Repository: moby/moby
File: integration/container/run_linux_test.go (Go)

Code before:
	for _, tc := range testCases {
		cID := container.Run(ctx, t, apiClient, tc.ops...)
		res, err := container.Exec(ctx, apiClient, cID, []string{"chown", "42", "/bin/true"})
		assert.NilError(t, err)
		assert.Equal(t, tc.expectedExitCode, res.ExitCode)
		if tc.expectedExitCode != 0 {
			assert.Check(t, is.Contains(res.Stderr(), "Operation not permitted"))
		}
	}
}

func TestCgroupRW(t *testing.T) {
	skip.If(t, testEnv.DaemonInfo.OSType != "linux")

	ctx := setupTest(t)
	apiClient := testEnv.APIClient()

	type testCase struct {
		ops              []func(*container.TestContainerConfig)
		expectedErrMsg   string
		expectedExitCode int
	}
	testCases := []testCase{
		{
			ops: nil,
			// no err msg, so, success
		},
		{
			ops: []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=true")},
			// no err msg, because this is correct key=value
			expectedExitCode: 0,
		},
		{
			ops: []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=false")},
			// no err msg, because this is correct key=value
			expectedExitCode: 1,
		},
		{
			ops:            []func(*container.TestContainerConfig){container.WithSecurityOpt("writeable-cgroups=true")},
			expectedErrMsg: `Error response from daemon: invalid --security-opt 2: "writeable-cgroups=true"`,
		},
		{
			ops:            []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=1")},
			expectedErrMsg: `Error response from daemon: invalid --security-opt 2: "writable-cgroups=1"`,
		},
		{
			ops:            []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=potato")},
			expectedErrMsg: `Error response from daemon: invalid --security-opt 2: "writable-cgroups=potato"`,
		},
	}
	for _, tc := range testCases {

Review comment (suggestion):
Looks like this one needs `expectedExitCode: 1` since its using the default case which should be non-writable.

Code after:
		res, err := container.Exec(ctx, apiClient, cID, []string{"chown", "42", "/bin/true"})
		assert.NilError(t, err)
		assert.Equal(t, tc.expectedExitCode, res.ExitCode)
		if tc.expectedExitCode != 0 {
			assert.Check(t, is.Contains(res.Stderr(), "Operation not permitted"))
		}
	}
}

func TestCgroupRW(t *testing.T) {
	skip.If(t, testEnv.DaemonInfo.OSType != "linux")
	skip.If(t, testEnv.IsRootless, "can't test writable cgroups in rootless (permission denied)")
	skip.If(t, testEnv.IsUserNamespace, "can't test writable cgroups in user namespaces (permission denied)")

	ctx := setupTest(t)
	apiClient := testEnv.APIClient()

	type testCase struct {
		name             string
		ops              []func(*container.TestContainerConfig)
		expectedErrMsg   string
		expectedExitCode int
	}
	testCases := []testCase{
		{
			name: "nil",
			ops:  nil,
			// no err msg, because disabled-by-default
			expectedExitCode: 1,
		},
		{
			name: "writable",
			ops:  []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups")},
			// no err msg, because this is correct key=bool
			expectedExitCode: 0,
		},
		{
			name: "writable=true",
			ops:  []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=true")},
			// no err msg, because this is correct key=value
			expectedExitCode: 0,
		},
		{
			name: "writable=false",
			ops:  []func(*container.TestContainerConfig){container.WithSecurityOpt("writable-cgroups=false")},
			// no err msg, because this is correct key=value
			expectedExitCode: 1,
		},
		{
			name:           "writeable=true",
			ops:            []func(*container.TestContainerConfig){container.WithSecurityOpt("writeable-cgroups=true")},