|
try await verifyContainer.stop()
|
|
} catch {
|
|
try? await verifyContainer.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testTrimExt4Clone() async throws {
|
|
let id = "test-trim-ext4-clone"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let diskImageURL = Self.testDir.appending(component: "\(id)-data.ext4")
|
|
try? FileManager.default.removeItem(at: diskImageURL)
|
|
|
|
let filesystem = try EXT4.Formatter(FilePath(diskImageURL.absolutePath()), minDiskSize: 64.mib())
|
|
try filesystem.close()
|
|
|
|
let cloneImageURL = Self.testDir.appending(component: "\(id)-data-clone.ext4")
|
|
try? FileManager.default.removeItem(at: cloneImageURL)
|
|
|
|
let writerContainer = try LinuxContainer("\(id)-writer", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.mounts.append(
|
|
Mount.block(
|
|
format: "ext4",
|
|
source: diskImageURL.absolutePath(),
|
|
destination: "/data"
|
|
))
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await writerContainer.create()
|
|
try await writerContainer.start()
|
|
|
|
let writeExec = try await writerContainer.exec("write-temp") { config in
|
|
config.arguments = [
|
|
"/bin/sh",
|
|
"-c",
|
|
"dd if=/dev/zero of=/data/trim.dat bs=1M count=8 status=none && sync && rm /data/trim.dat && sync",
|
|
]
|
|
}
|
|
try await writeExec.start()
|
|
let writeStatus = try await writeExec.wait()
|
|
try await writeExec.delete()
|
|
guard writeStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "trim setup exec failed with status \(writeStatus)")
|
|
}
|
|
|
|
try await writerContainer.filesystemOperation(operation: .trim, path: "/data")
|
|
|
|
try FileManager.default.copyItem(at: diskImageURL, to: cloneImageURL)
|
|
|
|
try await writerContainer.kill(.kill)
|
|
_ = try await writerContainer.wait()
|
|
try await writerContainer.stop()
|
|
} catch {
|
|
try? await writerContainer.stop()
|
|
throw error
|
|
}
|
|
|
|
let verifyContainer = try LinuxContainer("\(id)-reader", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.mounts.append(
|
|
Mount.block(
|
|
format: "ext4",
|
|
source: cloneImageURL.absolutePath(),
|
|
destination: "/data"
|
|
))
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await verifyContainer.create()
|
|
try await verifyContainer.start()
|
|
|
|
let mountBuffer = BufferWriter()
|
|
let mountExec = try await verifyContainer.exec("verify-mount") { config in
|
|
config.arguments = ["/bin/sh", "-c", "grep ' /data ' /proc/mounts"]
|
|
config.stdout = mountBuffer
|
|
}
|
|
try await mountExec.start()
|
|
var status = try await mountExec.wait()
|
|
try await mountExec.delete()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "failed to verify /data mount, status \(status)")
|
|
}
|
|
|
|
let mountOutput = String(decoding: mountBuffer.data, as: UTF8.self)
|
|
guard mountOutput.contains(" /data ") && mountOutput.contains(" ext4 ") else {
|
|
throw IntegrationError.assert(msg: "expected ext4 mount at /data, got: \(mountOutput)")
|
|
}
|
|
|
|
let lsBuffer = BufferWriter()
|
|
let lsExec = try await verifyContainer.exec("verify-no-hello") { config in
|
|
config.arguments = ["ls", "-1", "/data"]
|
|
config.stdout = lsBuffer
|
|
}
|
|
try await lsExec.start()
|
|
status = try await lsExec.wait()
|
|
try await lsExec.delete()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls /data failed with status \(status)")
|
|
}
|
|
|
|
let lsOutput = String(decoding: lsBuffer.data, as: UTF8.self)
|
|
let listedFiles = Set(lsOutput.split(whereSeparator: \.isNewline).map(String.init))
|
|
guard !listedFiles.contains("trim.dat") else {
|
|
throw IntegrationError.assert(msg: "expected cloned /data to not contain trim.dat, got: \(lsOutput)")
|
|
}
|
|
|
|
try await verifyContainer.kill(.kill)
|
|
_ = try await verifyContainer.wait()
|
|
try await verifyContainer.stop()
|
|
} catch {
|
|
