opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-12-02 02:58:03 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #17213 from umohnani8/nonroot

Browse Source 
Set runAsNonRoot=true in gen kube
This commit is contained in:
OpenShift Merge Robot
2023-01-26 05:03:07 -05:00
committed by GitHub
parent 4cd7f6354b 958c94094e
commit 0184ba5d09
2 changed files with 42 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
test/e2e/generate_kube_test.go
View File

@@ -1085,6 +1085,41 @@ ENTRYPOINT ["sleep"]`
Expect(containers[0]).To(HaveField("Args", []string{"hello"}))
})
It("podman generate kube - image has positive integer user set", func() {
// Build an image with user=1000.
containerfile := `FROM quay.io/libpod/alpine:latest
USER 1000`
targetPath, err := CreateTempDirInTempDir()
Expect(err).ToNot(HaveOccurred())
containerfilePath := filepath.Join(targetPath, "Containerfile")
err = os.WriteFile(containerfilePath, []byte(containerfile), 0644)
Expect(err).ToNot(HaveOccurred())
image := "generatekube:test"
session := podmanTest.Podman([]string{"build", "--pull-never", "-f", containerfilePath, "-t", image})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
session = podmanTest.Podman([]string{"create", "--pod", "new:testpod", image, "top"})
session.WaitWithDefaultTimeout()
Expect(session).Should(Exit(0))
kube := podmanTest.Podman([]string{"generate", "kube", "testpod"})
kube.WaitWithDefaultTimeout()
Expect(kube).Should(Exit(0))
// Now make sure that the container's securityContext has runAsNonRoot=true
pod := new(v1.Pod)
err = yaml.Unmarshal(kube.Out.Contents(), pod)
Expect(err).ToNot(HaveOccurred())
containers := pod.Spec.Containers
Expect(containers).To(HaveLen(1))
trueBool := true
Expect(containers[0]).To(HaveField("SecurityContext.RunAsNonRoot", &trueBool))
})
It("podman generate kube - --privileged container", func() {
session := podmanTest.Podman([]string{"create", "--pod", "new:testpod", "--privileged", ALPINE, "ls"})
session.WaitWithDefaultTimeout()