Repository: containerd/containerd
File: integration/image_volume_linux_test.go (Go)

Code before:
	containerName := "test-container"
	cfg := ContainerConfig(containerName, containerImage,
		WithCommand("sleep", "1d"),
		WithIDMapImageVolumeMount(imageVolumeImage, "", "/image-mount", uidMaps, gidMaps),
		WithLogPath(containerName),
		WithUserNamespace(containerID, hostID, size),
	)
	cnID, err := podCtx.rSvc.CreateContainer(podCtx.id, cfg, podCtx.cfg)
	require.NoError(t, err, "failed to create container with image volume and user namespace")

	require.NoError(t, podCtx.rSvc.StartContainer(cnID), "failed to start container")

	// Verify that the image volume is accessible
	stdout, stderr, err := runtimeService.ExecSync(cnID, []string{"ls", "/image-mount/pause"}, 0)
	require.NoError(t, err, "failed to access image volume")
	require.Len(t, stderr, 0)
	require.Contains(t, string(stdout), "pause", "image volume should contain pause binary")

	_, _, err = runtimeService.ExecSync(cnID, []string{"rm", "/image-mount/pause"}, 0)
	require.Error(t, err, "image volume should be read-only")
	require.Contains(t, err.Error(), "Read-only file system", "error should indicate read-only filesystem")

	stdout, stderr, err = runtimeService.ExecSync(cnID, []string{"stat", "-c", "%u:%g", "/image-mount/pause"}, 0)
	require.NoError(t, err, "failed to stat file in image volume")
	require.Len(t, stderr, 0)
	require.Contains(t, string(stdout), "0:0", "files in image volume should appear as owned by root in container's user namespace")
}


Review comment (suggestion):
This will be true if it returns `1000:05`. In other tests (I think in the k/k repo) we are using `stat -c '=%u=%g='`. This will print something like `=0=0=`. This way you can match for that string exactly and we can be sure the UID is 0 and not some bigger number that ends with 0 (like 1000).

Code after:
	cfg := ContainerConfig(containerName, containerImage,
		WithCommand("sleep", "1d"),
		WithIDMapImageVolumeMount(imageVolumeImage, "", "/image-mount", uidMaps, gidMaps),
		WithLogPath(containerName),
		WithUserNamespace(containerID, hostID, size),
	)
	cnID, err := podCtx.rSvc.CreateContainer(podCtx.id, cfg, podCtx.cfg)
	require.NoError(t, err, "failed to create container with image volume and user namespace")

	require.NoError(t, podCtx.rSvc.StartContainer(cnID), "failed to start container")

	// Verify that the image volume is accessible
	stdout, stderr, err := runtimeService.ExecSync(cnID, []string{"ls", "/image-mount/pause"}, 0)
	require.NoError(t, err, "failed to access image volume")
	require.Len(t, stderr, 0)
	require.Contains(t, string(stdout), "pause", "image volume should contain pause binary")

	_, _, err = runtimeService.ExecSync(cnID, []string{"rm", "/image-mount/pause"}, 0)
	require.Error(t, err, "image volume should be read-only")
	require.Contains(t, err.Error(), "Read-only file system", "error should indicate read-only filesystem")

	stdout, stderr, err = runtimeService.ExecSync(cnID, []string{"stat", "-c", "=%u=%g=", "/image-mount/pause"}, 0)
	require.NoError(t, err, "failed to stat file in image volume")
	require.Len(t, stderr, 0)
	require.Contains(t, string(stdout), "=0=0=", "files in image volume should appear as owned by root in container's user namespace")
}