try? await verifyContainer.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testUseInitBasic() async throws {
|
|
let id = "test-use-init-basic"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/echo", "hello from init"]
|
|
config.process.stdout = buffer
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "hello from init\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'hello from init', got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'")
|
|
}
|
|
}
|
|
|
|
func testUseInitExitCodePropagation() async throws {
|
|
let id = "test-use-init-exit-code"
|
|
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Test exit code 0
|
|
var container = try LinuxContainer("\(id)-success", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/true"]
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
var status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "expected exit code 0, got \(status.exitCode)")
|
|
}
|
|
|
|
// Test non-zero exit code
|
|
container = try LinuxContainer("\(id)-failure", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/false"]
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 1 else {
|
|
throw IntegrationError.assert(msg: "expected exit code 1, got \(status.exitCode)")
|
|
}
|
|
|
|
// Test custom exit code
|
|
container = try LinuxContainer("\(id)-custom", rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sh", "-c", "exit 42"]
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 42 else {
|
|
throw IntegrationError.assert(msg: "expected exit code 42, got \(status.exitCode)")
|
|
}
|
|
}
|
|
|
|
func testUseInitSignalForwarding() async throws {
|
|
let id = "test-use-init-signal"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "300"]
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
try await Task.sleep(for: .milliseconds(100))
|
|
|
|
try await container.kill(.term)
|
|
|
|
let status = try await container.wait(timeoutInSeconds: 5)
|
|
try await container.stop()
|
|
|
|
// SIGTERM should result in exit code 128 + 15 = 143
|
|
guard status.exitCode == 143 else {
|
|
throw IntegrationError.assert(msg: "expected exit code 143 (SIGTERM), got \(status.exitCode)")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testUseInitZombieReaping() async throws {
|
|
let id = "test-use-init-zombie-reaping"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
// This script creates an orphaned process that init must reap.
|
|
// The subshell exits immediately, orphaning the sleep process.
|
|
// Init should reap it when it exits.
|
|
config.process.arguments = [
|
|
"/bin/sh", "-c",
|
|
"""
|
|
# Create orphans: subshell exits before its children
|
|
(/bin/sleep 0.1 &)
|
|
(/bin/sleep 0.1 &)
|
|
# Wait for orphans to complete
|
|
/bin/sleep 0.3
|
|
# Check for zombie processes (Z state)
|
|
zombies=$(ps -eo stat 2>/dev/null | grep -c '^Z' || echo 0)
|
|
echo "zombie_count:$zombies"
|
|
""",
|
|
]
|
|
config.process.stdout = buffer
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// Should report 0 zombies
|
|
guard output.contains("zombie_count:0") else {
|
|
throw IntegrationError.assert(msg: "expected zero zombies, got: \(output)")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testUseInitWithTerminal() async throws {
|
|
let id = "test-use-init-terminal"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sh", "-c", "tty && echo 'has tty'"]
|
|
config.process.terminal = true
|
|
config.process.stdout = buffer
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output.contains("has tty") else {
|
|
throw IntegrationError.assert(msg: "expected 'has tty' in output, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testUseInitWithStdin() async throws {
|
|
let id = "test-use-init-stdin"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat"]
|
|
config.process.stdin = StdinBuffer(data: "input through init\n".data(using: .utf8)!)
