From b7d779bc5e798f9506177679767738e9c0943749 Mon Sep 17 00:00:00 2001 From: Arash Deshmeh Date: Fri, 6 Apr 2018 06:06:02 -0400 Subject: [PATCH 1/2] integration tests under integration/config use unique names when creating resources Signed-off-by: Arash Deshmeh Upstream-commit: 69481edc0770208f7af96c0eb48c0ab90e4889fb Component: engine --- .../engine/integration/config/config_test.go | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-) diff --git a/components/engine/integration/config/config_test.go b/components/engine/integration/config/config_test.go index 65323e2e59..6c72f2f8f9 100644 --- a/components/engine/integration/config/config_test.go +++ b/components/engine/integration/config/config_test.go @@ -36,8 +36,8 @@ func TestConfigList(t *testing.T) { assert.NilError(t, err) assert.Check(t, is.Equal(len(configs), 0)) - testName0 := "test0" - testName1 := "test1" + testName0 := "test0-" + t.Name() + testName1 := "test1-" + t.Name() testNames := []string{testName0, testName1} sort.Strings(testNames) @@ -122,7 +122,7 @@ func TestConfigsCreateAndDelete(t *testing.T) { ctx := context.Background() - testName := "test_config" + testName := "test_config-" + t.Name() // This test case is ported from the original TestConfigsCreate configID := createConfig(ctx, t, client, testName, []byte("TESTINGDATA"), nil) @@ -150,7 +150,7 @@ func TestConfigsUpdate(t *testing.T) { ctx := context.Background() - testName := "test_config" + testName := "test_config-" + t.Name() // This test case is ported from the original TestConfigsCreate configID := createConfig(ctx, t, client, testName, []byte("TESTINGDATA"), nil) @@ -200,27 +200,30 @@ func TestTemplatedConfig(t *testing.T) { ctx := context.Background() client := swarm.GetClient(t, d) + referencedSecretName := "referencedsecret-" + t.Name() referencedSecretSpec := swarmtypes.SecretSpec{ Annotations: swarmtypes.Annotations{ - Name: "referencedsecret", + Name: referencedSecretName, }, Data: []byte("this is a secret"), } referencedSecret, err := client.SecretCreate(ctx, referencedSecretSpec) assert.Check(t, err) + referencedConfigName := "referencedconfig-" + t.Name() referencedConfigSpec := swarmtypes.ConfigSpec{ Annotations: swarmtypes.Annotations{ - Name: "referencedconfig", + Name: referencedConfigName, }, Data: []byte("this is a config"), } referencedConfig, err := client.ConfigCreate(ctx, referencedConfigSpec) assert.Check(t, err) + templatedConfigName := "templated_config-" + t.Name() configSpec := swarmtypes.ConfigSpec{ Annotations: swarmtypes.Annotations{ - Name: "templated_config", + Name: templatedConfigName, }, Templating: &swarmtypes.Driver{ Name: "golang", @@ -237,13 +240,13 @@ func TestTemplatedConfig(t *testing.T) { swarm.ServiceWithConfig( &swarmtypes.ConfigReference{ File: &swarmtypes.ConfigReferenceFileTarget{ - Name: "/templated_config", + Name: "/" + templatedConfigName, UID: "0", GID: "0", Mode: 0600, }, ConfigID: templatedConfig.ID, - ConfigName: "templated_config", + ConfigName: templatedConfigName, }, ), swarm.ServiceWithConfig( @@ -255,7 +258,7 @@ func TestTemplatedConfig(t *testing.T) { Mode: 0600, }, ConfigID: referencedConfig.ID, - ConfigName: "referencedconfig", + ConfigName: referencedConfigName, }, ), swarm.ServiceWithSecret( @@ -267,7 +270,7 @@ func TestTemplatedConfig(t *testing.T) { Mode: 0600, }, SecretID: referencedSecret.ID, - SecretName: "referencedsecret", + SecretName: referencedSecretName, }, ), swarm.ServiceWithName("svc"), @@ -288,7 +291,7 @@ func TestTemplatedConfig(t *testing.T) { }) attach := swarm.ExecTask(t, d, task, types.ExecConfig{ - Cmd: []string{"/bin/cat", "/templated_config"}, + Cmd: []string{"/bin/cat", "/" + templatedConfigName}, AttachStdout: true, AttachStderr: true, }) @@ -303,7 +306,7 @@ func TestTemplatedConfig(t *testing.T) { AttachStdout: true, AttachStderr: true, }) - assertAttachedStream(t, attach, "tmpfs on /templated_config type tmpfs") + assertAttachedStream(t, attach, "tmpfs on /"+templatedConfigName+" type tmpfs") } func assertAttachedStream(t *testing.T, attach types.HijackedResponse, expect string) { From 2cf9f7eb8890691266868beb3c6a98e0ee572a44 Mon Sep 17 00:00:00 2001 From: Justin Cormack Date: Fri, 6 Apr 2018 14:01:38 +0100 Subject: [PATCH 2/2] Always make sysfs read-write with privileged It does not make any sense to vary this based on whether the rootfs is read only. We removed all the other mount dependencies on read-only eg see #35344. Signed-off-by: Justin Cormack Upstream-commit: a729853bc712910574a7417f67764ec8c523928b Component: engine --- components/engine/daemon/oci_linux.go | 10 ++++------ .../engine/integration-cli/docker_cli_run_test.go | 2 +- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/components/engine/daemon/oci_linux.go b/components/engine/daemon/oci_linux.go index a83f155fda..a3638ace21 100644 --- a/components/engine/daemon/oci_linux.go +++ b/components/engine/daemon/oci_linux.go @@ -685,12 +685,10 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c } if c.HostConfig.Privileged { - if !s.Root.Readonly { - // clear readonly for /sys - for i := range s.Mounts { - if s.Mounts[i].Destination == "/sys" { - clearReadOnly(&s.Mounts[i]) - } + // clear readonly for /sys + for i := range s.Mounts { + if s.Mounts[i].Destination == "/sys" { + clearReadOnly(&s.Mounts[i]) } } s.Linux.ReadonlyPaths = nil diff --git a/components/engine/integration-cli/docker_cli_run_test.go b/components/engine/integration-cli/docker_cli_run_test.go index a4984862ee..3b6e3cbbdf 100644 --- a/components/engine/integration-cli/docker_cli_run_test.go +++ b/components/engine/integration-cli/docker_cli_run_test.go @@ -2688,7 +2688,7 @@ func (s *DockerSuite) TestRunContainerWithReadonlyRootfs(c *check.C) { if root := os.Getenv("DOCKER_REMAP_ROOT"); root != "" { testPriv = false } - testReadOnlyFile(c, testPriv, "/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname", "/sys/kernel") + testReadOnlyFile(c, testPriv, "/file", "/etc/hosts", "/etc/resolv.conf", "/etc/hostname") } func (s *DockerSuite) TestPermissionsPtsReadonlyRootfs(c *check.C) {