Repository: containerd/containerd
File: integration/container_stats_test.go (Go)

Code before:
		},
		{
			name:                "sandbox with privileged=false, and container with privileged=true, create container failed",
			privilegedPod:       false,
			privilegedContainer: true,
			expectedErr:         "failed to generate spec opts: no privileged container allowed in sandbox",
		},
	}
	for _, test := range testcases {
		t.Run(test.name, func(t *testing.T) {
			EnsureImageExists(t, testImage)
			sb, sbConfig := PodSandboxConfigWithCleanup(
				t,
				"sandbox",
				"sysfs-stats-with-privileged",
				WithPodSecurityContext(test.privilegedPod),
			)
			cnConfig := ContainerConfig(
				"container",
				testImage,
				WithCommand("sh", "-c", "top"),
				WithSecurityContext(test.privilegedContainer),
			)
			cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
			if test.expectedErr != "" {
				assert.Contains(t, err.Error(), test.expectedErr)
				return
			}
			assert.NoError(t, err)
			defer func() {
				if test.expectedErr == "" {
					assert.NoError(t, runtimeService.RemoveContainer(cn))
				}
			}()

			t.Log("Start the container")
			require.NoError(t, runtimeService.StartContainer(cn))
			defer func() {
				assert.NoError(t, runtimeService.StopContainer(cn, 10))
			}()

			t.Logf("Execute cmd in container by sync")
			mountinfo, _, err := runtimeService.ExecSync(cn, []string{
				"sh",
				"-c",
				"mount |grep sysfs",
			}, 10)
			assert.NoError(t, err)
			assert.Contains(t, string(mountinfo), test.expectedSysfsOption)
		})
	}

Review comment (suggestion):
if `err` is `nil` instead, `err.Error()` may panic. suggest to add `assert.Error(err)` before this line.

Code after:
		},
		{
			name:                "sandbox with privileged=false, and container with privileged=true, create container failed",
			privilegedPod:       false,
			privilegedContainer: true,
			expectedErr:         "failed to generate spec opts: no privileged container allowed in sandbox",
		},
	}
	for _, test := range testcases {
		t.Run(test.name, func(t *testing.T) {
			EnsureImageExists(t, testImage)
			sb, sbConfig := PodSandboxConfigWithCleanup(
				t,
				"sandbox",
				"sysfs-stats-with-privileged",
				WithPodSecurityContext(test.privilegedPod),
			)
			cnConfig := ContainerConfig(
				"container",
				testImage,
				WithCommand("sh", "-c", "top"),
				WithSecurityContext(test.privilegedContainer),
			)
			cn, err := runtimeService.CreateContainer(sb, cnConfig, sbConfig)
			if test.expectedErr != "" && err != nil {
				assert.Contains(t, err.Error(), test.expectedErr)
				return
			}
			assert.NoError(t, err)
			defer func() {
				if test.expectedErr == "" {
					assert.NoError(t, runtimeService.RemoveContainer(cn))
				}
			}()

			t.Log("Start the container")
			require.NoError(t, runtimeService.StartContainer(cn))
			defer func() {
				assert.NoError(t, runtimeService.StopContainer(cn, 10))
			}()

			t.Logf("Execute cmd in container by sync")
			mountinfo, _, err := runtimeService.ExecSync(cn, []string{
				"sh",
				"-c",
				"mount |grep sysfs",
			}, 10)
			assert.NoError(t, err)
			assert.Contains(t, string(mountinfo), test.expectedSysfsOption)
		})
	}