Docker v26 compatibility & test fixes

Signed-off-by: apostasie <spam_blackhole@farcloser.world>

.github/workflows/test.yml

@@ -251,8 +251,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
           cache: true
           check-latest: true
-      # Docker >= v25 is still unsupported: https://github.com/containerd/nerdctl/issues/3088
-      - name: "Install Docker v24"
+      - name: "Install Docker v26"
         run: |
           set -eux -o pipefail
           # Uninstall the preinstalled Docker
@@ -264,8 +263,12 @@ jobs:
           cat /etc/docker/daemon.json
           # Download Docker packages
           curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/containerd.io_1.6.33-1_amd64.deb
-          curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce_24.0.9-1~ubuntu.22.04~jammy_amd64.deb
-          curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce-cli_24.0.9-1~ubuntu.22.04~jammy_amd64.deb
+          #curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce_24.0.9-1~ubuntu.22.04~jammy_amd64.deb
+          #curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce_25.0.5-1~ubuntu.22.04~jammy_amd64.deb
+          curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce_26.1.4-1~ubuntu.22.04~jammy_amd64.deb
+          #curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce-cli_24.0.9-1~ubuntu.22.04~jammy_amd64.deb
+          #curl -OSl https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce-cli_25.0.5-1~ubuntu.22.04~jammy_amd64.deb
+          curl -OSl https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-ce-cli_26.1.4-1~ubuntu.22.04~jammy_amd64.deb
           curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-buildx-plugin_0.13.1-1~ubuntu.22.04~jammy_amd64.deb
           curl -OSL https://download.docker.com/linux/ubuntu/dists/jammy/pool/stable/amd64/docker-compose-plugin_2.25.0-1~ubuntu.22.04~jammy_amd64.deb
           # Install Docker

cmd/nerdctl/container_create_linux_test.go

@@ -70,9 +70,9 @@ func TestCreateWithMACAddress(t *testing.T) {
 		WantErr bool
 		Expect  string
 	}{
-		{"host", true, "conflicting options"},
+		{"host", false, ""},
 		{"none", true, "can't open '/sys/class/net/eth0/address'"},
-		{"container:whatever" + tID, true, "conflicting options"},
+		{"container:whatever" + tID, true, "container"}, // "No such container" vs. "could not find container"
 		{"bridge", false, ""},
 		{networkBridge, false, ""},
 		{networkMACvlan, false, ""},
@@ -98,11 +98,16 @@ func TestCreateWithMACAddress(t *testing.T) {
 				base.Cmd("start", containerName).AssertOK()
 				cmd = base.Cmd("logs", containerName)
 				cmd.AssertOK()
-				cmd.AssertOutContains(test.Expect)
+				// Host or container networking allow passing mac-address, but it is a no-op
+				if test.Network != "host" {
+					cmd.AssertOutContains(test.Expect)
+				}
 			} else {
-				if (testutil.GetTarget() == testutil.Docker && test.Network == networkIPvlan) || test.Network == "none" {
+				if (testutil.GetTarget() == testutil.Docker &&
+					(test.Network == networkIPvlan || test.Network == "container:whatever"+tID)) ||
+					test.Network == "none" {
 					// 1. unlike nerdctl
-					// when using network ipvlan in Docker
+					// when using network ipvlan or container in Docker
 					// it delays fail on executing start command
 					// 2. start on network none will success in both
 					// nerdctl and Docker

