Skip to content

Commit d2b2c70

Browse files
Shubhranshu153Shubhranshu153
committed
feat: add userns
1 parent 0e29586 commit d2b2c70

13 files changed

+1218
-142
lines changed

‎cmd/nerdctl/container/container_create.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ func CreateCommand() *cobra.Command {
5555
return cmd
5656
}
5757

58+
//nolint:function-length
5859
func createOptions(cmd *cobra.Command) (types.ContainerCreateOptions, error) {
5960
var err error
6061
opt := types.ContainerCreateOptions{

‎cmd/nerdctl/container/container_create_linux_test.go

Lines changed: 21 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -337,26 +337,24 @@ func TestUsernsMappingCreateCmd(t *testing.T) {
337337
testCase := &test.Case{
338338
Require: require.All(
339339
nerdtest.AllowModifyUserns,
340-
require.Not(nerdtest.ContainerdV1),
341340
require.Not(nerdtest.Docker)),
342341
SubTests: []*test.Case{
343342
{
344343
Description: "Test container start with valid Userns",
345344
NoParallel: true, // Changes system config so running in non parallel mode
346345
Setup: func(data test.Data, helpers test.Helpers) {
347-
data.Set("validUserns", "nerdctltestuser")
348-
data.Set("expectedHostUID", "123456789")
349-
// need to be compiled with containerd version >2.0.2 to support multi uidmap and gidmap.
350-
if err := appendUsernsConfig(data.Get("validUserns"), data.Get("expectedHostUID")); err != nil {
346+
data.Labels().Set("validUserns", "nerdctltestuser")
347+
data.Labels().Set("expectedHostUID", "123456789")
348+
if err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID")); err != nil {
351349
t.Fatalf("Failed to append Userns config: %v", err)
352350
}
353351
},
354352
Cleanup: func(data test.Data, helpers test.Helpers) {
355-
removeUsernsConfig(t, data.Get("validUserns"), data.Get("expectedHostUID"))
353+
removeUsernsConfig(t, data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"))
356354
helpers.Anyhow("rm", "-f", data.Identifier())
357355
},
358356
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
359-
helpers.Ensure("create", "--tty", "--userns", data.Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
357+
helpers.Ensure("create", "--tty", "--userns", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
360358
return helpers.Command("start", data.Identifier())
361359
},
362360
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
@@ -367,7 +365,7 @@ func TestUsernsMappingCreateCmd(t *testing.T) {
367365
if err != nil {
368366
t.Fatalf("Failed to get container host UID: %v", err)
369367
}
370-
assert.Assert(t, actualHostUID == data.Get("expectedHostUID"), info)
368+
assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
371369
},
372370
}
373371
},
@@ -376,13 +374,13 @@ func TestUsernsMappingCreateCmd(t *testing.T) {
376374
Description: "Test container start with invalid Userns",
377375
NoParallel: true, // Changes system config so running in non parallel mode
378376
Setup: func(data test.Data, helpers test.Helpers) {
379-
data.Set("invalidUserns", "invaliduser")
377+
data.Labels().Set("invalidUserns", "invaliduser")
380378
},
381379
Cleanup: func(data test.Data, helpers test.Helpers) {
382380
helpers.Anyhow("rm", "-f", data.Identifier())
383381
},
384382
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
385-
return helpers.Command("create", "--tty", "--userns", data.Get("invalidUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
383+
return helpers.Command("create", "--tty", "--userns", data.Labels().Get("invalidUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
386384
},
387385
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
388386
return &test.Expected{
@@ -395,15 +393,15 @@ func TestUsernsMappingCreateCmd(t *testing.T) {
395393
testCase.Run(t)
396394
}
397395

398-
func runUsernsContainer(t *testing.T, name, Userns, image, cmd string) *icmd.Result {
396+
func runUsernsContainer(t *testing.T, name, userns, image, cmd string) *icmd.Result {
399397
base := testutil.NewBase(t)
400398
removeContainerArgs := []string{
401399
"rm", "-f", name,
402400
}
403401
base.Cmd(removeContainerArgs...).Run()
404402

405403
args := []string{
406-
"run", "-d", "--userns", Userns, "--name", name, image, "sh", "-c", cmd,
404+
"run", "-d", "--userns", userns, "--name", name, image, "sh", "-c", cmd,
407405
}
408406
return base.Cmd(args...).Run()
409407
}
@@ -425,12 +423,12 @@ func getContainerHostUID(helpers test.Helpers, containerName string) (string, er
425423
return strconv.Itoa(uid), nil
426424
}
427425

