Function TestCreateWithCustomMaskedPaths

integration/container/create_test.go:244–315

(t *testing.T)

}

func TestCreateWithCustomMaskedPaths(t *testing.T) {
	skip.If(t, testEnv.DaemonInfo.OSType != "linux")

	ctx := setupTest(t)
	apiClient := testEnv.APIClient()

	testCases := []struct {
		doc         string
		privileged  bool
		maskedPaths []string
		expected    []string
	}{
		{
			doc:         "default masked paths",
			maskedPaths: nil,
			expected:    oci.DefaultSpec().Linux.MaskedPaths,
		},
		{
			doc:         "no masked paths",
			maskedPaths: []string{},
			expected:    []string{},
		},
		{
			doc:         "custom masked paths",
			maskedPaths: []string{"/proc/kcore", "/proc/keys"},
			expected:    []string{"/proc/kcore", "/proc/keys"},
		},
		{
			// privileged containers should have no masked paths by default
			doc:         "privileged",
			privileged:  true,
			maskedPaths: nil,
			expected:    nil,
		},
	}

	for i, tc := range testCases {
		t.Run(tc.doc, func(t *testing.T) {
			t.Parallel()

			// Create the container.
			ctr, err := apiClient.ContainerCreate(ctx, client.ContainerCreateOptions{
				Config: &container.Config{
					Image: "busybox",
					Cmd:   []string{"true"},
				},
				HostConfig: &container.HostConfig{
					Privileged:  tc.privileged,
					MaskedPaths: tc.maskedPaths,
				},
				Name: fmt.Sprintf("create-masked-paths-%d", i),
			})
			assert.NilError(t, err)

			inspect, err := apiClient.ContainerInspect(ctx, ctr.ID, client.ContainerInspectOptions{})
			assert.NilError(t, err)
			assert.DeepEqual(t, inspect.Container.HostConfig.MaskedPaths, tc.expected)