pyrox.dev
1import ../make-test-python.nix (
2 { pkgs, lib, ... }:
3 let
4 quadletContainerFile = pkgs.writeText "quadlet.container" ''
5 [Unit]
6 Description=A test quadlet container
7
8 [Container]
9 Image=localhost/scratchimg:latest
10 Exec=bash -c 'trap exit SIGTERM SIGINT; while true; do sleep 1; done'
11 ContainerName=quadlet
12 Volume=/nix/store:/nix/store
13 Volume=/run/current-system/sw/bin:/bin
14
15 [Install]
16 WantedBy=default.target
17 '';
18 in
19 {
20 name = "podman";
21 meta = {
22 maintainers = lib.teams.podman.members;
23 };
24
25 nodes = {
26 rootful =
27 { pkgs, ... }:
28 {
29 virtualisation.podman.enable = true;
30
31 # hack to ensure that podman built with and without zfs in extraPackages is cached
32 boot.supportedFilesystems = [ "zfs" ];
33 networking.hostId = "00000000";
34 };
35 rootless =
36 { pkgs, ... }:
37 {
38 virtualisation.podman.enable = true;
39
40 users.users.alice = {
41 isNormalUser = true;
42 };
43 };
44 dns =
45 { pkgs, ... }:
46 {
47 virtualisation.podman.enable = true;
48
49 virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
50 };
51 docker =
52 { pkgs, ... }:
53 {
54 virtualisation.podman.enable = true;
55
56 virtualisation.podman.dockerSocket.enable = true;
57
58 environment.systemPackages = [
59 pkgs.docker-client
60 ];
61
62 users.users.alice = {
63 isNormalUser = true;
64 extraGroups = [ "podman" ];
65 };
66
67 users.users.mallory = {
68 isNormalUser = true;
69 };
70 };
71 };
72
73 testScript = ''
74 import shlex
75
76
77 def su_cmd(cmd, user = "alice"):
78 cmd = shlex.quote(cmd)
79 return f"su {user} -l -c {cmd}"
80
81
82 rootful.wait_for_unit("sockets.target")
83 rootless.wait_for_unit("sockets.target")
84 dns.wait_for_unit("sockets.target")
85 docker.wait_for_unit("sockets.target")
86 start_all()
87
88 with subtest("Run container as root with runc"):
89 rootful.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
90 rootful.succeed(
91 "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
92 )
93 rootful.succeed("podman ps | grep sleeping")
94 rootful.succeed("podman stop sleeping")
95 rootful.succeed("podman rm sleeping")
96
97 with subtest("Run container as root with crun"):
98 rootful.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
99 rootful.succeed(
100 "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
101 )
102 rootful.succeed("podman ps | grep sleeping")
103 rootful.succeed("podman stop sleeping")
104 rootful.succeed("podman rm sleeping")
105
106 with subtest("Run container as root with the default backend"):
107 rootful.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
108 rootful.succeed(
109 "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
110 )
111 rootful.succeed("podman ps | grep sleeping")
112 rootful.succeed("podman stop sleeping")
113 rootful.succeed("podman rm sleeping")
114
115 # start systemd session for rootless
116 rootless.succeed("loginctl enable-linger alice")
117 rootless.succeed(su_cmd("whoami"))
118 rootless.sleep(1)
119
120 with subtest("Run container rootless with runc"):
121 rootless.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
122 rootless.succeed(
123 su_cmd(
124 "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
125 )
126 )
127 rootless.succeed(su_cmd("podman ps | grep sleeping"))
128 rootless.succeed(su_cmd("podman stop sleeping"))
129 rootless.succeed(su_cmd("podman rm sleeping"))
130
131 with subtest("Run container rootless with crun"):
132 rootless.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
133 rootless.succeed(
134 su_cmd(
135 "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
136 )
137 )
138 rootless.succeed(su_cmd("podman ps | grep sleeping"))
139 rootless.succeed(su_cmd("podman stop sleeping"))
140 rootless.succeed(su_cmd("podman rm sleeping"))
141
142 with subtest("Run container rootless with the default backend"):
143 rootless.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
144 rootless.succeed(
145 su_cmd(
146 "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
147 )
148 )
149 rootless.succeed(su_cmd("podman ps | grep sleeping"))
150 rootless.succeed(su_cmd("podman stop sleeping"))
151 rootless.succeed(su_cmd("podman rm sleeping"))
152
153 with subtest("rootlessport"):
154 rootless.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
155 rootless.succeed(
156 su_cmd(
157 "podman run -d -p 9000:8888 --name=rootlessport -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Testing</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8888"
158 )
159 )
160 rootless.succeed(su_cmd("podman ps | grep rootlessport"))
161 rootless.wait_until_succeeds(su_cmd("${pkgs.curl}/bin/curl localhost:9000 | grep Testing"))
162 rootless.succeed(su_cmd("podman stop rootlessport"))
163 rootless.succeed(su_cmd("podman rm rootlessport"))
164
165 with subtest("Run container with init"):
166 rootful.succeed(
167 "tar cv -C ${pkgs.pkgsStatic.busybox} . | podman import - busybox"
168 )
169 pid = rootful.succeed("podman run --rm busybox readlink /proc/self").strip()
170 assert pid == "1"
171 pid = rootful.succeed("podman run --rm --init busybox readlink /proc/self").strip()
172 assert pid == "2"
173
174 with subtest("aardvark-dns"):
175 dns.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
176 dns.succeed(
177 "podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Testing</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8000"
178 )
179 dns.succeed("podman ps | grep webserver")
180 dns.wait_until_succeeds(
181 "podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${pkgs.curl}/bin/curl http://webserver:8000 | grep Testing"
182 )
183 dns.succeed("podman stop webserver")
184 dns.succeed("podman rm webserver")
185
186 with subtest("A podman member can use the docker cli"):
187 docker.succeed(su_cmd("docker version"))
188
189 with subtest("Run container via docker cli"):
190 docker.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
191 docker.succeed(
192 "docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin localhost/scratchimg /bin/sleep 10"
193 )
194 docker.succeed("docker ps | grep sleeping")
195 docker.succeed("podman ps | grep sleeping")
196 docker.succeed("docker stop sleeping")
197 docker.succeed("docker rm sleeping")
198
199 with subtest("A podman non-member can not use the docker cli"):
200 docker.fail(su_cmd("docker version", user="mallory"))
201
202 with subtest("A rootless quadlet container service is created"):
203 dir = "/home/alice/.config/containers/systemd"
204 rootless.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
205 rootless.succeed(su_cmd(f"mkdir -p {dir}"))
206 rootless.succeed(su_cmd(f"cp -f ${quadletContainerFile} {dir}/quadlet.container"))
207 rootless.systemctl("daemon-reload", "alice")
208 rootless.systemctl("start quadlet", "alice")
209 rootless.wait_until_succeeds(su_cmd("podman ps | grep quadlet"), timeout=20)
210 rootless.systemctl("stop quadlet", "alice")
211
212 # TODO: add docker-compose test
213
214 '';
215 }
216)