Skip to content

Commit ac404b5

Browse files
acosta11acosta11
committed
Move default docker user selection into droplet
* Not able to remove logic from process because droplet not guaranteed to exist for unstaged app
1 parent 9861af9 commit ac404b5

File tree

3 files changed

+94
-119
lines changed

3 files changed

+94
-119
lines changed

‎app/models/runtime/task_model.rb

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ def run_action_user
4848
return user if user.present?
4949

5050
if docker?
51-
docker_run_action_user
51+
docker_user
5252
elsif cnb?
5353
'root' # TODO: Why do CNB tasks default to this user instead of vcap?
5454
else
@@ -64,16 +64,16 @@ def cnb?
6464
!!droplet&.cnb?
6565
end
6666

67+
def docker_user
68+
droplet&.docker_user
69+
end
70+
6771
private
6872

6973
def permitted_users
7074
Set.new([AppModel::DEFAULT_CONTAINER_USER]) + Config.config.get(:additional_allowed_process_users)
7175
end
7276

73-
def docker_run_action_user
74-
droplet&.docker_user.presence || (Config.config.get(:allow_process_root_user) ? AppModel::DEFAULT_DOCKER_CONTAINER_USER : AppModel::DEFAULT_CONTAINER_USER)
75-
end
76-
7777
def running_state?
7878
state == RUNNING_STATE
7979
end

‎spec/unit/models/runtime/droplet_model_spec.rb

Lines changed: 73 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -359,41 +359,91 @@ module VCAP::CloudController
359359
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"],"user":"cnb"}' }
360360
let(:droplet_model) { DropletModel.make(:docker, execution_metadata: droplet_execution_metadata) }
361361

362-
context 'when the droplet execution metadata specifies a user' do
363-
it 'returns the specified user' do
364-
expect(droplet_model.docker_user).to eq('cnb')
362+
context 'when root user is allowed' do
363+
before do
364+
TestConfig.override(allow_process_root_user: true)
365+
end
366+
367+
context 'when the droplet execution metadata specifies a user' do
368+
it 'returns the specified user' do
369+
expect(droplet_model.docker_user).to eq('cnb')
370+
end
365371
end
366-
end
367372

368-
context 'when the droplet execution metadata DOES NOT specify a user' do
369-
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
373+
context 'when the droplet execution metadata DOES NOT specify a user' do
374+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
370375

371-
it 'defaults the user to root' do
372-
expect(droplet_model.docker_user).to eq('root')
376+
it 'defaults the user to root' do
377+
expect(droplet_model.docker_user).to eq('root')
378+
end
373379
end
374-
end
375380

376-
context 'when the droplet execution metadata is an empty string' do
377-
let(:droplet_execution_metadata) { '' }
381+
context 'when the droplet execution metadata is an empty string' do
382+
let(:droplet_execution_metadata) { '' }
378383

379-
it 'defaults the user to root' do
380-
expect(droplet_model.docker_user).to eq('root')
384+
it 'defaults the user to root' do
385+
expect(droplet_model.docker_user).to eq('root')
386+
end
381387
end
382-
end
383388

384-
context 'when the droplet execution metadata is nil' do
385-
let(:droplet_execution_metadata) { nil }
389+
context 'when the droplet execution metadata is nil' do
390+
let(:droplet_execution_metadata) { nil }
386391

387-
it 'defaults the user to root' do
388-
expect(droplet_model.docker_user).to eq('root')
392+
it 'defaults the user to root' do
393+
expect(droplet_model.docker_user).to eq('root')
394+
end
389395
end
390-
end
391396

392-
context 'when the droplet execution metadata has invalid json' do
393-
let(:droplet_execution_metadata) { '{' }
397+
context 'when the droplet execution metadata has invalid json' do
398+
let(:droplet_execution_metadata) { '{' }
399+
400+
it 'defaults the user to root' do
401+
expect(droplet_model.docker_user).to eq('root')
402+
end
403+
end
404+
405+
context 'when root user is not allowed' do
406+
before do
407+
TestConfig.override(allow_process_root_user: false)
408+
end
409+
410+
context 'when the droplet execution metadata specifies a user' do
411+
it 'returns the specified user' do
412+
expect(droplet_model.docker_user).to eq('cnb')
413+
end
414+
end
415+
416+
context 'when the droplet execution metadata DOES NOT specify a user' do
417+
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
418+
419+
it 'defaults the user to vcap' do
420+
expect(droplet_model.docker_user).to eq('vcap')
421+
end
422+
end
423+
424+
context 'when the droplet execution metadata is an empty string' do
425+
let(:droplet_execution_metadata) { '' }
426+
427+
it 'defaults the user to root' do
428+
expect(droplet_model.docker_user).to eq('vcap')
429+
end
430+
end
431+
432+
context 'when the droplet execution metadata is nil' do
433+
let(:droplet_execution_metadata) { nil }
434+
435+
it 'defaults the user to root' do
436+
expect(droplet_model.docker_user).to eq('vcap')
437+
end
438+
end
439+
440+
context 'when the droplet execution metadata has invalid json' do
441+
let(:droplet_execution_metadata) { '{' }
394442