|
|
config.process.stdout = buffer
|
|
config.useInit = true
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard String(data: buffer.data, encoding: .utf8) == "input through init\n" else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'input through init', got '\(String(data: buffer.data, encoding: .utf8) ?? "nil")'")
|
|
}
|
|
}
|
|
|
|
#if os(macOS)
|
|
@available(macOS 26.0, *)
|
|
func testNetworkingDisabled() async throws {
|
|
let id = "test-networking-disabled"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let network = try VmnetNetwork()
|
|
var manager = try ContainerManager(vmm: bs.vmm, network: network)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs,
|
|
networking: false
|
|
) { config in
|
|
config.process.arguments = ["ls", "-1", "/sys/class/net/"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls /sys/class/net/ failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// With networking disabled check we don't have an eth0.
|
|
let interfaces = output.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
.split(separator: "\n")
|
|
.map { $0.trimmingCharacters(in: .whitespaces) }
|
|
|
|
guard !interfaces.contains("eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected no 'eth0' interface")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testNetworkingEnabled() async throws {
|
|
let id = "test-networking-enabled"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let network = try VmnetNetwork()
|
|
var manager = try ContainerManager(vmm: bs.vmm, network: network)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
config.process.arguments = ["ls", "-1", "/sys/class/net/"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ls /sys/class/net/ failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// With networking enabled (default), eth0 should be present alongside lo
|
|
let interfaces = Set(
|
|
output.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
.split(separator: "\n")
|
|
.map { $0.trimmingCharacters(in: .whitespaces) }
|
|
)
|
|
guard interfaces.contains("lo") else {
|
|
throw IntegrationError.assert(msg: "expected 'lo' interface, got: \(interfaces)")
|
|
}
|
|
guard interfaces.contains("eth0") else {
|
|
throw IntegrationError.assert(msg: "expected 'eth0' interface, got: \(interfaces)")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testNetworkingEnabledIPv6() async throws {
|
|
let id = "test-networking-enabled-ipv6"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let network = try VmnetNetwork()
|
|
var manager = try ContainerManager(vmm: bs.vmm, network: network)
|
|
defer {
|
|
try? manager.delete(id)
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try await manager.create(
|
|
id,
|
|
image: bs.image,
|
|
rootfs: bs.rootfs
|
|
) { config in
|
|
config.process.arguments = ["ip", "-6", "addr", "show", "eth0", "scope", "global"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 addr show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output.contains("inet6 fd") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected a global-scope IPv6 address on eth0, got: \(output)")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6AddressAdd() async throws {
|
|
let id = "test-ipv6-address"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Pin the v6 prefix so the allocator's first allocation yields fd00::2.
|
|
var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64"))
|
|
defer {
|
|
try? network.releaseInterface(id)
|
|
}
|
|
|
|
guard let interface = try network.createInterface(id) else {
|
|
throw IntegrationError.assert(msg: "failed to create network interface")
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Check that the IPv6 address was assigned to eth0.
|
|
let exec = try await container.exec("check-ipv6") { config in
|
|
config.arguments = ["ip", "-6", "addr", "show", "eth0"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 addr show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output.contains("fd00::2") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected fd00::2 in output, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6DefaultRoute() async throws {
|
|
let id = "test-ipv6-default-route"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Pin the network's v6 prefix so the gateway is deterministically fd00::1
|
|
// and the allocator's first allocation yields fd00::2.
|
|
var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64"))
|
|
defer {
|
|
try? network.releaseInterface(id)
|
|
}
|
|
|
|
guard let interface = try network.createInterface(id) else {
|
|
throw IntegrationError.assert(msg: "failed to create network interface")
|
|
}
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Inspect IPv6 routes inside the container.
|
|
let exec = try await container.exec("check-v6-route") { config in
|
|
config.arguments = ["ip", "-6", "route", "show"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// The default v6 route must point at the gateway we configured, on eth0.
