Repository: containerd/containerd
File: integration/container_stats_test.go (Go)

Code before:

	// Windows does not collect inodes stats.
	if goruntime.GOOS != "windows" {
		require.NotEmpty(t, s.GetWritableLayer().GetInodesUsed().GetValue())
	}
}

func TestContainerSysfsStatsWithPrivilegedPod(t *testing.T) {
	if goruntime.GOOS == "windows" {
		t.Skip("Doesn't care about filesystem properties on windows")
	}
	sb, sbConfig := PodSandboxConfigWithCleanup(
		t,
		"sandbox",
		"sysfs-stats-with-privileged",
		WithPodSecurityContext(true),
	)

	var (
		testImage                 = images.Get(images.BusyBox)
		containerName             = "test-container"
		containerNameNoPrivileged = "test-container-no-privileged"
	)

	EnsureImageExists(t, testImage)
	//sandbox and container with WithSecurityContext=true, sysfs is "ro"
	cnConfig := ContainerConfig(
		containerName,
		testImage,
		WithCommand("sh", "-c", "top"),
		WithSecurityContext(true),
	)
	cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
	require.NoError(t, err)
	defer func() {
		assert.NoError(t, runtimeService.RemoveContainer(cn))
	}()

	t.Log("Start the container")
	require.NoError(t, runtimeService.StartContainer(cn))
	defer func() {
		assert.NoError(t, runtimeService.StopContainer(cn, 10))
	}()

	t.Logf("Execute cmd in container by sync")
	mountinfo, _, err := runtimeService.ExecSync(cn, []string{
		"sh",
		"-c",
		"mount |grep sysfs",
	}, 10)
	assert.NoError(t, err)

Review comment (bug):
> WithSecurityContext=true, sysfs is "ro"

the comment looks incorrect. it should be `"rw"`?

Code after:

	// Windows does not collect inodes stats.
	if goruntime.GOOS != "windows" {
		require.NotEmpty(t, s.GetWritableLayer().GetInodesUsed().GetValue())
	}
}

func TestContainerSysfsStatsWithPrivilegedPod(t *testing.T) {
	if goruntime.GOOS == "windows" {
		t.Skip("Doesn't care about filesystem properties on windows")
	}
	testImage := images.Get(images.BusyBox)
	testcases := []struct {
		name                               string
		privilegedPod, privilegedContainer bool
		expectedSysfsOption, expectedErr   string
	}{
		{
			name:                "sandbox and container with privileged=true, sysfs is rw",
			privilegedPod:       true,
			privilegedContainer: true,
			expectedSysfsOption: "rw",
		},
		{
			name:                "sandbox with privileged=true, and container with privileged=false, sysfs is ro",
			privilegedPod:       true,
			privilegedContainer: false,
			expectedSysfsOption: "ro",
		},
		{
			name:                "sandbox and container with privileged=false, sysfs is ro",
			privilegedPod:       false,
			privilegedContainer: false,
			expectedSysfsOption: "ro",
		},
		{
			name:                "sandbox with privileged=false, and container with privileged=true, create container failed",
			privilegedPod:       false,
			privilegedContainer: true,
			expectedErr:         "failed to generate spec opts: no privileged container allowed in sandbox",
		},
	}
	for _, test := range testcases {
		t.Run(test.name, func(t *testing.T) {
			EnsureImageExists(t, testImage)
			sb, sbConfig := PodSandboxConfigWithCleanup(
				t,
				"sandbox",
				"sysfs-stats-with-privileged",
				WithPodSecurityContext(test.privilegedPod),
			)