96 lines
3.2 KiB
Shell
Executable file
96 lines
3.2 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
source_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
adapter="${source_root}/scripts/linux-subcontrol-docker-backend.sh"
|
|
fixture=$(mktemp -d)
|
|
trap 'rm -rf "${fixture}"' EXIT
|
|
|
|
mkdir -p "${fixture}/bin" "${fixture}/state" "${fixture}/receipts"
|
|
printf '%s\n' 'f3d4b730-7f02-452f-975b-7091a4800431' >"${fixture}/dmi"
|
|
printf '%s\n' "menuentry 'Ubuntu' --id 'gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6' {" >"${fixture}/grub.cfg"
|
|
cat >"${fixture}/backend.conf" <<'EOF'
|
|
schema=guanghu.linux-subcontrol-docker-backend/v1
|
|
node_id=JD-FD-PRIMARY
|
|
instance_id=f3d4b730-7f02-452f-975b-7091a4800431
|
|
backend_id=jd-linux-on-demand
|
|
container_name=guanghu-linux-subcontrol-jd
|
|
image=ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
|
|
rescue_slot_id=gnulinux-simple-9e4550a0-452b-4f28-b5a5-d5364aa450f6
|
|
EOF
|
|
|
|
cat >"${fixture}/bin/docker" <<'EOF'
|
|
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
printf '%s\n' "$*" >>"${FAKE_DOCKER_LOG}"
|
|
case "${1:-}" in
|
|
image)
|
|
[[ "${2:-}" == inspect ]]
|
|
;;
|
|
inspect)
|
|
[[ -f "${FAKE_DOCKER_STATE}" ]] || exit 1
|
|
printf '%s\n' true
|
|
;;
|
|
run)
|
|
touch "${FAKE_DOCKER_STATE}"
|
|
printf '%s\n' fixture-container-id
|
|
;;
|
|
exec)
|
|
[[ -f "${FAKE_DOCKER_STATE}" ]]
|
|
printf '%s\n' 'ID=ubuntu' 'VERSION_ID=22.04'
|
|
;;
|
|
rm)
|
|
rm -f "${FAKE_DOCKER_STATE}"
|
|
;;
|
|
*)
|
|
exit 64
|
|
;;
|
|
esac
|
|
EOF
|
|
chmod +x "${fixture}/bin/docker"
|
|
|
|
export GH_SUBCONTROL_TEST_MODE=1
|
|
export GH_SUBCONTROL_CONFIG="${fixture}/backend.conf"
|
|
export GH_SUBCONTROL_DOCKER="${fixture}/bin/docker"
|
|
export GH_SUBCONTROL_DMI_PATH="${fixture}/dmi"
|
|
export GH_SUBCONTROL_GRUB_CFG="${fixture}/grub.cfg"
|
|
export GH_SUBCONTROL_STATE_ROOT="${fixture}/state"
|
|
export GH_SUBCONTROL_RECEIPT_ROOT="${fixture}/receipts"
|
|
export FAKE_DOCKER_LOG="${fixture}/docker.log"
|
|
export FAKE_DOCKER_STATE="${fixture}/container.running"
|
|
|
|
[[ "$("${adapter}" observe jd-linux-on-demand)" == dormant ]]
|
|
"${adapter}" preflight jd-linux-on-demand
|
|
"${adapter}" wake jd-linux-on-demand
|
|
[[ "$("${adapter}" observe jd-linux-on-demand)" == ready ]]
|
|
"${adapter}" execute jd-linux-on-demand runtime-identity-readback REQ-001
|
|
"${adapter}" verify jd-linux-on-demand runtime-identity-readback REQ-001
|
|
"${adapter}" reclaim jd-linux-on-demand
|
|
[[ "$("${adapter}" observe jd-linux-on-demand)" == dormant ]]
|
|
|
|
grep -Fq -- '--network none' "${fixture}/docker.log"
|
|
grep -Fq -- '--read-only' "${fixture}/docker.log"
|
|
grep -Fq -- '--cap-drop ALL' "${fixture}/docker.log"
|
|
grep -Fq -- '--security-opt no-new-privileges' "${fixture}/docker.log"
|
|
grep -Fq -- '--pids-limit 64' "${fixture}/docker.log"
|
|
grep -Fq -- 'ubuntu@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' "${fixture}/docker.log"
|
|
|
|
if "${adapter}" execute jd-linux-on-demand arbitrary-shell REQ-002; then
|
|
echo "unregistered capability was accepted" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s\n' 'wrong-instance' >"${fixture}/dmi"
|
|
if "${adapter}" wake jd-linux-on-demand; then
|
|
echo "wrong machine identity was accepted" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s\n' 'f3d4b730-7f02-452f-975b-7091a4800431' >"${fixture}/dmi"
|
|
: >"${fixture}/grub.cfg"
|
|
if "${adapter}" wake jd-linux-on-demand; then
|
|
echo "missing rescue slot was accepted" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "GUANGHU_LINUX_SUBCONTROL_DOCKER_BACKEND_OK"
|