(t *testing.T)
| 496 | } |
| 497 | |
| 498 | func TestBuildEntitlements(t *testing.T) { |
| 499 | c := NewParallelCLI(t) |
| 500 | |
| 501 | // declare builder |
| 502 | result := c.RunDockerCmd(t, "buildx", "create", "--name", "build-insecure", "--use", "--bootstrap", "--buildkitd-flags", |
| 503 | `'--allow-insecure-entitlement=security.insecure'`) |
| 504 | assert.NilError(t, result.Error) |
| 505 | |
| 506 | t.Cleanup(func() { |
| 507 | c.RunDockerComposeCmd(t, "--project-directory", "fixtures/build-test/entitlements", "down") |
| 508 | _ = c.RunDockerCmd(t, "buildx", "rm", "-f", "build-insecure") |
| 509 | }) |
| 510 | |
| 511 | t.Run("use build privileged mode to run insecure build command", func(t *testing.T) { |
| 512 | res := c.RunDockerComposeCmd(t, "--project-directory", "fixtures/build-test/entitlements", "build") |
| 513 | capEffRe := regexp.MustCompile("CapEff:\t([0-9a-f]+)") |
| 514 | matches := capEffRe.FindStringSubmatch(res.Stdout()) |
| 515 | assert.Equal(t, 2, len(matches), "Did not match CapEff in output, matches: %v", matches) |
| 516 | |
| 517 | capEff, err := strconv.ParseUint(matches[1], 16, 64) |
| 518 | assert.NilError(t, err, "Parsing CapEff: %s", matches[1]) |
| 519 | |
| 520 | // NOTE: can't use constant from x/sys/unix or tests won't compile on macOS/Windows |
| 521 | // #define CAP_SYS_ADMIN 21 |
| 522 | // https://github.com/torvalds/linux/blob/v6.1/include/uapi/linux/capability.h#L278 |
| 523 | const capSysAdmin = 0x15 |
| 524 | if capEff&capSysAdmin != capSysAdmin { |
| 525 | t.Fatalf("CapEff %s is missing CAP_SYS_ADMIN", matches[1]) |
| 526 | } |
| 527 | }) |
| 528 | } |
| 529 | |
| 530 | func TestBuildDependsOn(t *testing.T) { |
| 531 | c := NewParallelCLI(t) |
nothing calls this directly
no test coverage detected