tests/containers.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2015 David Thompson <davet@gnu.org>
   3 ;;;
   4 ;;; This file is part of GNU Guix.
   5 ;;;
   6 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   7 ;;; under the terms of the GNU General Public License as published by
   8 ;;; the Free Software Foundation; either version 3 of the License, or (at
   9 ;;; your option) any later version.
  10 ;;;
  11 ;;; GNU Guix is distributed in the hope that it will be useful, but
  12 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  13 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14 ;;; GNU General Public License for more details.
  15 ;;;
  16 ;;; You should have received a copy of the GNU General Public License
  17 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  18
  19 (define-module (test-containers)
  20   #:use-module (guix utils)
  21   #:use-module (guix build syscalls)
  22   #:use-module (gnu build linux-container)
  23   #:use-module (srfi srfi-64)
  24   #:use-module (ice-9 match))
  25
  26 (define (assert-exit x)
  27   (primitive-exit (if x 0 1)))
  28
  29 (test-begin "containers")
  30
  31 (test-assert "call-with-container, user namespace"
  32   (zero?
  33    (call-with-container '()
  34      (lambda ()
  35        ;; The user is root within the new user namespace.
  36        (assert-exit (and (zero? (getuid)) (zero? (getgid)))))
  37      #:namespaces '(user))))
  38
  39 (test-assert "call-with-container, uts namespace"
  40   (zero?
  41    (call-with-container '()
  42      (lambda ()
  43        ;; The user is root within the container and should be able to change
  44        ;; the hostname of that container.
  45        (sethostname "test-container")
  46        (primitive-exit 0))
  47      #:namespaces '(user uts))))
  48
  49 (test-assert "call-with-container, pid namespace"
  50   (zero?
  51    (call-with-container '()
  52      (lambda ()
  53        (match (primitive-fork)
  54          (0
  55           ;; The first forked process in the new pid namespace is pid 2.
  56           (assert-exit (= 2 (getpid))))
  57          (pid
  58           (primitive-exit
  59            (match (waitpid pid)
  60              ((_ . status)
  61               (status:exit-val status)))))))
  62      #:namespaces '(user pid))))
  63
  64 (test-assert "call-with-container, mnt namespace"
  65   (zero?
  66    (call-with-container '(("none" device "/testing" "tmpfs" () #f #f))
  67      (lambda ()
  68        (assert-exit (file-exists? "/testing")))
  69      #:namespaces '(user mnt))))
  70
  71 (test-assert "call-with-container, all namespaces"
  72   (zero?
  73    (call-with-container '()
  74      (lambda ()
  75        (primitive-exit 0)))))
  76
  77 (test-assert "container-excursion"
  78   (call-with-temporary-directory
  79    (lambda (root)
  80      ;; Two pipes: One for the container to signal that the test can begin,
  81      ;; and one for the parent to signal to the container that the test is
  82      ;; over.
  83      (match (list (pipe) (pipe))
  84        (((start-in . start-out) (end-in . end-out))
  85         (define (container)
  86           (close end-out)
  87           (close start-in)
  88           ;; Signal for the test to start.
  89           (write 'ready start-out)
  90           (close start-out)
  91           ;; Wait for test completion.
  92           (read end-in)
  93           (close end-in))
  94
  95         (define (namespaces pid)
  96           (let ((pid (number->string pid)))
  97             (map (lambda (ns)
  98                    (readlink (string-append "/proc/" pid "/ns/" ns)))
  99                  '("user" "ipc" "uts" "net" "pid" "mnt"))))
 100
 101         (let* ((pid (run-container root '() %namespaces container))
 102                (container-namespaces (namespaces pid))
 103                (result
 104                 (begin
 105                   (close start-out)
 106                   ;; Wait for container to be ready.
 107                   (read start-in)
 108                   (close start-in)
 109                   (container-excursion pid
 110                     (lambda ()
 111                       ;; Fork again so that the pid is within the context of
 112                       ;; the joined pid namespace instead of the original pid
 113                       ;; namespace.
 114                       (match (primitive-fork)
 115                         (0
 116                          ;; Check that all of the namespace identifiers are
 117                          ;; the same as the container process.
 118                          (assert-exit
 119                           (equal? container-namespaces
 120                                   (namespaces (getpid)))))
 121                         (fork-pid
 122                          (match (waitpid fork-pid)
 123                            ((_ . status)
 124                             (primitive-exit
 125                              (status:exit-val status)))))))))))
 126           (close end-in)
 127           ;; Stop the container.
 128           (write 'done end-out)
 129           (close end-out)
 130           (waitpid pid)
 131           (zero? result)))))))
 132
 133 (test-end)
 134
 135 \f
 136 (exit (= (test-runner-fail-count (test-runner-current)) 0))