Add tests for state namespacing

Signed-off-by: Matthew Heon <matthew.heon@gmail.com>

libpod/boltdb_state.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/boltdb/bolt"
 	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
 // BoltState is a state implementation backed by a Bolt DB
@@ -29,6 +30,8 @@ func NewBoltState(path, lockDir string, runtime *Runtime) (State, error) {
 	state.namespace = ""
 	state.namespaceBytes = nil
 
+	logrus.Debugf("Initializing boltdb state at %s", path)
+
 	// Make the directory that will hold container lockfiles
 	if err := os.MkdirAll(lockDir, 0750); err != nil {
 		// The directory is allowed to exist
@@ -367,10 +370,10 @@ func (s *BoltState) HasContainer(id string) (bool, error) {
 			return err
 		}
 
-		ctrExists := ctrBucket.Bucket(ctrID)
+		ctrDB := ctrBucket.Bucket(ctrID)
-		if ctrExists != nil {
+		if ctrDB != nil {
 			if s.namespaceBytes != nil {
-				nsBytes := ctrBucket.Get(namespaceKey)
+				nsBytes := ctrDB.Get(namespaceKey)
 				if bytes.Equal(nsBytes, s.namespaceBytes) {
 					exists = true
 				}

libpod/state_test.go

@@ -345,6 +345,59 @@ func TestGetContainerWithEmptyIDFails(t *testing.T) {
 	})
 }
 
+func TestGetContainerInDifferentNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test2"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		_, err = state.Container(testCtr.ID())
+		assert.Error(t, err)
+	})
+}
+
+func TestGetContainerInSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		ctr, err := state.Container(testCtr.ID())
+		assert.NoError(t, err)
+
+		testContainersEqual(t, testCtr, ctr)
+	})
+}
+
+func TestGetContainerInNamespaceWhileNotInNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		ctr, err := state.Container(testCtr.ID())
+		assert.NoError(t, err)
+
+		testContainersEqual(t, testCtr, ctr)
+	})
+}
+
 func TestLookupContainerWithEmptyIDFails(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.LookupContainer("")
@@ -448,6 +501,66 @@ func TestLookupCtrByPodIDFails(t *testing.T) {
 	})
 }
 
+func TestLookupCtrInSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		ctr, err := state.LookupContainer(testCtr.ID())
+		assert.NoError(t, err)
+
+		testContainersEqual(t, testCtr, ctr)
+	})
+}
+
+func TestLookupCtrInDifferentNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.LookupContainer(testCtr.ID())
+		assert.Error(t, err)
+	})
+}
+
+func TestLookupContainerMatchInDifferentNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr1, err := getTestContainer(strings.Repeat("0", 32), "test1", lockPath)
+		assert.NoError(t, err)
+		testCtr1.config.Namespace = "test2"
+		testCtr2, err := getTestContainer(strings.Repeat("0", 31)+"1", "test2", lockPath)
+		assert.NoError(t, err)
+		testCtr2.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr1)
+		assert.NoError(t, err)
+
+		err = state.AddContainer(testCtr2)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		ctr, err := state.LookupContainer("000")
+		assert.NoError(t, err)
+
+		testContainersEqual(t, testCtr2, ctr)
+	})
+}
+
 func TestHasContainerEmptyIDFails(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.HasContainer("")
@@ -491,6 +604,42 @@ func TestHasContainerPodIDIsFalse(t *testing.T) {
 	})
 }
 
+func TestHasContainerSameNamespaceIsTrue(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		exists, err := state.HasContainer(testCtr.ID())
+		assert.NoError(t, err)
+		assert.True(t, exists)
+	})
+}
+
+func TestHasContainerDifferentNamespaceIsFalse(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		exists, err := state.HasContainer(testCtr.ID())
+		assert.NoError(t, err)
+		assert.False(t, exists)
+	})
+}
+
 func TestSaveAndUpdateContainer(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testCtr, err := getTestCtr1(lockPath)
@@ -516,6 +665,35 @@ func TestSaveAndUpdateContainer(t *testing.T) {
 	})
 }
 
+func TestSaveAndUpdateContainerSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		retrievedCtr, err := state.Container(testCtr.ID())
+		assert.NoError(t, err)
+
+		retrievedCtr.state.State = ContainerStateStopped
+		retrievedCtr.state.ExitCode = 127
+		retrievedCtr.state.FinishedTime = time.Now()
+
+		err = state.SaveContainer(retrievedCtr)
+		assert.NoError(t, err)
+
+		err = state.UpdateContainer(testCtr)
+		assert.NoError(t, err)
+
+		testContainersEqual(t, testCtr, retrievedCtr)
+	})
+}
+
 func TestUpdateContainerNotInDatabaseReturnsError(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testCtr, err := getTestCtr1(lockPath)
@@ -534,6 +712,23 @@ func TestUpdateInvalidContainerReturnsError(t *testing.T) {
 	})
 }
 
+func TestUpdateContainerNotInNamespaceReturnsError(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		err = state.UpdateContainer(testCtr)
+		assert.Error(t, err)
+	})
+}
+
 func TestSaveInvalidContainerReturnsError(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		err := state.SaveContainer(&Container{config: &ContainerConfig{ID: "1234"}})
@@ -552,6 +747,23 @@ func TestSaveContainerNotInStateReturnsError(t *testing.T) {
 	})
 }
 
+func TestSaveContainerNotInNamespaceReturnsError(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		err = state.SaveContainer(testCtr)
+		assert.Error(t, err)
+	})
+}
+
 func TestRemoveContainer(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testCtr, err := getTestCtr1(lockPath)
@@ -584,6 +796,33 @@ func TestRemoveNonexistantContainerFails(t *testing.T) {
 	})
 }
 
+func TestRemoveContainerNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		ctrs, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(ctrs))
+
+		state.SetNamespace("test2")
+
+		err = state.RemoveContainer(testCtr)
+		assert.Error(t, err)
+
+		state.SetNamespace("")
+
+		ctrs2, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(ctrs2))
+	})
+}
+
 func TestGetAllContainersOnNewStateIsEmpty(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		ctrs, err := state.AllContainers()
@@ -627,6 +866,50 @@ func TestGetAllContainersTwoContainers(t *testing.T) {
 	})
 }
 
+func TestGetAllContainersNoContainerInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		ctrs, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(ctrs))
+	})
+}
+
+func TestGetContainerOneContainerInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr1, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr1.config.Namespace = "test1"
+
+		testCtr2, err := getTestCtr2(lockPath)
+		assert.NoError(t, err)
+
+		err = state.AddContainer(testCtr1)
+		assert.NoError(t, err)
+
+		err = state.AddContainer(testCtr2)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		ctrs, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(ctrs))
+
+		testContainersEqual(t, testCtr1, ctrs[0])
+	})
+}
+
 func TestContainerInUseInvalidContainer(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.ContainerInUse(&Container{})
@@ -638,7 +921,24 @@ func TestContainerInUseCtrNotInState(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testCtr, err := getTestCtr1(lockPath)
 		assert.NoError(t, err)
-		_, err := state.ContainerInUse(testCtr)
+		_, err = state.ContainerInUse(testCtr)
+		assert.Error(t, err)
+	})
+}
+
+func TestContainerInUseCtrNotInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testCtr, err := getTestCtr1(lockPath)
+		assert.NoError(t, err)
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddContainer(testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.ContainerInUse(testCtr)
 		assert.Error(t, err)
 	})
 }
@@ -1031,6 +1331,42 @@ func TestGetPodByCtrID(t *testing.T) {
 	})
 }
 
+func TestGetPodInNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		statePod, err := state.Pod(testPod.ID())
+		assert.NoError(t, err)
+
+		testPodsEqual(t, testPod, statePod)
+	})
+}
+
+func TestGetPodPodNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.Pod(testPod.ID())
+		assert.Error(t, err)
+	})
+}
+
 func TestLookupPodEmptyID(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.LookupPod("")
@@ -1135,6 +1471,69 @@ func TestLookupPodByCtrName(t *testing.T) {
 	})
 }
 
