mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 06:03:57 +08:00
Kir Kolyshkin
3cdda464fa
The runtime-spec [1] currently says: > 6. Runtime's start command is invoked with the unique identifier of > the container. > 7. The startContainer hooks MUST be invoked by the runtime. If any > startContainer hook fails, the runtime MUST generate an error, stop > the container, and continue the lifecycle at step 12. > 8. The runtime MUST run the user-specified program, as specified by > process. > 9. The poststart hooks MUST be invoked by the runtime. If any > poststart hook fails, the runtime MUST generate an error, stop the > container, and continue the lifecycle at step 12. > ... > 11. Runtime's delete command is invoked with the unique identifier of > the container. > 12. The container MUST be destroyed by undoing the steps performed > during create phase (step 2). > 13. The poststop hooks MUST be invoked by the runtime. If any poststop > hook fails, the runtime MUST log a warning, but the remaining hooks > and lifecycle continue as if the hook had succeeded. Currently, we do 9 before 8 (heck, even before 6), which is clearly against the spec and results in issues like the one described in [2]. Let's move running poststart hook to after the user-specified process has started. NOTE this patch only fixes the order and does not implement removing the container when the poststart hook failed (as this part of the spec is controversial -- destroy et al and should probably be, and currently are, part of "runc delete"). [1]: https://github.com/opencontainers/runtime-spec/blob/main/runtime.md#lifecycle [2]: https://github.com/opencontainers/runc/issues/5182 Reported-by: ningmingxiao <ning.mingxiao@zte.com.cn> Reported-by: Erik Sjölund <erik.sjolund@gmail.com> Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
85 lines
2.7 KiB
Bash
85 lines
2.7 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load helpers
|
|
|
|
function setup() {
|
|
setup_busybox
|
|
}
|
|
|
|
function teardown() {
|
|
teardown_bundle
|
|
}
|
|
|
|
@test "runc create [second createRuntime hook fails]" {
|
|
update_config '.hooks |= {"createRuntime": [{"path": "/bin/true"}, {"path": "/bin/false"}]}'
|
|
|
|
runc create --console-socket "$CONSOLE_SOCKET" test_hooks
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"error running createRuntime hook #1:"* ]]
|
|
}
|
|
|
|
@test "runc create [hook fails]" {
|
|
for hook in prestart createRuntime createContainer; do
|
|
echo "testing hook $hook"
|
|
update_config '.hooks |= {"'$hook'": [{"path": "/bin/true"}, {"path": "/bin/false"}]}'
|
|
runc create --console-socket "$CONSOLE_SOCKET" test_hooks
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"error running $hook hook #1:"* ]]
|
|
done
|
|
}
|
|
|
|
@test "runc run [hook fails]" {
|
|
update_config '.process.args = ["/bin/echo", "Hello World"]'
|
|
# All hooks except Poststop.
|
|
for hook in prestart createRuntime createContainer startContainer poststart; do
|
|
echo "testing hook $hook"
|
|
update_config '.hooks |= {"'$hook'": [{"path": "/bin/true"}, {"path": "/bin/false"}]}'
|
|
runc run "test_hook-$hook"
|
|
# Failed poststart hooks results in container being killed,
|
|
# but only after it has started, so output may or may not appear.
|
|
if [ "$hook" != "poststart" ]; then
|
|
[[ "$output" != "Hello World" ]]
|
|
fi
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"error running $hook hook #1:"* ]]
|
|
done
|
|
}
|
|
|
|
# While runtime-spec does not say what environment variables hooks should have,
|
|
# if not explicitly specified, historically the StartContainer hook inherited
|
|
# the process environment specified for init.
|
|
#
|
|
# Check this behavior is preserved.
|
|
@test "runc run [startContainer hook should inherit process environment]" {
|
|
cat >"rootfs/check-env.sh" <<-'EOF'
|
|
#!/bin/sh -ue
|
|
test $ONE = two
|
|
test $FOO = bar
|
|
echo $HOME # Test HOME is set w/o checking the value.
|
|
EOF
|
|
chmod +x "rootfs/check-env.sh"
|
|
|
|
update_config ' .process.args = ["/bin/true"]
|
|
| .process.env = ["ONE=two", "FOO=bar"]
|
|
| .hooks |= {"startContainer": [{"path": "/check-env.sh"}]}'
|
|
runc run ct1
|
|
[ "$status" -eq 0 ]
|
|
}
|
|
|
|
# https://github.com/opencontainers/runc/issues/1663
|
|
@test "runc run [hook's argv is preserved]" {
|
|
# Check that argv[0] and argv[1] passed to the hook's binary
|
|
# exactly as set in config.json.
|
|
update_config '.hooks |= {"startContainer": [{"path": "/bin/busybox", "args": ["cat", "/nosuchfile"]}]}'
|
|
runc run ct1
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"cat: can't open"*"/nosuchfile"* ]]
|
|
|
|
# Busybox also accepts commands where argv[0] is "busybox",
|
|
# and argv[1] is applet name. Test this as well.
|
|
update_config '.hooks |= {"startContainer": [{"path": "/bin/busybox", "args": ["busybox", "cat", "/nosuchfile"]}]}'
|
|
runc run ct1
|
|
[ "$status" -ne 0 ]
|
|
[[ "$output" == *"cat: can't open"*"/nosuchfile"* ]]
|
|
}
|