|
|
guard output.contains("default via fd00::1 dev eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'default via fd00::1 dev eth0' in v6 routes, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6GatewayOutsideSubnet() async throws {
|
|
let id = "test-ipv6-gateway-outside-subnet"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Address in fd00::/120, gateway in fd01::/120 — subnets don't overlap, so the
|
|
// LinuxContainer wiring must add a /128 link route to the gateway before the
|
|
// default route. The two prefixes are independent so we drive this directly
|
|
// via NATInterface rather than the VmnetNetwork allocator (which always
|
|
// derives the gateway from the network's own prefix).
|
|
let interface = NATInterface(
|
|
ipv4Address: try CIDRv4("192.0.2.2/24"),
|
|
ipv4Gateway: try IPv4Address("192.0.2.1"),
|
|
ipv6Address: try CIDRv6("fd00::2/120"),
|
|
ipv6Gateway: try IPv6Address("fd01::1"))
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let exec = try await container.exec("check-v6-routes") { config in
|
|
config.arguments = ["ip", "-6", "route", "show"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// Both the link-scoped route to the gateway AND the default via that gateway
|
|
// must be present. Without the link route, the kernel would refuse the default.
|
|
// Match the link route on a line that starts with the gateway address (no "via")
|
|
// so it can't be satisfied by a substring of the default-via line.
|
|
let lines = output.split(separator: "\n").map(String.init)
|
|
let hasLinkRoute = lines.contains { $0.hasPrefix("fd01::1 ") && $0.contains("dev eth0") && !$0.contains("via") }
|
|
guard hasLinkRoute else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected an on-link route 'fd01::1 ... dev eth0' (no 'via') in v6 routes, got: \(output)")
|
|
}
|
|
guard output.contains("default via fd01::1 dev eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'default via fd01::1 dev eth0' in v6 routes, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6OnlyDefaultRoute() async throws {
|
|
let id = "test-ipv6-only-default-route"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Construct a NATInterface with a nil IPv4 gateway and a v6 gateway, so
|
|
// LinuxContainer takes the no-v4-gateway branch in setupInterface. The v4
|
|
// address comes from TEST-NET-1; nothing in the test traffics over v4.
|
|
let interface = NATInterface(
|
|
ipv4Address: try CIDRv4("192.0.2.2/24"),
|
|
ipv4Gateway: nil,
|
|
ipv6Address: try CIDRv6("fd00::2/64"),
|
|
ipv6Gateway: try IPv6Address("fd00::1"))
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let exec = try await container.exec("check-v6-route") { config in
|
|
config.arguments = ["ip", "-6", "route", "show"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
guard output.contains("default via fd00::1 dev eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'default via fd00::1 dev eth0' in v6 routes when ipv4Gateway is nil, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6OnlyGatewayOutsideSubnet() async throws {
|
|
let id = "test-ipv6-only-gateway-outside-subnet"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// No v4 gateway AND v6 gateway is outside the v6 subnet. Exercises
|
|
// setupInterface's "no v4 gateway, but v6 link route required before
|
|
// v6 default route" branch — the exact bug the helper extraction fixed.
|
|
let interface = NATInterface(
|
|
ipv4Address: try CIDRv4("192.0.2.2/24"),
|
|
ipv4Gateway: nil,
|
|
ipv6Address: try CIDRv6("fd00::2/120"),
|
|
ipv6Gateway: try IPv6Address("fd01::1"))
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let exec = try await container.exec("check-v6-routes") { config in
|
|
config.arguments = ["ip", "-6", "route", "show"]
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 route show failed with status \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert output to UTF8")
|
|
}
|
|
|
|
// Both the on-link route to the gateway AND the default via it must be present.
|
|
// Without the link route the kernel rejects the default — that was the bug.
