mirror of
https://github.com/Tecnativa/docker-socket-proxy
synced 2025-01-06 13:50:59 +00:00
e84babd1c4
* Add first version of tests
From https://github.com/Tecnativa/docker-socket-proxy/pull/14
* Expand tests
* Add GH CI
* Apply suggestions
* Apply autopretty template + fix prettier
* Fix isort
* Apply autoprettier
* Fix VSCode settings
* Make tests run in parallel
* Build docker image before testing
* Update workspace settings
* Try multi-platform builds and push to ghcr.io
* Push to docker hub as well from ci
* Upgrade autopretty
* Update pyproject configurations
* Improve test configuration and execution
TT26468
* Provide initial conftest
* Improve tests
* Add python3 in image
* Remove POST rule from proxy
* Build image before testing and push at the end
Builds the image (in single arch) before testing
Loads the image into local docker (See https://github.com/docker/build-push-action#export-image-to-docker)
Rebuilds and pushes the final image in multi-arch at the end.
* Fix python path
* Remove build fixture from tests to see if image is built in CI
* Organize docker tests definition and document
* Restore fixture allowing usage for local testing
This reverts commit dc0b60e63f and allows using `--prebuild` CLI flag for pytest when doing local tests.
Co-authored-by: Jairo Llopis <jairo.llopis@tecnativa.com>
79 lines
2.2 KiB
Python
79 lines
2.2 KiB
Python
import logging
|
|
|
|
import pytest
|
|
from conftest import proxy
|
|
from plumbum import ProcessExecutionError
|
|
from plumbum.cmd import docker
|
|
|
|
logger = logging.getLogger()
|
|
|
|
|
|
def _check_permissions(allowed_calls, forbidden_calls):
|
|
for args in allowed_calls:
|
|
docker(*args)
|
|
for args in forbidden_calls:
|
|
with pytest.raises(ProcessExecutionError):
|
|
docker(*args)
|
|
|
|
|
|
def test_default_permissions():
|
|
with proxy() as test_container:
|
|
allowed_calls = (("version",),)
|
|
forbidden_calls = (
|
|
("pull", "alpine"),
|
|
("--rm", "alpine", "--name", test_container),
|
|
("logs", test_container),
|
|
("wait", test_container),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
("network", "ls"),
|
|
("config", "ls"),
|
|
("service", "ls"),
|
|
("stack", "ls"),
|
|
("secret", "ls"),
|
|
("plugin", "ls"),
|
|
("info",),
|
|
("system", "info"),
|
|
("build", "."),
|
|
("swarm", "init"),
|
|
)
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_container_permissions():
|
|
with proxy(CONTAINERS=1) as test_container:
|
|
allowed_calls = [
|
|
("logs", test_container),
|
|
("inspect", test_container),
|
|
]
|
|
forbidden_calls = [
|
|
("wait", test_container),
|
|
("run", "--rm", "alpine"),
|
|
("rm", "-f", test_container),
|
|
("restart", test_container),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_post_permissions():
|
|
with proxy(POST=1) as test_container:
|
|
allowed_calls = []
|
|
forbidden_calls = [
|
|
("rm", "-f", test_container),
|
|
("pull", "alpine"),
|
|
("run", "--rm", "alpine"),
|
|
("network", "create", "foobar"),
|
|
]
|
|
_check_permissions(allowed_calls, forbidden_calls)
|
|
|
|
|
|
def test_network_post_permissions():
|
|
with proxy(POST=1, NETWORKS=1):
|
|
allowed_calls = [
|
|
("network", "ls"),
|
|
("network", "create", "foo"),
|
|
("network", "rm", "foo"),
|
|
]
|
|
forbidden_calls = []
|
|
_check_permissions(allowed_calls, forbidden_calls)
|