wehub-resource-sync
b4fbd6fe9f
Deploy Site / deploy-vercel (push) Has been skipped
Deploy Site / deploy-docs (push) Has been skipped
Build Skills Index / build-index (push) Has been skipped
CI / Deny unrelated histories (push) Has been skipped
CI / Detect affected areas (push) Successful in 27m35s
CI / OSV scan (push) Failing after 4s
CI / Build&Test Docker image (push) Successful in 9s
CI / Supply-chain scan (push) Has been skipped
CI / Lint Docker scripts (push) Failing after 5m13s
CI / Check contributors (push) Failing after 12m8s
CI / Docs Site (push) Failing after 12m8s
CI / TypeScript (push) Failing after 12m8s
CI / Python lints (push) Failing after 12m9s
CI / Python tests (push) Failing after 12m9s
CI / Check uv.lock (push) Failing after 23m22s
CI / CI timing report (push) Has been cancelled
Build Skills Index / trigger-deploy (push) Has been cancelled
CI / All required checks pass (push) Has been cancelled
66 lines
2.2 KiB
Python
66 lines
2.2 KiB
Python
"""Runtime smoke tests for Docker --user flag guard.
|
|
|
|
Build the real image and verify the actual runtime behavior:
|
|
|
|
1. docker run --user <arbitrary-uid> is rejected with actionable guidance
|
|
2. Root start (default) works fine
|
|
3. --user <hermes-uid> (10000) is allowed (supported non-root start)
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import subprocess
|
|
|
|
|
|
def test_arbitrary_user_uid_rejected(
|
|
built_image: str,
|
|
) -> None:
|
|
"""docker run --user 1000 must be rejected with actionable guidance."""
|
|
r = subprocess.run(
|
|
["docker", "run", "--rm", "--user", "1000:1000",
|
|
built_image, "echo", "should_not_reach"],
|
|
capture_output=True, text=True, timeout=60,
|
|
)
|
|
assert r.returncode != 0, (
|
|
f"container started with arbitrary --user UID unexpectedly: {r.stdout}"
|
|
)
|
|
assert "should_not_reach" not in r.stdout, (
|
|
f"container ran despite --user rejection: {r.stdout}"
|
|
)
|
|
combined = r.stdout + r.stderr
|
|
assert "not supported" in combined.lower(), (
|
|
f"rejection message missing 'not supported': {combined[-500:]}"
|
|
)
|
|
# Must mention the remediation env vars
|
|
assert "HERMES_UID" in combined or "PUID" in combined, (
|
|
f"rejection message missing remediation guidance: {combined[-500:]}"
|
|
)
|
|
|
|
|
|
def test_root_start_works(
|
|
built_image: str,
|
|
) -> None:
|
|
"""Root start (the default) must work without issues."""
|
|
r = subprocess.run(
|
|
["docker", "run", "--rm", built_image, "sh", "-c", "echo OK"],
|
|
capture_output=True, text=True, timeout=60,
|
|
)
|
|
assert r.returncode == 0, f"root start failed: {r.stderr[-500:]}"
|
|
assert "OK" in r.stdout
|
|
|
|
|
|
def test_user_pinned_to_hermes_uid_works(
|
|
built_image: str,
|
|
) -> None:
|
|
"""docker run --user 10000:10000 (the hermes UID) must be allowed.
|
|
|
|
This is the supported non-root start from #34648 / #34837.
|
|
"""
|
|
r = subprocess.run(
|
|
["docker", "run", "--rm", "--user", "10000:10000",
|
|
built_image, "sh", "-c", "echo OK"],
|
|
capture_output=True, text=True, timeout=60,
|
|
)
|
|
assert r.returncode == 0, (
|
|
f"--user 10000:10000 (hermes UID) was rejected: {r.stderr[-500:]}"
|
|
)
|
|
assert "OK" in r.stdout |