Disable docker image download (#240)

dnestoro · web-flow · commit 9be6c331882a · 2023-03-21T16:17:54.000+01:00
* Disable docker image download * Add tests and docs * Add image vulnerability scanning * Add grype scanning into workflows * Refactoring * Change nginx version to one with less vurnelabilities * test docker image for jakarta.mail * Change opengauss image and remove ryuk * Replace runtime.exec with ExecOperations and disable Testcontainers test * Comment whole Testcontainers test * Disable testcontainers test * Remove @disabled * Add link to ryuk issue * Replace port number * Fix docs and grammar issues * Enable discard service with inetd * Add discard port to test-changed-metadata workflow
diff --git a/.github/workflows/discard-port.conf b/.github/workflows/discard-port.conf
@@ -0,0 +1,2 @@
+discard   stream  tcp     nowait  root    internal
+discard   dgram   udp     wait    root    internal
diff --git a/.github/workflows/dockerd.service b/.github/workflows/dockerd.service
@@ -0,0 +1,4 @@
+[Service]
+Environment="HTTP_PROXY=http://localhost:9"
+Environment="HTTPS_PROXY=https://localhost:9"
+Environment="NO_PROXY=localhost,127.0.0.1"
diff --git a/.github/workflows/scan-docker-images.yml b/.github/workflows/scan-docker-images.yml
@@ -0,0 +1,22 @@
+name: "Scan docker images from the allowed docker images list"
+
+on: [push, pull_request]
+
+jobs:
+  scan-images:
+    name: "🔎 Scan docker images"
+    runs-on: "ubuntu-20.04"
+    steps:
+      - name: "☁️ Checkout repository"
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - uses: graalvm/setup-graalvm@v1
+        with:
+          version: '22.3.1'
+          java-version: '17'
+      - name: "🔎 Check docker images"
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sudo sh -s -- -b /usr/local/bin
+          sudo apt-get install jq
+          ./gradlew checkAllowedDockerImages
diff --git a/.github/workflows/test-all-metadata.yml b/.github/workflows/test-all-metadata.yml
@@ -52,6 +52,18 @@ jobs:
           components: 'native-image'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
+      - name: "Pull allowed docker images"
+        run: |
+          ./gradlew pullAllowedDockerImages --coordinates=${{ matrix.coordinates }}
+      - name: "Disable docker"
+        run: |
+          sudo apt-get install openbsd-inetd
+          sudo bash -c "cat ./.github/workflows/discard-port.conf >> /etc/inetd.conf"
+          sudo systemctl start inetd
+          sudo mkdir /etc/systemd/system/docker.service.d
+          sudo bash -c "cat ./.github/workflows/dockerd.service > /etc/systemd/system/docker.service.d/http-proxy.conf"
+          sudo systemctl daemon-reload
+          sudo systemctl restart docker
       - name: "🧪 Run '${{ matrix.coordinates }}' tests"
         run: |
           ./gradlew test -Pcoordinates=${{ matrix.coordinates }}
diff --git a/.github/workflows/test-changed-metadata.yml b/.github/workflows/test-changed-metadata.yml
@@ -55,6 +55,18 @@ jobs:
           components: 'native-image'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
+      - name: "Pull allowed docker images"
+        run: |
+          ./gradlew pullAllowedDockerImages --coordinates=${{ matrix.coordinates }}
+      - name: "Disable docker"
+        run: |
+          sudo apt-get install openbsd-inetd
+          sudo bash -c "cat ./.github/workflows/discard-port.conf >> /etc/inetd.conf"
+          sudo systemctl start inetd
+          sudo mkdir /etc/systemd/system/docker.service.d
+          sudo bash -c "cat ./.github/workflows/dockerd.service > /etc/systemd/system/docker.service.d/http-proxy.conf"
+          sudo systemctl daemon-reload
+          sudo systemctl restart docker
       - name: "🧪 Run '${{ matrix.coordinates }}' tests"
         run: |
           ./gradlew test -Pcoordinates=${{ matrix.coordinates }}
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -196,6 +196,26 @@ In this example this can be done by invoking following command from the reposito
 ```bash
 ./gradlew test -Pcoordinates=org.example:library:0.0.1
 ```
+ 
+### Providing the tests that use docker
+ 
+If your tests use docker (either with explicit docker process invocation or through some library method call), all images 
+have to be declared in `required-docker-images.txt` file. This file must be placed under `/tests/src/<groupId>/<artifactId>/<versionId>`.
+
+Only docker images that are listed [here](https://github.com/oracle/graalvm-reachability-metadata/blob/master/tests/tck-build-logic/src/main/resources/AllowedDockerImages.txt)
+can be executed. If you want to extend this list, please create separate pull request to do that, and post the result of the following command on your pull request:
+
+```shell
+grype <dockerImageName>
+```
+
+Possible scenarios:
+   * If your test uses docker image, and you didn't specify it in the `required-docker-images.txt` file, the test will fail.
+   * If your test uses docker image that is not listed in [allowed docker images list](https://github.com/oracle/graalvm-reachability-metadata/blob/master/tests/tck-build-logic/src/main/resources/AllowedDockerImages.txt),
+   the test will fail
+   * Only docker images that are in both `required-docker-images.txt` and in the `allowed docker images list`
+   can be executed. 
+
 
