host
9f05178f2b
DockerExecutor gains a runtime parameter (passed as docker --runtime in build_run_command, after --pids-limit); worker CLI gains --docker-runtime, wired through _build_cli_executor. Unset or empty means no --runtime flag, so existing tasks keep docker default (runc); an unregistered runtime fails container start (fail closed), it never silently falls back. Tests: runsc appears in the command, default/empty omit it, CLI wiring passes through. README documents the flag and corrects a stale multi-tenant note (host kernel does not ban userns; bwrap fails inside Docker containers on nested-pidns proc mount).
71 lines
2.7 KiB
Python
71 lines
2.7 KiB
Python
"""Docker runtime 单测：--runtime=runsc 接入。
|
|
|
|
只用假 runner，不跑真实 Docker。覆盖：显式 runtime 进命令
|
|
（且在 --pids-limit 之后）、默认/空串不传 --runtime、
|
|
worker CLI --docker-runtime 透传到 DockerExecutor。
|
|
"""
|
|
|
|
import sys
|
|
import unittest
|
|
from pathlib import Path
|
|
from types import SimpleNamespace
|
|
from unittest import mock
|
|
|
|
try:
|
|
from cloud.sandbox import DockerExecutor
|
|
from cloud.worker import _build_cli_executor
|
|
except ImportError:
|
|
sys.path.insert(0, str(Path(__file__).resolve().parents[2]))
|
|
from cloud.sandbox import DockerExecutor
|
|
from cloud.worker import _build_cli_executor
|
|
|
|
|
|
def _executor(**kwargs):
|
|
def fake(cmd, timeout=None):
|
|
return SimpleNamespace(returncode=0, stdout="", stderr="")
|
|
kwargs.setdefault("env", {"XCM_API_KEY": "test-placeholder"})
|
|
kwargs.setdefault("runner", fake)
|
|
with mock.patch("cloud.sandbox.shutil.which",
|
|
return_value="/usr/bin/docker"):
|
|
return DockerExecutor("/fake/host.py", **kwargs)
|
|
|
|
|
|
def _cmd(ex):
|
|
with mock.patch("cloud.sandbox.shutil.which",
|
|
return_value="/usr/bin/docker"):
|
|
return ex.build_run_command(
|
|
{"id": "t1", "worktree": "/tmp/wt"}, ["echo", "hi"])
|
|
|
|
|
|
class DockerRuntimeTestCase(unittest.TestCase):
|
|
def test_runsc_appears_in_command(self):
|
|
cmd = _cmd(_executor(runtime="runsc", pids_limit=512))
|
|
self.assertIn("--runtime", cmd)
|
|
self.assertEqual(cmd[cmd.index("--runtime") + 1], "runsc")
|
|
# 顺序：--runtime 在 --pids-limit 之后。
|
|
self.assertLess(cmd.index("--pids-limit"), cmd.index("--runtime"))
|
|
|
|
def test_default_and_empty_omit_runtime(self):
|
|
self.assertNotIn("--runtime", _cmd(_executor()))
|
|
self.assertNotIn("--runtime", _cmd(_executor(runtime="")))
|
|
self.assertNotIn("--runtime", _cmd(_executor(runtime=" ")))
|
|
|
|
def test_cli_wiring(self):
|
|
args = SimpleNamespace(
|
|
executor="docker", config=None,
|
|
docker_image="codex-app-server:latest",
|
|
docker_cpus="2", docker_memory="2g", docker_user="1000:1000",
|
|
docker_worktrees_root=None, env_key=None, codex_config=None,
|
|
docker_timeout=None, docker_extra_mounts=None,
|
|
docker_security_opt=None, docker_pids_limit=512,
|
|
docker_runtime="runsc")
|
|
ex = _build_cli_executor(args, "/fake/host.py")
|
|
self.assertIsInstance(ex, DockerExecutor)
|
|
self.assertEqual(ex.runtime, "runsc")
|
|
args2 = SimpleNamespace(**{**vars(args), "docker_runtime": None})
|
|
self.assertIsNone(_build_cli_executor(args2, "/fake/host.py").runtime)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|