(t *testing.T)
| 363 | } |
| 364 | |
| 365 | func TestBuildPrivileged(t *testing.T) { |
| 366 | c := NewParallelCLI(t) |
| 367 | |
| 368 | // declare builder |
| 369 | result := c.RunDockerCmd(t, "buildx", "create", "--name", "build-privileged", "--use", "--bootstrap", "--buildkitd-flags", |
| 370 | `'--allow-insecure-entitlement=security.insecure'`) |
| 371 | assert.NilError(t, result.Error) |
| 372 | |
| 373 | t.Cleanup(func() { |
| 374 | c.RunDockerComposeCmd(t, "--project-directory", "fixtures/build-test/privileged", "down") |
| 375 | _ = c.RunDockerCmd(t, "buildx", "rm", "-f", "build-privileged") |
| 376 | }) |
| 377 | |
| 378 | t.Run("use build privileged mode to run insecure build command", func(t *testing.T) { |
| 379 | res := c.RunDockerComposeCmd(t, "--project-directory", "fixtures/build-test/privileged", "build") |
| 380 | capEffRe := regexp.MustCompile("CapEff:\t([0-9a-f]+)") |
| 381 | matches := capEffRe.FindStringSubmatch(res.Stdout()) |
| 382 | assert.Equal(t, 2, len(matches), "Did not match CapEff in output, matches: %v", matches) |
| 383 | |
| 384 | capEff, err := strconv.ParseUint(matches[1], 16, 64) |
| 385 | assert.NilError(t, err, "Parsing CapEff: %s", matches[1]) |
| 386 | |
| 387 | // NOTE: can't use constant from x/sys/unix or tests won't compile on macOS/Windows |
| 388 | // #define CAP_SYS_ADMIN 21 |
| 389 | // https://github.com/torvalds/linux/blob/v6.1/include/uapi/linux/capability.h#L278 |
| 390 | const capSysAdmin = 0x15 |
| 391 | if capEff&capSysAdmin != capSysAdmin { |
| 392 | t.Fatalf("CapEff %s is missing CAP_SYS_ADMIN", matches[1]) |
| 393 | } |
| 394 | }) |
| 395 | } |
| 396 | |
| 397 | func TestBuildPlatformsStandardErrors(t *testing.T) { |
| 398 | c := NewParallelCLI(t) |
nothing calls this directly
no test coverage detected