|
|
let lines = output.split(separator: "\n").map(String.init)
|
|
let hasLinkRoute = lines.contains { $0.hasPrefix("fd01::1 ") && $0.contains("dev eth0") && !$0.contains("via") }
|
|
guard hasLinkRoute else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected an on-link route 'fd01::1 ... dev eth0' (no 'via') in v6 routes, got: \(output)")
|
|
}
|
|
guard output.contains("default via fd01::1 dev eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'default via fd01::1 dev eth0' in v6 routes, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
@available(macOS 26.0, *)
|
|
func testIPv6DualStack() async throws {
|
|
let id = "test-ipv6-dual-stack"
|
|
let bs = try await bootstrap(id)
|
|
|
|
// Pin the network's v6 prefix so the gateway is deterministically fd00::1
|
|
// and the allocator's first allocation yields fd00::2.
|
|
var network = try VmnetNetwork(prefixV6: try CIDRv6("fd00::/64"))
|
|
defer {
|
|
try? network.releaseInterface(id)
|
|
}
|
|
|
|
guard let interface = try network.createInterface(id) else {
|
|
throw IntegrationError.assert(msg: "failed to create network interface")
|
|
}
|
|
|
|
// Capture the v4 address vmnet allocated so we can assert it ends up on eth0.
|
|
let expectedV4 = interface.ipv4Address.address.description
|
|
|
|
let addrBuffer = BufferWriter()
|
|
let routeBuffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.interfaces = [interface]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// `ip addr show` (no family flag) lists both v4 and v6.
|
|
let addrExec = try await container.exec("check-dual-stack-addr") { config in
|
|
config.arguments = ["ip", "addr", "show", "eth0"]
|
|
config.stdout = addrBuffer
|
|
}
|
|
try await addrExec.start()
|
|
let addrStatus = try await addrExec.wait()
|
|
try await addrExec.delete()
|
|
|
|
guard addrStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip addr show failed with status \(addrStatus)")
|
|
}
|
|
|
|
guard let addrOutput = String(data: addrBuffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert addr output to UTF8")
|
|
}
|
|
|
|
guard addrOutput.contains(expectedV4) else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected v4 address \(expectedV4) on eth0, got: \(addrOutput)")
|
|
}
|
|
guard addrOutput.contains("fd00::2") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected v6 address fd00::2 on eth0, got: \(addrOutput)")
|
|
}
|
|
|
|
// The dual-stack default routes must both be installed.
|
|
let routeExec = try await container.exec("check-dual-stack-route") { config in
|
|
config.arguments = ["ip", "-6", "route", "show"]
|
|
config.stdout = routeBuffer
|
|
}
|
|
try await routeExec.start()
|
|
let routeStatus = try await routeExec.wait()
|
|
try await routeExec.delete()
|
|
|
|
guard routeStatus.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "ip -6 route show failed with status \(routeStatus)")
|
|
}
|
|
|
|
guard let routeOutput = String(data: routeBuffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert route output to UTF8")
|
|
}
|
|
|
|
guard routeOutput.contains("default via fd00::1 dev eth0") else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'default via fd00::1 dev eth0' in v6 routes, got: \(routeOutput)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
#endif
|
|
|
|
func testSysctl() async throws {
|
|
let id = "test-container-sysctl"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.sysctl = [
|
|
"net.core.somaxconn": "4096"
|
|
]
|
|
config.process.arguments = ["cat", "/proc/sys/net/core/somaxconn"]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
guard output == "4096" else {
|
|
throw IntegrationError.assert(
|
|
msg: "sysctl net.core.somaxconn should be '4096', got '\(output ?? "nil")'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testSysctlMultiple() async throws {
|
|
let id = "test-container-sysctl-multiple"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.sysctl = [
|
|
"net.core.somaxconn": "2048",
|
|
"net.ipv4.ip_forward": "1",
|
|
]
|
|
