36 lines
1.7 KiB
Bash
36 lines
1.7 KiB
Bash
|
#!/bin/sh
|
||
|
|
set -eu
|
||
|
|
fail=0
|
||
|
|
export HOME=/srv/le-app-codex/home
|
||
|
|
export DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||
|
|
ALPINE='docker.io/library/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659'
|
||
|
|
NGINX='docker.io/library/nginx:1.29.4-alpine@sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2'
|
||
|
|
test "$(id -u)" -eq 1200
|
||
|
|
test -S /run/user/1200/docker.sock
|
||
|
|
test "$(docker context show)" = le-app-codex
|
||
|
|
test "$(docker context inspect le-app-codex --format '{{.Endpoints.docker.Host}}')" = unix:///run/user/1200/docker.sock
|
||
|
|
docker info --format '{{json .SecurityOptions}}' | grep -q rootless
|
||
|
|
test "$(docker info --format '{{.DockerRootDir}}')" = /srv/le-app-codex/container-runtime/docker
|
||
|
|
docker run --rm --network none "$ALPINE" true
|
||
|
|
docker run --rm "$ALPINE" wget -qO- https://example.com >/dev/null
|
||
|
|
for target in 127.0.0.1 10.200.120.1 192.168.10.1 192.168.10.151 10.98.0.2 74.67.173.56 169.254.169.254; do
|
||
|
|
if docker run --rm "$ALPINE" wget -T2 -qO- "http://$target" >/dev/null 2>&1; then
|
||
|
|
echo "UNEXPECTED CONTAINER ACCESS: $target" >&2; fail=1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
if docker run --rm "$ALPINE" sh -c 'nc -w2 -z 1.1.1.1 25 || nc -w2 -z 1.1.1.1 465 || nc -w2 -z 1.1.1.1 587'; then
|
||
|
|
echo 'UNEXPECTED CONTAINER SMTP ACCESS' >&2; fail=1
|
||
|
|
fi
|
||
|
|
cid=$(docker run -d --rm -p 18080:80 "$NGINX")
|
||
|
|
trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
|
||
|
|
sleep 2
|
||
|
|
for host in 127.0.0.1 192.168.10.151 10.98.0.2; do
|
||
|
|
if curl -fsS --connect-timeout 2 "http://$host:18080" >/dev/null 2>&1; then
|
||
|
|
echo "UNEXPECTED PUBLISHED PORT: $host" >&2; fail=1
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
docker rm -f "$cid" >/dev/null
|
||
|
|
trap - EXIT
|
||
|
|
test ! -S /run/docker.sock || ! docker -H unix:///run/docker.sock info >/dev/null 2>&1
|
||
|
|
exit "$fail"
|