Function TestCreateWithCustomReadonlyPaths

integration/container/create_test.go:317–386

(t *testing.T)

}

func TestCreateWithCustomReadonlyPaths(t *testing.T) {
	skip.If(t, testEnv.DaemonInfo.OSType != "linux")

	ctx := setupTest(t)
	apiClient := testEnv.APIClient()

	testCases := []struct {
		doc           string
		privileged    bool
		readonlyPaths []string
		expected      []string
	}{
		{
			doc:           "default readonly paths",
			readonlyPaths: nil,
			expected:      oci.DefaultSpec().Linux.ReadonlyPaths,
		},
		{
			doc:           "empty readonly paths",
			readonlyPaths: []string{},
			expected:      []string{},
		},
		{
			doc:           "custom readonly paths",
			readonlyPaths: []string{"/proc/asound", "/proc/bus"},
			expected:      []string{"/proc/asound", "/proc/bus"},
		},
		{
			// privileged containers should have no readonly paths by default
			doc:           "privileged",
			privileged:    true,
			readonlyPaths: nil,
			expected:      nil,
		},
	}

	for i, tc := range testCases {
		t.Run(tc.doc, func(t *testing.T) {
			t.Parallel()
			ctr, err := apiClient.ContainerCreate(ctx, client.ContainerCreateOptions{
				Config: &container.Config{
					Image: "busybox",
					Cmd:   []string{"true"},
				},
				HostConfig: &container.HostConfig{
					Privileged:    tc.privileged,
					ReadonlyPaths: tc.readonlyPaths,
				},
				Name: fmt.Sprintf("create-readonly-paths-%d", i),
			})
			assert.NilError(t, err)

			ctrInspect, err := apiClient.ContainerInspect(ctx, ctr.ID, client.ContainerInspectOptions{})
			assert.NilError(t, err)
			assert.DeepEqual(t, ctrInspect.Container.HostConfig.ReadonlyPaths, tc.expected)

			// Start the container.
			_, err = apiClient.ContainerStart(ctx, ctr.ID, client.ContainerStartOptions{})