395-
it 'defaults the user to root' do
396-
expect(droplet_model.docker_user).to eq('root')
443+
it 'defaults the user to root' do
444+
expect(droplet_model.docker_user).to eq('vcap')
445+
end
446+
end
397447
end
398448
end
399449
end

‎spec/unit/models/runtime/task_model_spec.rb

Lines changed: 16 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -204,111 +204,36 @@ module VCAP::CloudController
204204
task.droplet.update(execution_metadata: droplet_execution_metadata)
205205
end
206206

207-
context 'when root user is allowed' do
207+
context 'when the task has a user specified' do
208208
before do
209-
TestConfig.override(allow_process_root_user: true)
210-
end
211-
212-
context 'when the task has a user specified' do
213-
before do
214-
task.update(user: 'ContainerUser')
215-
end
216-
217-
it 'returns the user' do
218-
expect(task.run_action_user).to eq('ContainerUser')
219-
end
220-
end
221-
222-
context 'when the droplet execution metadata specifies a user' do
223-
it 'returns the specified user' do
224-
expect(task.run_action_user).to eq('some-user')
225-
end
226-
end
227-
228-
context 'when the droplet execution metadata DOES NOT specify a user' do
229-
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
230-
231-
it 'defaults the user to root' do
232-
expect(task.run_action_user).to eq('root')
233-
end
234-
end
235-
236-
context 'when the droplet execution metadata is an empty string' do
237-
let(:droplet_execution_metadata) { '' }
238-
239-
it 'defaults the user to root' do
240-
expect(task.run_action_user).to eq('root')
241-
end
242-
end
243-
244-
context 'when the droplet execution metadata is nil' do
245-
let(:droplet_execution_metadata) { nil }
246-
247-
it 'defaults the user to root' do
248-
expect(task.run_action_user).to eq('root')
249-
end
209+
task.update(user: 'ContainerUser')
250210
end
251211

252-
context 'when the droplet execution metadata has invalid json' do
253-
let(:droplet_execution_metadata) { '{' }
254-
255-
it 'defaults the user to root' do
256-
expect(task.run_action_user).to eq('root')
257-
end
212+
it 'returns the user' do
213+
expect(task.run_action_user).to eq('ContainerUser')
258214
end
259215
end
260216

261-
context 'when root user is not allowed' do
262-
before do
263-
TestConfig.override(allow_process_root_user: false)
264-
end
265-
266-
context 'when the task has a user specified' do
217+
context 'when the task DOES NOT have a user specified' do
218+
context 'when there is a droplet and it has the docker lifecycle' do
267219
before do
268-
task.update(user: 'ContainerUser')
269-
end
270-
271-
it 'returns the user' do
272-
expect(task.run_action_user).to eq('ContainerUser')
273-
end
274-
end
275-
276-
context 'when the droplet execution metadata specifies a user' do
277-
it 'returns the specified user' do
278-
expect(task.run_action_user).to eq('some-user')
220+
allow(task.droplet).to(receive(:docker_user).and_return('DropletDockerUser'))
279221
end
280-
end
281-
282-
context 'when the droplet execution metadata DOES NOT specify a user' do
283-
let(:droplet_execution_metadata) { '{"entrypoint":["/image-entrypoint.sh"]}' }
284222

285-
it 'defaults the user to vcap' do
286-
expect(task.run_action_user).to eq('vcap')
223+
it 'returns the docker_user from the droplet' do
224+
expect(task.run_action_user).to eq('DropletDockerUser')
287225
end
288226
end
227+
end
289228

290-
context 'when the droplet execution metadata is an empty string' do
291-
let(:droplet_execution_metadata) { '' }
292-
293-
it 'defaults the user to vcap' do
294-
expect(task.run_action_user).to eq('vcap')
295-
end
296-
end
297-
298-
context 'when the droplet execution metadata is nil' do
299-
let(:droplet_execution_metadata) { nil }
300-
301-
it 'defaults the user to vcap' do
302-
expect(task.run_action_user).to eq('vcap')
303-
end
229+
context 'when there is no droplet for the task' do
230+
before do
231+
task.droplet.delete
232+
task.reload
304233
end
305234

306-
context 'when the droplet execution metadata has invalid json' do
307-
let(:droplet_execution_metadata) { '{' }
308-
309-
it 'defaults the user to vcap' do
310-
expect(task.run_action_user).to eq('vcap')
311-
end
235+
it 'returns the default "vcap" user' do
236+
expect(task.run_action_user).to eq('vcap')
312237
end
313238
end
314239
end

0 commit comments

Comments
 (0)