2021-12-19 01:06:50 +00:00
|
|
|
import ../make-test-python.nix (
|
2020-04-24 23:36:52 +00:00
|
|
|
{ pkgs, lib, ... }: {
|
|
|
|
name = "podman";
|
|
|
|
meta = {
|
|
|
|
maintainers = lib.teams.podman.members;
|
|
|
|
};
|
|
|
|
|
|
|
|
nodes = {
|
2022-11-04 12:27:35 +00:00
|
|
|
podman = { pkgs, ... }: {
|
|
|
|
virtualisation.podman.enable = true;
|
|
|
|
|
|
|
|
users.users.alice = {
|
|
|
|
isNormalUser = true;
|
|
|
|
};
|
|
|
|
};
|
2023-01-11 07:51:40 +00:00
|
|
|
dns = { pkgs, ... }: {
|
|
|
|
virtualisation.podman.enable = true;
|
|
|
|
|
|
|
|
virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
|
|
|
|
|
|
|
|
networking.firewall.allowedUDPPorts = [ 53 ];
|
|
|
|
};
|
2022-11-04 12:27:35 +00:00
|
|
|
docker = { pkgs, ... }: {
|
|
|
|
virtualisation.podman.enable = true;
|
|
|
|
|
|
|
|
virtualisation.podman.dockerSocket.enable = true;
|
|
|
|
|
|
|
|
environment.systemPackages = [
|
|
|
|
pkgs.docker-client
|
|
|
|
];
|
2020-04-24 23:36:52 +00:00
|
|
|
|
2022-11-04 12:27:35 +00:00
|
|
|
users.users.alice = {
|
|
|
|
isNormalUser = true;
|
|
|
|
extraGroups = [ "podman" ];
|
2020-04-24 23:36:52 +00:00
|
|
|
};
|
2022-11-04 12:27:35 +00:00
|
|
|
|
|
|
|
users.users.mallory = {
|
|
|
|
isNormalUser = true;
|
|
|
|
};
|
|
|
|
};
|
2020-04-24 23:36:52 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
testScript = ''
|
|
|
|
import shlex
|
|
|
|
|
|
|
|
|
2021-06-01 10:57:12 +00:00
|
|
|
def su_cmd(cmd, user = "alice"):
|
2020-04-24 23:36:52 +00:00
|
|
|
cmd = shlex.quote(cmd)
|
2021-06-01 10:57:12 +00:00
|
|
|
return f"su {user} -l -c {cmd}"
|
2020-04-24 23:36:52 +00:00
|
|
|
|
|
|
|
|
|
|
|
podman.wait_for_unit("sockets.target")
|
2023-01-11 07:51:40 +00:00
|
|
|
dns.wait_for_unit("sockets.target")
|
2022-11-04 12:27:35 +00:00
|
|
|
docker.wait_for_unit("sockets.target")
|
2020-04-24 23:36:52 +00:00
|
|
|
start_all()
|
|
|
|
|
2020-05-29 06:06:01 +00:00
|
|
|
with subtest("Run container as root with runc"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
|
2020-04-24 23:36:52 +00:00
|
|
|
podman.succeed(
|
2020-05-29 06:06:01 +00:00
|
|
|
"podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
2020-04-24 23:36:52 +00:00
|
|
|
)
|
|
|
|
podman.succeed("podman ps | grep sleeping")
|
|
|
|
podman.succeed("podman stop sleeping")
|
2020-05-29 06:06:01 +00:00
|
|
|
podman.succeed("podman rm sleeping")
|
2020-04-24 23:36:52 +00:00
|
|
|
|
2020-05-29 06:06:01 +00:00
|
|
|
with subtest("Run container as root with crun"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
|
2020-05-29 06:06:01 +00:00
|
|
|
podman.succeed(
|
|
|
|
"podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
|
|
|
)
|
|
|
|
podman.succeed("podman ps | grep sleeping")
|
|
|
|
podman.succeed("podman stop sleeping")
|
|
|
|
podman.succeed("podman rm sleeping")
|
|
|
|
|
2020-12-03 08:41:04 +00:00
|
|
|
with subtest("Run container as root with the default backend"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
|
2020-12-03 08:41:04 +00:00
|
|
|
podman.succeed(
|
|
|
|
"podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
|
|
|
)
|
|
|
|
podman.succeed("podman ps | grep sleeping")
|
|
|
|
podman.succeed("podman stop sleeping")
|
|
|
|
podman.succeed("podman rm sleeping")
|
|
|
|
|
2022-11-04 12:27:35 +00:00
|
|
|
# start systemd session for rootless
|
2021-02-05 17:12:51 +00:00
|
|
|
podman.succeed("loginctl enable-linger alice")
|
2022-11-04 12:27:35 +00:00
|
|
|
podman.succeed(su_cmd("whoami"))
|
|
|
|
podman.sleep(1)
|
2021-02-05 17:12:51 +00:00
|
|
|
|
|
|
|
with subtest("Run container rootless with runc"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
|
2021-02-05 17:12:51 +00:00
|
|
|
podman.succeed(
|
|
|
|
