Denozordec
57b7652d4d
quality / changes (push) Successful in 6s
quality / commitlint (push) Skipped
quality / openapi (push) Successful in 28s
quality / web (push) Successful in 57s
quality / api (push) Successful in 1m35s
quality / linux-agent-smoke (push) Successful in 24s
quality / docker-check (push) Failing after 3m20s
CD / quality (push) Failing after 6m56s
CD / publish (push) Skipped
40 lines
1.7 KiB
Bash
40 lines
1.7 KiB
Bash
#!/usr/bin/env sh
|
|
# Run from the checkout root. Build context is sent to Docker, never bind-mounted.
|
|
set -eu
|
|
command -v docker >/dev/null
|
|
[ "$(docker info --format '{{.OSType}}')" = linux ] || { echo 'A Linux Docker daemon is required for the agent namespace smoke' >&2; exit 1; }
|
|
tmp="$(mktemp -d)"
|
|
name="evofw-linux-smoke-${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}-$$"
|
|
image=''
|
|
cleanup() {
|
|
result=$?
|
|
trap - EXIT HUP INT TERM
|
|
docker rm -f "$name" >/dev/null 2>&1 || true
|
|
if [ -n "$image" ]; then docker image rm "$image" >/dev/null 2>&1 || true; fi
|
|
rm -rf "$tmp"
|
|
exit "$result"
|
|
}
|
|
trap cleanup EXIT
|
|
trap 'exit 129' HUP
|
|
trap 'exit 130' INT
|
|
trap 'exit 143' TERM
|
|
docker build --file scripts/ci/linux-agent-smoke.Dockerfile --iidfile "$tmp/image-id" .
|
|
image="$(cat "$tmp/image-id")"
|
|
printf '%s\n' "$image" | grep -Eq '^sha256:[0-9a-f]{64}$' || { echo 'Missing immutable helper image ID' >&2; exit 1; }
|
|
set -- docker run --rm --name "$name" --network none \
|
|
--cap-drop ALL --cap-add SYS_ADMIN --cap-add NET_ADMIN --cap-add NET_RAW \
|
|
--security-opt no-new-privileges:true \
|
|
--read-only --tmpfs /tmp:rw,nosuid,nodev,noexec,size=64m \
|
|
--pids-limit 256 --cpus 2 --memory 512m
|
|
# docker-default AppArmor denies the mount operations used by unshare/ip-netns.
|
|
# Only this disposable, networkless helper gets the mount-capable exception.
|
|
# libxt_set opens an AF_INET/SOCK_RAW/IPPROTO_RAW socket to query ipset;
|
|
# NET_RAW permits that query inside the isolated helper network namespace.
|
|
# Default seccomp remains enabled and adapts to the granted capabilities.
|
|
security="$(docker info --format '{{json .SecurityOptions}}')"
|
|
if printf '%s' "$security" | grep -q apparmor; then
|
|
set -- "$@" --security-opt apparmor=unconfined
|
|
fi
|
|
set -- "$@" "$image"
|
|
"$@"
|