wehub-resource-sync
4ce4204b6c
CI / Lint (push) Failing after 2s
CI / Build (push) Has been skipped
SDK CI / PHP SDK (push) Failing after 1s
Split PHP SDK / PHP SDK tests (push) Failing after 1s
CI / Test (push) Failing after 1s
CI / Dashboard (push) Failing after 0s
SDK CI / JavaScript SDK (push) Failing after 0s
SDK CI / Python SDK (push) Failing after 2s
SDK CI / Java SDK (push) Failing after 1s
Split PHP SDK / Mirror sdk/php -> rmyndharis/openwa-php (push) Has been skipped
CI / Test (PostgreSQL migrations) (push) Failing after 7m47s
CI / Docker Build (push) Has been skipped
49 lines
1.5 KiB
Bash
49 lines
1.5 KiB
Bash
#!/bin/sh
|
|
# Smoke test: verify the built image runs its process as the openwa user (not root).
|
|
# Usage: ./scripts/smoke-test-non-root.sh
|
|
# Requires Docker to be running locally.
|
|
set -e
|
|
|
|
# The Dockerfile pins the builder to $BUILDPLATFORM (BuildKit-injected) for multi-arch correctness,
|
|
# so the build requires BuildKit. It's the modern default, but force it on in case the host disabled it.
|
|
export DOCKER_BUILDKIT=1
|
|
|
|
IMAGE_TAG="openwa-test-non-root:smoke"
|
|
|
|
echo "==> Building test image..."
|
|
docker build -t "$IMAGE_TAG" .
|
|
|
|
echo ""
|
|
echo "==> Checking process user inside container..."
|
|
# Override CMD with 'id' so docker-entrypoint.sh runs: exec gosu openwa id
|
|
USER_OUTPUT=$(docker run --rm "$IMAGE_TAG" id)
|
|
echo " $USER_OUTPUT"
|
|
|
|
if echo "$USER_OUTPUT" | grep -q "uid=0(root)"; then
|
|
echo "FAIL: process is running as root!" >&2
|
|
docker rmi "$IMAGE_TAG" > /dev/null 2>&1 || true
|
|
exit 1
|
|
fi
|
|
|
|
if echo "$USER_OUTPUT" | grep -q "openwa"; then
|
|
echo "PASS: process runs as openwa (non-root)"
|
|
else
|
|
echo "FAIL: process is not running as the openwa user" >&2
|
|
docker rmi "$IMAGE_TAG" > /dev/null 2>&1 || true
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "==> Verifying dumb-init is PID 1..."
|
|
PID1=$(docker run --rm "$IMAGE_TAG" sh -c 'cat /proc/1/comm 2>/dev/null || ps -p 1 -o comm= 2>/dev/null || echo unknown')
|
|
echo " PID 1: $PID1"
|
|
if echo "$PID1" | grep -q "dumb-init"; then
|
|
echo "PASS: dumb-init is PID 1"
|
|
else
|
|
echo "WARN: PID 1 is '$PID1' (expected dumb-init) — check entrypoint chain"
|
|
fi
|
|
|
|
docker rmi "$IMAGE_TAG" > /dev/null 2>&1 || true
|
|
echo ""
|
|
echo "All smoke tests passed!"
|