config.process.arguments = [
|
|
"/bin/sh", "-c",
|
|
"cat /proc/sys/net/core/somaxconn && cat /proc/sys/net/ipv4/ip_forward",
|
|
]
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines)
|
|
let lines = output?.split(separator: "\n").map { $0.trimmingCharacters(in: .whitespaces) }
|
|
guard lines == ["2048", "1"] else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected sysctls ['2048', '1'], got '\(output ?? "nil")'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testNoNewPrivileges() async throws {
|
|
let id = "test-no-new-privileges"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat", "/proc/self/status"]
|
|
config.process.noNewPrivileges = true
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
// /proc/self/status contains "NoNewPrivs:\t1" when the bit is set
|
|
guard output.contains("NoNewPrivs:\t1") else {
|
|
throw IntegrationError.assert(msg: "expected NoNewPrivs to be 1, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testNoNewPrivilegesDisabled() async throws {
|
|
let id = "test-no-new-privileges-disabled"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["cat", "/proc/self/status"]
|
|
// noNewPrivileges defaults to false
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
// When noNewPrivileges is not set, NoNewPrivs should be 0
|
|
guard output.contains("NoNewPrivs:\t0") else {
|
|
throw IntegrationError.assert(msg: "expected NoNewPrivs to be 0, got: \(output)")
|
|
}
|
|
}
|
|
|
|
func testWorkingDirCreated() async throws {
|
|
let id = "test-working-dir-created"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let buffer = BufferWriter()
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/pwd"]
|
|
config.process.workingDirectory = "/does/not/exist"
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process with non-existent workingDir failed: \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to read stdout")
|
|
}
|
|
|
|
guard output == "/does/not/exist" else {
|
|
throw IntegrationError.assert(msg: "expected cwd '/does/not/exist', got '\(output)'")
|
|
}
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testWorkingDirExecCreated() async throws {
|
|
let id = "test-working-dir-exec-created"
|
|
let bs = try await bootstrap(id)
|
|
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/sleep", "1000"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("cwd-exec") { config in
|
|
config.arguments = ["/bin/pwd"]
|
|
config.workingDirectory = "/a/b/c/d"
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec with non-existent workingDir failed: \(status)")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) else {
|
|
throw IntegrationError.assert(msg: "failed to read stdout")
|
|
}
|
|
|
|
guard output == "/a/b/c/d" else {
|
|
throw IntegrationError.assert(msg: "expected cwd '/a/b/c/d', got '\(output)'")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testNoNewPrivilegesExec() async throws {
|
|
let id = "test-no-new-privileges-exec"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "100"]
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
// Exec a process with noNewPrivileges set
|
|
let buffer = BufferWriter()
|
|
let exec = try await container.exec("nnp-exec") { config in
|
|
config.arguments = ["cat", "/proc/self/status"]
|
|
config.noNewPrivileges = true
|
|
config.stdout = buffer
|
|
}
|
|
|
|
try await exec.start()
|
|
let status = try await exec.wait()
|
|
try await exec.delete()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "exec status \(status) != 0")
|
|
}
|
|
|
|
guard let output = String(data: buffer.data, encoding: .utf8) else {
|
|
throw IntegrationError.assert(msg: "failed to convert stdout to UTF8")
|
|
}
|
|
|
|
guard output.contains("NoNewPrivs:\t1") else {
|
|
throw IntegrationError.assert(msg: "expected NoNewPrivs to be 1 in exec, got: \(output)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
func testVMResourceOverhead() async throws {
|
|
let id = "test-vm-resource-overhead"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["sleep", "infinity"]
