podman/test/apiv2
Paul Holzinger 597ebeb60f
top: do not depend on ps(1) in container
This ended up more complicated then expected. Lets start first with the
problem to show why I am doing this:

Currently we simply execute ps(1) in the container. This has some
drawbacks. First, obviously you need to have ps(1) in the container
image. That is no always the case especially in small images. Second,
even if you do it will often be only busybox's ps which supports far
less options.

Now we also have psgo which is used by default but that only supports a
small subset of ps(1) options. Implementing all options there is way to
much work.

Docker on the other hand executes ps(1) directly on the host and tries
to filter pids with `-q` an option which is not supported by busybox's
ps and conflicts with other ps(1) arguments. That means they fall back
to full ps(1) on the host and then filter based on the pid in the
output. This is kinda ugly and fails short because users can modify the
ps output and it may not even include the pid in the output which causes
an error.

So every solution has a different drawback, but what if we can combine
them somehow?! This commit tries exactly that.

We use ps(1) from the host and execute that in the container's pid
namespace.
There are some security concerns that must be addressed:
- mount the executable paths for ps and podman itself readonly to
  prevent the container from overwriting it via /proc/self/exe.
- set NO_NEW_PRIVS, SET_DUMPABLE and PDEATHSIG
- close all non std fds to prevent leaking files in that the caller had
  open
- unset all environment variables to not leak any into the contianer

Technically this could be a breaking change if somebody does not
have ps on the host and only in the container but I find that very
unlikely, we still have the exec in container fallback.

Because this can be insecure when the contianer has CAP_SYS_PTRACE we
still only use the podman exec version in that case.

This updates the docs accordingly, note that podman pod top never falls
back to executing ps in the container as this makes no sense with
multiple containers so I fixed the docs there as well.

Fixes #19001
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=2215572

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2023-07-10 13:32:55 +02:00
..
python chore(deps): update dependency setuptools to v68 2023-06-19 18:59:03 +00:00
00-TEMPLATE Tests for API v2 2020-01-17 09:59:22 -07:00
01-basic.at Bump Compat API maximum version to v1.41 2022-05-23 11:31:44 -04:00
10-images.at compat API create/pull: fix error handling 2023-06-21 16:37:27 +02:00
12-imagesMore.at compat API push: fix error handling 2023-06-21 16:35:55 +02:00
15-manifest.at Add support for podman-remote manifest annotate 2022-11-24 14:11:08 +09:00
19-stats.at Fix: display online_cpus in compat REST API 2023-05-31 07:41:30 +03:00
20-containers.at top: do not depend on ps(1) in container 2023-07-10 13:32:55 +02:00
22-stop.at Add podman rm --depend 2022-01-11 14:33:54 -05:00
23-containersArchive.at APIv2 test cleanup, part 2 of 2 2022-08-25 11:07:11 -06:00
25-containersMore.at export: use io.Writer instead of file 2022-12-20 14:38:41 +01:00
26-containersWait.at remote wait: fix "removed" condition 2023-06-16 11:55:53 +02:00
27-containersEvents.at Events for containers in pods now include the pod's ID 2022-09-22 14:18:56 -04:00
30-volumes.at Add until filter to volume ls filters list 2021-07-22 00:01:07 +02:00
35-networks.at compat API: network create return 409 for duplicate 2023-02-21 16:55:27 +01:00
40-pods.at APIv2 test cleanup, part 2 of 2 2022-08-25 11:07:11 -06:00
44-mounts.at System test cleanup 2021-03-15 15:27:06 -06:00
45-system.at Vendor c/image after https://github.com/containers/image/pull/1816 2023-02-08 22:37:38 +01:00
50-secrets.at Add support for secret exists 2023-04-03 15:33:50 +03:00
60-auth.at api: auth: fix nil deref 2023-04-12 11:27:35 +02:00
70-short-names.at compat API push: fix error handling 2023-06-21 16:35:55 +02:00
80-kube.at test/apiv2/80-kube.at 2023-04-04 16:07:02 +02:00
README.md APIv2 test cleanup, part 2 of 2 2022-08-25 11:07:11 -06:00
containers.conf compat API: allow enforcing short-names resolution to Docker Hub 2021-11-30 14:22:52 +01:00
containers.host-netns.conf [docker compat] Don't overwrite the NetworkMode if containers.conf overrides netns. 2023-01-11 17:44:09 +00:00
containers.no_hosts.conf API: use no_hosts from containers.conf 2022-04-11 18:41:19 +02:00
test-apiv2 compat: accept tag in /images/create?fromSrc 2023-05-17 16:12:19 +02:00

README.md

API v2 tests

This directory contains tests for the podman version 2 API (HTTP).

Tests themselves are in files of the form 'NN-NAME.at' where NN is a two-digit number, NAME is a descriptive name, and '.at' is just an extension I picked.

Running Tests

The main test runner is test-apiv2. Usage is:

$ sudo ./test-apiv2 [NAME [...]]

...where NAME is one or more optional test names, e.g. 'image' or 'pod' or both. By default, test-apiv2 will invoke all *.at tests.

test-apiv2 connects to localhost only and via TCP. There is no support here for remote hosts or for UNIX sockets. This is a framework for testing the API, not all possible protocols.

test-apiv2 will start the service if it isn't already running.

Writing Tests

The main test function is t. It runs curl against the server, with POST parameters if present, and compares return status and (optionally) string results from the server:

t GET /_ping 200 OK
  ^^^ ^^^^^^ ^^^ ^^
  |   |      |   +--- expected string result
  |   |      +------- expected return code
  |   +-------------- endpoint to access
  +------------------ method (GET, POST, DELETE, HEAD)


t POST libpod/volumes/create name=foo 201 .ID~[0-9a-f]\\{12\\}
       ^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^^ ^^^ ^^^^^^^^^^^^^^^^^^^^
       |                     |        |   JSON '.ID': expect 12-char hex
       |                     |        +-- expected code
       |                     +----------- POST params
       +--------------------------------- note the missing slash

Never, ever, ever, seriously EVER exit from a test. Just don't. That skips cleanup, and leaves the system in a broken state.

Notes:

  • If the endpoint has a leading slash (/_ping), t leaves it unchanged. If there's no leading slash, t prepends /v1.40. This is a simple convenience for simplicity of writing tests.

  • When method is POST, the argument(s) after the endpoint may be a series of POST parameters in the form 'key=value', separated by spaces: t POST myentrypoint 200 ! no params t POST myentrypoint id=$id 200 ! just one t POST myentrypoint id=$id filter='{"foo":"bar"}' 200 ! two, with json t POST myentrypoint name=$name badparam='["foo","bar"]' 500 ! etc... t will convert the param list to JSON form for passing to the server. A numeric status code terminates processing of POST parameters. ** As a special case, when one POST argument is a string ending in .tar, .yaml, or .json, t will invoke curl with --data-binary @PATH and set Content-type as appropriate. This is useful for build endpoints. (To override Content-type, simply pass along an extra string argument matching application/*): t POST myentrypoint /mytmpdir/myfile.tar application/foo 400 ** Like above, when using PUT, t does --upload-time instead of --data-binary

  • The final arguments are one or more expected string results. If an argument starts with a dot, t will invoke jq on the output to fetch that field, and will compare it to the right-hand side of the argument. If the separator is = (equals), t will require an exact match; if ~ (tilde), t will use expr to compare.

  • If your test expects curl to time out: APIV2_TEST_EXPECT_TIMEOUT=5 t POST /foo 999