su_cmd(
|
|
|
|
"podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
|
|
|
)
|
|
|
|
)
|
|
|
|
podman.succeed(su_cmd("podman ps | grep sleeping"))
|
|
|
|
podman.succeed(su_cmd("podman stop sleeping"))
|
|
|
|
podman.succeed(su_cmd("podman rm sleeping"))
|
|
|
|
|
2020-12-03 08:41:04 +00:00
|
|
|
with subtest("Run container rootless with crun"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
|
2020-05-29 06:06:01 +00:00
|
|
|
podman.succeed(
|
|
|
|
su_cmd(
|
2020-12-03 08:41:04 +00:00
|
|
|
"podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
2020-05-29 06:06:01 +00:00
|
|
|
)
|
|
|
|
)
|
|
|
|
podman.succeed(su_cmd("podman ps | grep sleeping"))
|
|
|
|
podman.succeed(su_cmd("podman stop sleeping"))
|
|
|
|
podman.succeed(su_cmd("podman rm sleeping"))
|
|
|
|
|
2020-12-03 08:41:04 +00:00
|
|
|
with subtest("Run container rootless with the default backend"):
|
2021-12-19 01:06:50 +00:00
|
|
|
podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
|
2020-04-24 23:36:52 +00:00
|
|
|
podman.succeed(
|
|
|
|
su_cmd(
|
2020-12-03 08:41:04 +00:00
|
|
|
"podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
|
2020-04-24 23:36:52 +00:00
|
|
|
)
|
|
|
|
)
|
|
|
|
podman.succeed(su_cmd("podman ps | grep sleeping"))
|
|
|
|
podman.succeed(su_cmd("podman stop sleeping"))
|
2020-05-29 06:06:01 +00:00
|
|
|
podman.succeed(su_cmd("podman rm sleeping"))
|
2021-03-23 19:22:30 +00:00
|
|
|
|
|
|
|
with subtest("Run container with init"):
|
|
|
|
podman.succeed(
|
2021-12-19 01:06:50 +00:00
|
|
|
"tar cv -C ${pkgs.pkgsStatic.busybox} . | podman import - busybox"
|
2021-03-23 19:22:30 +00:00
|
|
|
)
|
|
|
|
pid = podman.succeed("podman run --rm busybox readlink /proc/self").strip()
|
|
|
|
assert pid == "1"
|
|
|
|
pid = podman.succeed("podman run --rm --init busybox readlink /proc/self").strip()
|
|
|
|
assert pid == "2"
|
2021-06-01 10:57:12 +00:00
|
|
|
|
2023-01-11 07:51:40 +00:00
|
|
|
with subtest("aardvark-dns"):
|
|
|
|
dns.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
|
|
|
|
dns.succeed(
|
|
|
|
"podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Hi</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8000"
|
|
|
|
)
|
|
|
|
dns.succeed("podman ps | grep webserver")
|
|
|
|
dns.succeed("""
|
|
|
|
for i in `seq 0 120`; do
|
|
|
|
podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${pkgs.curl}/bin/curl http://webserver:8000 >/dev/console \
|
|
|
|
&& exit 0
|
|
|
|
sleep 0.5
|
|
|
|
done
|
|
|
|
exit 1
|
|
|
|
""")
|
|
|
|
dns.succeed("podman stop webserver")
|
|
|
|
dns.succeed("podman rm webserver")
|
|
|
|
|
2021-06-01 10:57:12 +00:00
|
|
|
with subtest("A podman member can use the docker cli"):
|
2022-11-04 12:27:35 +00:00
|
|
|
docker.succeed(su_cmd("docker version"))
|
2021-06-01 10:57:12 +00:00
|
|
|
|
|
|
|
with subtest("Run container via docker cli"):
|
2022-11-04 12:27:35 +00:00
|
|
|
docker.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
|
|
|
|
docker.succeed(
|
2022-03-05 16:20:37 +00:00
|
|
|
"docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin localhost/scratchimg /bin/sleep 10"
|
2021-06-01 10:57:12 +00:00
|
|
|
)
|
2022-11-04 12:27:35 +00:00
|
|
|
docker.succeed("docker ps | grep sleeping")
|
|
|
|
docker.succeed("podman ps | grep sleeping")
|
|
|
|
docker.succeed("docker stop sleeping")
|
|
|
|
docker.succeed("docker rm sleeping")
|
2021-06-01 10:57:12 +00:00
|
|
|
|
|
|
|
with subtest("A podman non-member can not use the docker cli"):
|
2022-11-04 12:27:35 +00:00
|
|
|
docker.fail(su_cmd("docker version", user="mallory"))
|
2021-06-01 10:57:12 +00:00
|
|
|
|
|
|
|
# TODO: add docker-compose test
|
|
|
|
|
2020-04-24 23:36:52 +00:00
|
|
|
'';
|
|
|
|
}
|
|
|
|
)
|