428-
func appendUsernsConfig(Userns string, hostUid string) error {
429-
if err := addUser(Userns, hostUid); err != nil {
430-
return fmt.Errorf("failed to add user %s: %w", Userns, err)
426+
func appendUsernsConfig(userns string, hostUid string) error {
427+
if err := addUser(userns, hostUid); err != nil {
428+
return fmt.Errorf("failed to add user %s: %w", userns, err)
431429
}
432430

433-
entry := fmt.Sprintf("%s:%s:65536\n", Userns, hostUid)
431+
entry := fmt.Sprintf("%s:%s:65536\n", userns, hostUid)
434432

435433
tempDir := os.TempDir()
436434

@@ -482,14 +480,13 @@ func addUser(username string, hostId string) error {
482480
return nil
483481
}
484482

485-
func removeUsernsConfig(t *testing.T, Userns string, hostUid string) {
486-
487-
if err := delUser(Userns); err != nil {
488-
t.Logf("failed to del user %s, Error: %s", Userns, err)
483+
func removeUsernsConfig(t *testing.T, userns string, hostUid string) {
484+
if err := delUser(userns); err != nil {
485+
t.Logf("failed to del user %s, Error: %s", userns, err)
489486
}
490487

491-
if err := delGroup(Userns); err != nil {
492-
t.Logf("failed to del group %s, Error: %s", Userns, err)
488+
if err := delGroup(userns); err != nil {
489+
t.Logf("failed to del group %s, Error: %s", userns, err)
493490
}
494491

495492
tempDir := os.TempDir()
@@ -521,7 +518,7 @@ func removeUsernsConfig(t *testing.T, Userns string, hostUid string) {
521518
}
522519

523520
func delUser(username string) error {
524-
cmd := exec.Command("sudo", "userdel", username)
521+
cmd := exec.Command("userdel", username)
525522
output, err := cmd.CombinedOutput()
526523
if err != nil {
527524
return fmt.Errorf("userdel failed: %s, %w", string(output), err)
@@ -530,7 +527,7 @@ func delUser(username string) error {
530527
}
531528

532529
func delGroup(groupname string) error {
533-
cmd := exec.Command("sudo", "groupdel", groupname)
530+
cmd := exec.Command("groupdel", groupname)
534531
output, err := cmd.CombinedOutput()
535532
if err != nil {
536533
return fmt.Errorf("groupdel failed: %s, %w", string(output), err)

‎cmd/nerdctl/container/container_run_user_linux_test.go

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,11 +20,12 @@ import (
2020
"fmt"
2121
"testing"
2222

23+
"gotest.tools/v3/assert"
24+
2325
"github.com/containerd/nerdctl/mod/tigron/require"
2426
"github.com/containerd/nerdctl/mod/tigron/test"
2527
"github.com/containerd/nerdctl/v2/pkg/testutil"
2628
"github.com/containerd/nerdctl/v2/pkg/testutil/nerdtest"
27-
"gotest.tools/v3/assert"
2829
)
2930