cmd/nerdctl/container_run_network_linux_test.go

@@ -354,12 +354,17 @@ func TestRunContainerWithStaticIP(t *testing.T) {
 			useNetwork:        true,
 			checkTheIPAddress: false,
 		},
-		{
-			ip:                "10.4.0.2",
-			shouldSuccess:     true,
-			useNetwork:        false,
-			checkTheIPAddress: false,
-		},
+		// XXX see https://github.com/containerd/nerdctl/issues/3101
+		// docker 24 silently ignored the ip - now, docker 26 is erroring out - furthermore, this ip only makes sense
+		// in the context of nerdctl bridge network, so, this test needs rewritting either way
+		/*
+			{
+				ip:                "10.4.0.2",
+				shouldSuccess:     true,
+				useNetwork:        false,
+				checkTheIPAddress: false,
+			},
+		*/
 	}
 	tID := testutil.Identifier(t)
 	for i, tc := range testCases {
@@ -453,42 +458,62 @@ func TestRunContainerWithMACAddress(t *testing.T) {
 	networkBridge := "testNetworkBridge" + tID
 	networkMACvlan := "testNetworkMACvlan" + tID
 	networkIPvlan := "testNetworkIPvlan" + tID
-	base.Cmd("network", "create", networkBridge, "--driver", "bridge").AssertOK()
-	base.Cmd("network", "create", networkMACvlan, "--driver", "macvlan").AssertOK()
-	base.Cmd("network", "create", networkIPvlan, "--driver", "ipvlan").AssertOK()
-	t.Cleanup(func() {
+
+	tearDown := func() {
 		base.Cmd("network", "rm", networkBridge).Run()
 		base.Cmd("network", "rm", networkMACvlan).Run()
 		base.Cmd("network", "rm", networkIPvlan).Run()
-	})
+	}
+
+	tearDown()
+	t.Cleanup(tearDown)
+
+	base.Cmd("network", "create", networkBridge, "--driver", "bridge").AssertOK()
+	base.Cmd("network", "create", networkMACvlan, "--driver", "macvlan").AssertOK()
+	base.Cmd("network", "create", networkIPvlan, "--driver", "ipvlan").AssertOK()
+
+	cmd := base.Cmd("run", "--rm", "-i", "--network", "host", testutil.CommonImage).
+		CmdOption(testutil.WithStdin(strings.NewReader("ip addr show eth0 | grep ether | awk '{printf $2}'")))
+	defaultMac := cmd.Run().Stdout()
+
+	passedMac := "we expect the generated mac on the output"
 	tests := []struct {
 		Network string
 		WantErr bool
 		Expect  string
 	}{
-		{"host", true, "conflicting options"},
-		{"none", true, "can't open '/sys/class/net/eth0/address'"},
-		{"container:whatever" + tID, true, "conflicting options"},
-		{"bridge", false, ""},
-		{networkBridge, false, ""},
-		{networkMACvlan, false, ""},
+		{"host", false, defaultMac},                     // anything but the actual address being passed
+		{"none", false, ""},                             // nothing
+		{"container:whatever" + tID, true, "container"}, // "No such container" vs. "could not find container"
+		{"bridge", false, passedMac},
+		{networkBridge, false, passedMac},
+		{networkMACvlan, false, passedMac},
 		{networkIPvlan, true, "not support"},
 	}
 	for _, test := range tests {
 		macAddress, err := nettestutil.GenerateMACAddress()
 		if err != nil {
 			t.Errorf("failed to generate MAC address: %s", err)
 		}
-		if test.Expect == "" && !test.WantErr {
+		if test.Expect == passedMac {
 			test.Expect = macAddress
 		}
-		cmd := base.Cmd("run", "--rm", "--network", test.Network, "--mac-address", macAddress, testutil.CommonImage, "cat", "/sys/class/net/eth0/address")
+
+		cmd := base.Cmd("run", "--rm", "-i", "--network", test.Network, "--mac-address", macAddress, testutil.CommonImage).
+			CmdOption(testutil.WithStdin(strings.NewReader("ip addr show eth0 | grep ether | awk '{printf $2}'")))
+
 		if test.WantErr {
-			cmd.AssertFail()
-			cmd.AssertCombinedOutContains(test.Expect)
+			res := cmd.Run()
+			assert.Assert(t, res.ExitCode != 0, "Command should have failed", res.Combined())
+			assert.Assert(t, strings.Contains(res.Combined(), test.Expect), fmt.Sprintf("expected output to contain %q: %q", test.Expect, res.Combined()))
 		} else {
-			cmd.AssertOK()
-			cmd.AssertOutContains(test.Expect)
+			res := cmd.Run()
+			assert.Assert(t, res.ExitCode == 0, "Command should have succeeded", res.Combined())
+
+			// Host or container networking allow passing mac-address, but it is a no-op
+			if test.Network != "host" {
+				assert.Assert(t, strings.Contains(res.Stdout(), test.Expect), fmt.Sprintf("expected output to contain %q: %q", test.Expect, res.Stdout()))
+			}
 		}
 	}
 }

cmd/nerdctl/network_inspect_test.go

@@ -34,7 +34,7 @@ func TestNetworkInspect(t *testing.T) {
 	const (
 		testSubnet  = "10.24.24.0/24"
 		testGateway = "10.24.24.1"
-		testIPRange = "10.24.24.1/25"
+		testIPRange = "10.24.24.0/25"
 	)
 
 	base := testutil.NewBase(t)

pkg/containerutil/container_network_manager.go

@@ -200,9 +200,9 @@ func (m *containerNetworkManager) VerifyNetworkOptions(_ context.Context) error
 		return errors.New("conflicting options: only one network specification is allowed when using '--network=container:<container>'")
 	}
 
+	// Note that mac-address is accepter, though it is a no-op
 	nonZeroParams := nonZeroMapValues(map[string]interface{}{
-		"--hostname":    m.netOpts.Hostname,
-		"--mac-address": m.netOpts.MACAddress,
+		"--hostname": m.netOpts.Hostname,
 		// NOTE: an empty slice still counts as a non-zero value so we check its length:
 		"-p/--publish": len(m.netOpts.PortMappings) != 0,
 		"--dns":        len(m.netOpts.DNSServers) != 0,
@@ -286,6 +286,8 @@ func (m *containerNetworkManager) InternalNetworkingOptionLabels(ctx context.Con
 	if m.netOpts.NetworkSlice == nil || len(m.netOpts.NetworkSlice) != 1 {
 		return opts, fmt.Errorf("conflicting options: exactly one network specification is allowed when using '--network=container:<container>'")
 	}
+	// MacAddress is not allowed with container networking
+	opts.MACAddress = ""
 
 	container, err := m.getNetworkingContainerForArgument(ctx, m.netOpts.NetworkSlice[0], m.client)
 	if err != nil {
@@ -357,10 +359,6 @@ func (m *hostNetworkManager) VerifyNetworkOptions(_ context.Context) error {
 		return errors.New("cannot use host networking on Windows")
 	}
 
-	if m.netOpts.MACAddress != "" {
-		return errors.New("conflicting options: mac-address and the network mode")
-	}
-
 	return validateUtsSettings(m.netOpts)
 }