+func TestLookupPodInSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		statePod, err := state.LookupPod(testPod.ID())
+		assert.NoError(t, err)
+
+		testPodsEqual(t, testPod, statePod)
+	})
+}
+
+func TestLookupPodInDifferentNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.LookupPod(testPod.ID())
+		assert.Error(t, err)
+	})
+}
+
+func TestLookupPodOneInDifferentNamespaceFindsRightPod(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod1, err := getTestPod(strings.Repeat("1", 32), "test1", lockPath)
+		assert.NoError(t, err)
+
+		testPod1.config.Namespace = "test1"
+
+		testPod2, err := getTestPod(strings.Repeat("1", 31)+"2", "test2", lockPath)
+		assert.NoError(t, err)
+
+		testPod2.config.Namespace = "test2"
+
+		err = state.AddPod(testPod1)
+		assert.NoError(t, err)
+
+		err = state.AddPod(testPod2)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		pod, err := state.LookupPod(strings.Repeat("1", 5))
+		assert.NoError(t, err)
+
+		testPodsEqual(t, testPod1, pod)
+	})
+}
+
 func TestHasPodEmptyIDErrors(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.HasPod("")
@@ -1192,6 +1591,42 @@ func TestHasPodCtrIDFalse(t *testing.T) {
 	})
 }
 
+func TestHasPodSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		exist, err := state.HasPod(testPod.ID())
+		assert.NoError(t, err)
+		assert.True(t, exist)
+	})
+}
+
+func TestHasPodDifferentNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		exist, err := state.HasPod(testPod.ID())
+		assert.NoError(t, err)
+		assert.False(t, exist)
+	})
+}
+
 func TestAddPodInvalidPodErrors(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		err := state.AddPod(&Pod{config: &PodConfig{}})
@@ -1427,6 +1862,29 @@ func TestRemovePodAfterEmptySucceeds(t *testing.T) {
 	})
 }
 
+func TestRemovePodNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		err = state.RemovePod(testPod)
+		assert.Error(t, err)
+
+		state.SetNamespace("")
+
+		allPods, err := state.AllPods()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(allPods))
+	})
+}
+
 func TestAllPodsEmptyOnEmptyState(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		allPods, err := state.AllPods()
@@ -1489,6 +1947,52 @@ func TestAllPodsMultiplePods(t *testing.T) {
 	})
 }
 
+func TestAllPodsPodInDifferentNamespaces(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		allPods, err := state.AllPods()
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(allPods))
+	})
+}
+
+func TestAllPodsOnePodInDifferentNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod1, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod1.config.Namespace = "test1"
+
+		testPod2, err := getTestPod2(lockPath)
+		assert.NoError(t, err)
+
+		testPod2.config.Namespace = "test2"
+
+		err = state.AddPod(testPod1)
+		assert.NoError(t, err)
+
+		err = state.AddPod(testPod2)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		allPods, err := state.AllPods()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(allPods))
+
+		testPodsEqual(t, testPod1, allPods[0])
+	})
+}
+
 func TestPodHasContainerNoSuchPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.PodHasContainer(&Pod{config: &PodConfig{}}, strings.Repeat("0", 32))
@@ -1565,6 +2069,23 @@ func TestPodHasContainerSucceeds(t *testing.T) {
 	})
 }
 
+func TestPodHasContainerPodNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.PodHasContainer(testPod, strings.Repeat("2", 32))
+		assert.Error(t, err)
+	})
+}
+
 func TestPodContainersByIDInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.PodContainersByID(&Pod{config: &PodConfig{}})
@@ -1667,6 +2188,23 @@ func TestPodContainersByIDMultipleContainers(t *testing.T) {
 	})
 }
 
+func TestPodContainerByIDPodNotInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.PodContainersByID(testPod)
+		assert.Error(t, err)
+	})
+}
+
 func TestPodContainersInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		_, err := state.PodContainers(&Pod{config: &PodConfig{}})
@@ -1674,7 +2212,7 @@ func TestPodContainersInvalidPod(t *testing.T) {
 	})
 }
 