|
|
config.cpus = 2
|
|
config.memoryInBytes = 256.mib()
|
|
config.cpuOverhead = 2
|
|
config.memoryOverhead = 1024.mib()
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
do {
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let cpuBuffer = BufferWriter()
|
|
let cpuExec = try await container.exec("check-nproc") { config in
|
|
config.arguments = ["nproc"]
|
|
config.stdout = cpuBuffer
|
|
}
|
|
try await cpuExec.start()
|
|
var status = try await cpuExec.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "nproc status \(status) != 0")
|
|
}
|
|
try await cpuExec.delete()
|
|
|
|
guard let cpuStr = String(data: cpuBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines),
|
|
let cpuCount = Int(cpuStr)
|
|
else {
|
|
throw IntegrationError.assert(msg: "failed to parse nproc output")
|
|
}
|
|
let expectedCpus = 4
|
|
guard cpuCount == expectedCpus else {
|
|
throw IntegrationError.assert(msg: "nproc \(cpuCount) != expected \(expectedCpus)")
|
|
}
|
|
|
|
let memBuffer = BufferWriter()
|
|
let memExec = try await container.exec("check-meminfo") { config in
|
|
config.arguments = ["sh", "-c", "grep MemTotal /proc/meminfo | awk '{print $2}'"]
|
|
config.stdout = memBuffer
|
|
}
|
|
try await memExec.start()
|
|
status = try await memExec.wait()
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "meminfo status \(status) != 0")
|
|
}
|
|
try await memExec.delete()
|
|
|
|
guard let memStr = String(data: memBuffer.data, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines),
|
|
let memTotalKiB = UInt64(memStr)
|
|
else {
|
|
throw IntegrationError.assert(msg: "failed to parse MemTotal")
|
|
}
|
|
let memTotalBytes = memTotalKiB * 1024
|
|
let expectedMin: UInt64 = 1024.mib()
|
|
guard memTotalBytes > expectedMin else {
|
|
throw IntegrationError.assert(
|
|
msg: "MemTotal \(memTotalBytes) should exceed \(expectedMin)")
|
|
}
|
|
|
|
try await container.kill(.kill)
|
|
try await container.wait()
|
|
try await container.stop()
|
|
} catch {
|
|
try? await container.stop()
|
|
throw error
|
|
}
|
|
}
|
|
|
|
// Verify that mounts are sorted by destination path depth so that a
|
|
// higher-level mount (e.g. /mnt) doesn't shadow a deeper mount
|
|
// (e.g. /mnt/deep/nested). Both directories are separate virtiofs
|
|
// shares; the sort ensures /mnt is mounted first and /mnt/deep/nested
|
|
// on top of it.
|
|
func testMountsSortedByDepth() async throws {
|
|
let id = "test-mount-sort-depth"
|
|
|
|
let bs = try await bootstrap(id)
|
|
let buffer = BufferWriter()
|
|
|
|
// Create two separate mount directories with distinct files.
|
|
let deepDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
try "deep-content".write(to: deepDir.appendingPathComponent("deep.txt"), atomically: true, encoding: .utf8)
|
|
|
|
let shallowDir = FileManager.default.uniqueTemporaryDirectory(create: true)
|
|
try "shallow-content".write(to: shallowDir.appendingPathComponent("shallow.txt"), atomically: true, encoding: .utf8)
|
|
|
|
// Add deeper mount first, then shallower mount. Without sorting the
|
|
// shallower mount would shadow the deeper one.
|
|
let container = try LinuxContainer(id, rootfs: bs.rootfs, vmm: bs.vmm) { config in
|
|
config.process.arguments = ["/bin/cat", "/mnt/deep/nested/deep.txt"]
|
|
config.mounts.append(.share(source: deepDir.path, destination: "/mnt/deep/nested"))
|
|
config.mounts.append(.share(source: shallowDir.path, destination: "/mnt"))
|
|
config.process.stdout = buffer
|
|
config.bootLog = bs.bootLog
|
|
}
|
|
|
|
try await container.create()
|
|
try await container.start()
|
|
|
|
let status = try await container.wait()
|
|
try await container.stop()
|
|
|
|
guard status.exitCode == 0 else {
|
|
throw IntegrationError.assert(msg: "process status \(status) != 0")
|
|
}
|
|
|
|
let value = String(data: buffer.data, encoding: .utf8)
|
|
guard value == "deep-content" else {
|
|
throw IntegrationError.assert(
|
|
msg: "expected 'deep-content' but got '\(value ?? "<nil>")'")
|
|
}
|
|
}
|
|
}
|