@@ -617,6 +617,7 @@ func ContainerCreate(opt *option.Option) {
617617 command .Run (opt , "start" , testContainerName )
618618 verifyNetworkSettings (opt , testContainerName , "bridge" )
619619 })
620+
620621 It ("should create a container with specified restart options" , func () {
621622 // define options
622623 options .Cmd = []string {"sleep" , "Infinity" }
@@ -1126,6 +1127,144 @@ func ContainerCreate(opt *option.Option) {
11261127 }
11271128 Expect (foundUTSNamespace ).Should (BeFalse ())
11281129 })
1130+
1131+ It ("should create a container with specified PidMode" , func () {
1132+ // First create a container that will be referenced in pid mode
1133+ hostOptions := types.ContainerCreateRequest {}
1134+ hostOptions .Image = defaultImage
1135+ hostOptions .Cmd = []string {"sleep" , "Infinity" }
1136+ statusCode , hostCtr := createContainer (uClient , url , "host-container" , hostOptions )
1137+ Expect (statusCode ).Should (Equal (http .StatusCreated ))
1138+ Expect (hostCtr .ID ).ShouldNot (BeEmpty ())
1139+ command .Run (opt , "start" , "host-container" )
1140+
1141+ // Define options for the container with pid mode
1142+ options .Cmd = []string {"sleep" , "Infinity" }
1143+ options .HostConfig .PidMode = "container:host-container"
1144+
1145+ // Create container
1146+ statusCode , ctr := createContainer (uClient , url , testContainerName , options )
1147+ Expect (statusCode ).Should (Equal (http .StatusCreated ))
1148+ Expect (ctr .ID ).ShouldNot (BeEmpty ())
1149+
1150+ // Inspect container using Docker-compatible format
1151+ resp := command .Stdout (opt , "inspect" , testContainerName )
1152+ var inspect []* dockercompat.Container
1153+ err := json .Unmarshal (resp , & inspect )
1154+ Expect (err ).Should (BeNil ())
1155+ Expect (inspect ).Should (HaveLen (1 ))
1156+
1157+ // Verify PidMode configuration
1158+ Expect (inspect [0 ].HostConfig .PidMode ).Should (Equal (hostCtr .ID ))
1159+
1160+ // Cleanup
1161+ command .Run (opt , "rm" , "-f" , "host-container" )
1162+ })
1163+
1164+ It ("should create a container with private IPC mode" , func () {
1165+ options .Cmd = []string {"sleep" , "Infinity" }
1166+ options .HostConfig .IpcMode = "private"
1167+
1168+ statusCode , ctr := createContainer (uClient , url , testContainerName , options )
1169+ Expect (statusCode ).Should (Equal (http .StatusCreated ))
1170+ Expect (ctr .ID ).ShouldNot (BeEmpty ())
1171+
1172+ command .Run (opt , "start" , testContainerName )
1173+
1174+ nativeResp := command .Stdout (opt , "inspect" , "--mode=native" , testContainerName )
1175+ var nativeInspect []map [string ]interface {}
1176+ err := json .Unmarshal (nativeResp , & nativeInspect )
1177+ Expect (err ).Should (BeNil ())
1178+ Expect (nativeInspect ).Should (HaveLen (1 ))
1179+
1180+ spec , ok := nativeInspect [0 ]["Spec" ].(map [string ]interface {})
1181+ Expect (ok ).Should (BeTrue ())
1182+ linux , ok := spec ["linux" ].(map [string ]interface {})
1183+ Expect (ok ).Should (BeTrue ())
1184+ namespaces , ok := linux ["namespaces" ].([]interface {})
1185+ Expect (ok ).Should (BeTrue ())
1186+
1187+ // For private IPC mode, verify IPC namespace is present
1188+ foundIpcNamespace := false
1189+ for _ , ns := range namespaces {
1190+ namespace := ns .(map [string ]interface {})
1191+ if namespace ["type" ] == "ipc" {
1192+ foundIpcNamespace = true
1193+ break
1194+ }
1195+ }
1196+ Expect (foundIpcNamespace ).Should (BeTrue ())
1197+ })
1198+
1199+ It ("should create a container with privileged mode" , func () {
1200+ // Define options
1201+ options .Cmd = []string {"sleep" , "Infinity" }
1202+ options .HostConfig .Privileged = true
1203+
1204+ // Create container
1205+ statusCode , ctr := createContainer (uClient , url , testContainerName , options )
1206+ Expect (statusCode ).Should (Equal (http .StatusCreated ))
1207+ Expect (ctr .ID ).ShouldNot (BeEmpty ())
1208+
1209+ // Start container
1210+ command .Run (opt , "start" , testContainerName )
1211+
1212+ // Inspect the container using native format
1213+ nativeResp := command .Stdout (opt , "inspect" , "--mode=native" , testContainerName )
1214+ var nativeInspect []map [string ]interface {}
1215+ err := json .Unmarshal (nativeResp , & nativeInspect )
1216+ Expect (err ).Should (BeNil ())
1217+ Expect (nativeInspect ).Should (HaveLen (1 ))
1218+
1219+ // Navigate to the process capabilities section
1220+ spec , ok := nativeInspect [0 ]["Spec" ].(map [string ]interface {})
1221+ Expect (ok ).Should (BeTrue ())
1222+ process , ok := spec ["process" ].(map [string ]interface {})
1223+ Expect (ok ).Should (BeTrue ())
1224+ capabilities , ok := process ["capabilities" ].(map [string ]interface {})
1225+ Expect (ok ).Should (BeTrue ())
1226+
1227+ // Verify privileged capabilities
1228+ // In privileged mode, the container should have extensive capabilities
1229+ expectedCaps := []string {
1230+ "CAP_SYS_ADMIN" ,
1231+ "CAP_NET_ADMIN" ,
1232+ "CAP_SYS_MODULE" ,
1233+ }
1234+
1235+ for _ , capType := range []string {"bounding" , "effective" , "permitted" } {
1236+ caps , ok := capabilities [capType ].([]interface {})
1237+ Expect (ok ).Should (BeTrue ())
1238+ capsList := make ([]string , len (caps ))
1239+ for i , cap := range caps {
1240+ capsList [i ] = cap .(string )
1241+ }
1242+ for _ , expectedCap := range expectedCaps {
1243+ Expect (capsList ).Should (ContainElement (expectedCap ))
1244+ }
1245+ }
1246+
1247+ // Also verify that devices are allowed in privileged mode
1248+ linux , ok := spec ["linux" ].(map [string ]interface {})
1249+ Expect (ok ).Should (BeTrue ())
1250+ resources , ok := linux ["resources" ].(map [string ]interface {})
1251+ Expect (ok ).Should (BeTrue ())
1252+ devices , ok := resources ["devices" ].([]interface {})
1253+ Expect (ok ).Should (BeTrue ())
1254+
1255+ // In privileged mode, there should be a device rule that allows all devices
1256+ foundAllowAllDevices := false
1257+ for _ , device := range devices {
1258+ dev := device .(map [string ]interface {})
1259+ if dev ["allow" ] == true && dev ["access" ] == "rwm" {
1260+ if _ , hasType := dev ["type" ]; ! hasType {
1261+ foundAllowAllDevices = true
1262+ break
1263+ }
1264+ }
1265+ }
1266+ Expect (foundAllowAllDevices ).Should (BeTrue ())
1267+ })
11291268 })
11301269}
11311270
0 commit comments