-func TestPodContainerdPodNotInState(t *testing.T) {
+func TestPodContainersPodNotInState(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testPod, err := getTestPod1(lockPath)
 		assert.NoError(t, err)
@@ -1770,6 +2308,23 @@ func TestPodContainersMultipleContainers(t *testing.T) {
 	})
 }
 
+func TestPodContainersPodNotInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.PodContainers(testPod)
+		assert.Error(t, err)
+	})
+}
+
 func TestRemovePodContainersInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		err := state.RemovePodContainers(&Pod{config: &PodConfig{}})
@@ -1926,6 +2481,23 @@ func TestRemovePodContainerDependencyInPod(t *testing.T) {
 	})
 }
 
+func TestRemoveContainersNotInNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		err := state.RemovePodContainers(testPod)
+		assert.Error(t, err)
+	})
+}
+
 func TestAddContainerToPodInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testCtr, err := getTestCtr1(lockPath)
@@ -2620,6 +3192,76 @@ func TestRemoveContainerFromPodWithDependencySucceedsAfterDepRemoved(t *testing.
 	})
 }
 
+func TestRemoveContainerFromPodSameNamespaceSucceeds(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		testCtr, err := getTestCtr2(lockPath)
+		assert.NoError(t, err)
+		testCtr.config.Pod = testPod.ID()
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		err = state.AddContainerToPod(testPod, testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		err = state.RemoveContainerFromPod(testPod, testCtr)
+		assert.NoError(t, err)
+
+		ctrs, err := state.PodContainers(testPod)
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(ctrs))
+
+		allCtrs, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 0, len(allCtrs))
+	})
+}
+
+func TestRemoveContainerFromPodDifferentNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		testCtr, err := getTestCtr2(lockPath)
+		assert.NoError(t, err)
+		testCtr.config.Pod = testPod.ID()
+
+		testCtr.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		err = state.AddContainerToPod(testPod, testCtr)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		err = state.RemoveContainerFromPod(testPod, testCtr)
+		assert.Error(t, err)
+
+		state.SetNamespace("")
+
+		ctrs, err := state.PodContainers(testPod)
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(ctrs))
+
+		allCtrs, err := state.AllContainers()
+		assert.NoError(t, err)
+		assert.Equal(t, 1, len(allCtrs))
+	})
+}
+
 func TestUpdatePodInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		err := state.UpdatePod(&Pod{config: &PodConfig{}})
@@ -2637,6 +3279,23 @@ func TestUpdatePodPodNotInStateFails(t *testing.T) {
 	})
 }
 
+func TestUpdatePodNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.UpdatePod(testPod)
+		assert.Error(t, err)
+	})
+}
+
 func TestSavePodInvalidPod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		err := state.SavePod(&Pod{config: &PodConfig{}})
@@ -2654,6 +3313,23 @@ func TestSavePodPodNotInStateFails(t *testing.T) {
 	})
 }
 
+func TestSavePodNotInNamespaceFails(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test2")
+
+		_, err = state.SavePod(testPod)
+		assert.Error(t, err)
+	})
+}
+
 func TestSaveAndUpdatePod(t *testing.T) {
 	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
 		testPod, err := getTestPod1(lockPath)
@@ -2678,3 +3354,32 @@ func TestSaveAndUpdatePod(t *testing.T) {
 		testPodsEqual(t, testPod, statePod)
 	})
 }
+
+func TestSaveAndUpdatePodSameNamespace(t *testing.T) {
+	runForAllStates(t, func(t *testing.T, state State, lockPath string) {
+		testPod, err := getTestPod1(lockPath)
+		assert.NoError(t, err)
+
+		testPod.config.Namespace = "test1"
+
+		err = state.AddPod(testPod)
+		assert.NoError(t, err)
+
+		state.SetNamespace("test1")
+
+		statePod, err := state.Pod(testPod.ID())
+		assert.NoError(t, err)
+
+		testPodsEqual(t, testPod, statePod)
+
+		testPod.state.CgroupPath = "/new/path/for/test"
+
+		err = state.SavePod(testPod)
+		assert.NoError(t, err)
+
+		err = state.UpdatePod(statePod)
+		assert.NoError(t, err)
+
+		testPodsEqual(t, testPod, statePod)
+	})
+}