3031
func TestRunUserGID(t *testing.T) {
@@ -192,25 +193,24 @@ func TestUsernsMappingRunCmd(t *testing.T) {
192193
testCase := &test.Case{
193194
Require: require.All(
194195
nerdtest.AllowModifyUserns,
195-
require.Not(nerdtest.ContainerdV1),
196196
require.Not(nerdtest.Docker)),
197197
SubTests: []*test.Case{
198198
{
199199
Description: "Test container start with valid Userns",
200200
NoParallel: true, // Changes system config so running in non parallel mode
201201
Setup: func(data test.Data, helpers test.Helpers) {
202-
data.Set("validUserns", "nerdctltestuser")
203-
data.Set("expectedHostUID", "123456789")
204-
if err := appendUsernsConfig(data.Get("validUserns"), data.Get("expectedHostUID")); err != nil {
202+
data.Labels().Set("validUserns", "nerdctltestuser")
203+
data.Labels().Set("expectedHostUID", "123456789")
204+
if err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID")); err != nil {
205205
t.Fatalf("Failed to append Userns config: %v", err)
206206
}
207207
},
208208
Cleanup: func(data test.Data, helpers test.Helpers) {
209209
helpers.Anyhow("rm", "-f", data.Identifier())
210-
removeUsernsConfig(t, data.Get("validUserns"), data.Get("expectedHostUID"))
210+
removeUsernsConfig(t, data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"))
211211
},
212212
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
213-
return helpers.Command("run", "--tty", "-d", "--userns", data.Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
213+
return helpers.Command("run", "--tty", "-d", "--userns", data.Labels().Get("validUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
214214
},
215215
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
216216
return &test.Expected{
@@ -220,7 +220,7 @@ func TestUsernsMappingRunCmd(t *testing.T) {
220220
if err != nil {
221221
t.Fatalf("Failed to get container host UID: %v", err)
222222
}
223-
assert.Assert(t, actualHostUID == data.Get("expectedHostUID"), info)
223+
assert.Assert(t, actualHostUID == data.Labels().Get("expectedHostUID"), info)
224224
},
225225
}
226226
},
@@ -229,22 +229,22 @@ func TestUsernsMappingRunCmd(t *testing.T) {
229229
Description: "Test container network share with valid Userns",
230230
NoParallel: true, // Changes system config so running in non parallel mode
231231
Setup: func(data test.Data, helpers test.Helpers) {
232-
data.Set("validUserns", "nerdctltestuser")
233-
data.Set("expectedHostUID", "123456789")
234-
data.Set("net-container", "net-container")
235-
if err := appendUsernsConfig(data.Get("validUserns"), data.Get("expectedHostUID")); err != nil {
232+
data.Labels().Set("validUserns", "nerdctltestuser")
233+
data.Labels().Set("expectedHostUID", "123456789")
234+
data.Labels().Set("net-container", "net-container")
235+
if err := appendUsernsConfig(data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID")); err != nil {
236236
t.Fatalf("Failed to append Userns config: %v", err)
237237
}
238238

239-
helpers.Ensure("run", "--tty", "-d", "--userns", data.Get("validUserns"), "--name", data.Get("net-container"), testutil.NginxAlpineImage)
239+
helpers.Ensure("run", "--tty", "-d", "--userns", data.Labels().Get("validUserns"), "--name", data.Labels().Get("net-container"), testutil.NginxAlpineImage)
240240
},
241241
Cleanup: func(data test.Data, helpers test.Helpers) {
242242
helpers.Anyhow("rm", "-f", data.Identifier())
243-
helpers.Anyhow("rm", "-f", data.Get("net-container"))
244-
removeUsernsConfig(t, data.Get("validUserns"), data.Get("expectedHostUID"))
243+
helpers.Anyhow("rm", "-f", data.Labels().Get("net-container"))
244+
removeUsernsConfig(t, data.Labels().Get("validUserns"), data.Labels().Get("expectedHostUID"))
245245
},
246246
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
247-
return helpers.Command("run", "--tty", "-d", "--userns", data.Get("validUserns"), "--net", fmt.Sprintf("container:%s", data.Get("net-container")), "--name", data.Identifier(), testutil.NginxAlpineImage)
247+
return helpers.Command("run", "--tty", "-d", "--userns", data.Labels().Get("validUserns"), "--net", fmt.Sprintf("container:%s", data.Labels().Get("net-container")), "--name", data.Identifier(), testutil.NginxAlpineImage)
248248
},
249249
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
250250
return &test.Expected{
@@ -255,13 +255,13 @@ func TestUsernsMappingRunCmd(t *testing.T) {
255255
{
256256
Description: "Test container start with invalid Userns",
257257
Setup: func(data test.Data, helpers test.Helpers) {
258-
data.Set("invalidUserns", "invaliduser")
258+
data.Labels().Set("invalidUserns", "invaliduser")
259259
},
260260
Cleanup: func(data test.Data, helpers test.Helpers) {
261261
helpers.Anyhow("rm", "-f", data.Identifier())
262262
},
263263
Command: func(data test.Data, helpers test.Helpers) test.TestableCommand {
264-
return helpers.Command("run", "--tty", "-d", "--userns", data.Get("invalidUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
264+
return helpers.Command("run", "--tty", "-d", "--userns", data.Labels().Get("invalidUserns"), "--name", data.Identifier(), testutil.NginxAlpineImage)
265265
},
266266
Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
267267
return &test.Expected{

0 commit comments

Comments
 (0)