mirror of
https://github.com/linuxserver/docker-socket-proxy.git
synced 2026-03-23 00:05:53 +08:00
e84babd1c4
* Add first version of tests From https://github.com/Tecnativa/docker-socket-proxy/pull/14 * Expand tests * Add GH CI * Apply suggestions * Apply autopretty template + fix prettier * Fix isort * Apply autoprettier * Fix VSCode settings * Make tests run in parallel * Build docker image before testing * Update workspace settings * Try multi-platform builds and push to ghcr.io * Push to docker hub as well from ci * Upgrade autopretty * Update pyproject configurations * Improve test configuration and execution TT26468 * Provide initial conftest * Improve tests * Add python3 in image * Remove POST rule from proxy * Build image before testing and push at the end Builds the image (in single arch) before testing Loads the image into local docker (See https://github.com/docker/build-push-action#export-image-to-docker) Rebuilds and pushes the final image in multi-arch at the end. * Fix python path * Remove build fixture from tests to see if image is built in CI * Organize docker tests definition and document * Restore fixture allowing usage for local testing This reverts commit dc0b60e63f05ef041383b981995f9673e919054b and allows using `--prebuild` CLI flag for pytest when doing local tests. Co-authored-by: Jairo Llopis <jairo.llopis@tecnativa.com>
79 lines
2.2 KiB
Python
79 lines
2.2 KiB
Python
import logging
|
|
|
|
import pytest
|
|
from conftest import proxy
|
|
from plumbum import ProcessExecutionError
|
|
from plumbum.cmd import docker
|
|
|
|
logger = logging.getLogger()
|
|
|
|
|
|
def _check_permissions(allowed_calls, forbidden_calls):
|
|
for args in allowed_calls:
|
|
docker(*args)
|
|
for args in forbidden_calls:
|
|
with pytest.raises(ProcessExecutionError):
|
|
docker(*args)
|
|
|
|
|
|
def test_default_permissions():
|
|
with proxy() as test_container:
|
|
allowed_calls = (("version",),)
|
|
forbidden_calls = (
|
|
("pull", "alpine"),
|
|
("--rm", "alpine", "--name", test_container),
|
|
("logs", test_container),
|
|
("wait", test_container),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
("network", "ls"),
|
|
("config", "ls"),
|
|
("service", "ls"),
|
|
("stack", "ls"),
|
|
("secret", "ls"),
|
|
("plugin", "ls"),
|
|
("info",),
|
|
("system", "info"),
|
|
("build", "."),
|
|
("swarm", "init"),
|
|
)
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_container_permissions():
|
|
with proxy(CONTAINERS=1) as test_container:
|
|
allowed_calls = [
|
|
("logs", test_container),
|
|
("inspect", test_container),
|
|
]
|
|
forbidden_calls = [
|
|
("wait", test_container),
|
|
("run", "--rm", "alpine"),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_post_permissions():
|
|
with proxy(POST=1) as test_container:
|
|
allowed_calls = []
|
|
forbidden_calls = [
|
|
("rm", "-f", test_container),
|
|
("pull", "alpine"),
|
|
("run", "--rm", "alpine"),
|
|
("network", "create", "foobar"),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_network_post_permissions():
|
|
with proxy(POST=1, NETWORKS=1):
|
|
allowed_calls = [
|
|
("network", "ls"),
|
|
("network", "create", "foo"),
|
|
("network", "rm", "foo"),
|
|
]
|
|
forbidden_calls = []
|
|
_check_permissions(allowed_calls, forbidden_calls)
|