 ## Tested Libraries and Frameworks
 
diff --git a/metadata/index.json b/metadata/index.json
@@ -240,5 +240,9 @@
   {
     "directory" : "jakarta.servlet/jakarta.servlet-api",
     "module" : "jakarta.servlet:jakarta.servlet-api"
+  },
+  {
+    "directory" : "samples/docker",
+    "module" : "samples:docker"
   }
 ]
diff --git a/metadata/samples/docker/image-pull/.gitkeep b/metadata/samples/docker/image-pull/.gitkeep
diff --git a/metadata/samples/docker/index.json b/metadata/samples/docker/index.json
@@ -0,0 +1,10 @@
+[
+  {
+    "latest": true,
+    "metadata-version": "image-pull",
+    "module": "samples:docker",
+    "tested-versions": [
+      "image-pull"
+    ]
+  }
+]
diff --git a/tests/src/com.mysql/mysql-connector-j/8.0.31/required-docker-images.txt b/tests/src/com.mysql/mysql-connector-j/8.0.31/required-docker-images.txt
@@ -0,0 +1 @@
+mysql/mysql-server:8.0
diff --git a/tests/src/com.sun.mail/jakarta.mail/2.0.1/required-docker-images.txt b/tests/src/com.sun.mail/jakarta.mail/2.0.1/required-docker-images.txt
@@ -0,0 +1 @@
+greenmail/standalone:2.0.0
diff --git a/tests/src/com.sun.mail/jakarta.mail/2.0.1/src/test/java/com/sun/mail/JakartaMailTest.java b/tests/src/com.sun.mail/jakarta.mail/2.0.1/src/test/java/com/sun/mail/JakartaMailTest.java
@@ -35,7 +35,7 @@ public class JakartaMailTest {
     static void beforeAll() throws IOException {
         System.out.println("Starting email server ...");
         new ProcessBuilder("docker", "run", "--cidfile", "greenmail.cid", "-p", "3025:3025", "--rm", "-e",
-                "GREENMAIL_OPTS=-Dgreenmail.setup.test.all -Dgreenmail.hostname=0.0.0.0 -Dgreenmail.auth.disabled -Dgreenmail.verbose", "greenmail/standalone:1.6.10")
+                "GREENMAIL_OPTS=-Dgreenmail.setup.test.all -Dgreenmail.hostname=0.0.0.0 -Dgreenmail.auth.disabled -Dgreenmail.verbose", "greenmail/standalone:2.0.0")
                 .redirectOutput(new File("greenmail-stdout.txt"))
                 .redirectError(new File("greenmail-stderr.txt")).start();
         Awaitility.await().atMost(Duration.ofSeconds(10)).until(() -> {
diff --git a/tests/src/index.json b/tests/src/index.json
@@ -636,5 +636,16 @@
         ]
       }
     ]
+  },
+  {
+    "test-project-path" : "samples/docker/image-pull",
+    "libraries" : [
+      {
+        "name" : "samples:docker",
+        "versions" : [
+          "image-pull"
+        ]
+      }
+    ]
   }
 ]
diff --git a/tests/src/mysql/mysql-connector-java/8.0.29/required-docker-images.txt b/tests/src/mysql/mysql-connector-java/8.0.29/required-docker-images.txt
@@ -0,0 +1 @@
+mysql/mysql-server:8.0
diff --git a/tests/src/org.mariadb.jdbc/mariadb-java-client/3.0.6/required-docker-images.txt b/tests/src/org.mariadb.jdbc/mariadb-java-client/3.0.6/required-docker-images.txt
@@ -0,0 +1 @@
+mariadb:10.8
diff --git a/tests/src/org.opengauss/opengauss-jdbc/3.1.0-og/required-docker-images.txt b/tests/src/org.opengauss/opengauss-jdbc/3.1.0-og/required-docker-images.txt
@@ -0,0 +1 @@
+opengauss/opengauss:3.1.0
diff --git a/tests/src/org.opengauss/opengauss-jdbc/3.1.0-og/src/test/java/org_opengauss/opengauss_jdbc/Opengauss_jdbcTest.java b/tests/src/org.opengauss/opengauss-jdbc/3.1.0-og/src/test/java/org_opengauss/opengauss_jdbc/Opengauss_jdbcTest.java
@@ -51,7 +51,7 @@ static void beforeAll() throws IOException {
         System.out.println("Starting OpenGauss ...");
         process = new ProcessBuilder(
                 "docker", "run", "--rm", "-p", "15432:5432", "-e", "GS_USERNAME=" + USERNAME,
-                "-e", "GS_PASSWORD=" + PASSWORD, "enmotech/opengauss:3.1.0")
+                "-e", "GS_PASSWORD=" + PASSWORD, "opengauss/opengauss:3.1.0")
                 .redirectOutput(new File("opengauss-stdout.txt")).redirectError(new File("opengauss-stderr.txt")).start();
         Awaitility.await().atMost(Duration.ofMinutes(1)).ignoreExceptions().until(() -> {
             openConnection().close();
diff --git a/tests/src/org.postgresql/postgresql/42.3.4/required-docker-images.txt b/tests/src/org.postgresql/postgresql/42.3.4/required-docker-images.txt
@@ -0,0 +1 @@
+postgres:15-alpine
diff --git a/tests/src/org.postgresql/postgresql/42.3.4/src/test/java/postgresql/PostgresqlTests.java b/tests/src/org.postgresql/postgresql/42.3.4/src/test/java/postgresql/PostgresqlTests.java
@@ -60,7 +60,7 @@ static void beforeAll() throws IOException {
         System.out.println("Starting PostgreSQL ...");
         process = new ProcessBuilder(
                 "docker", "run", "--rm", "-p", "5432:5432", "-e", "POSTGRES_DB=" + DATABASE, "-e", "POSTGRES_USER=" + USERNAME,
-                "-e", "POSTGRES_PASSWORD=" + PASSWORD, "postgres:14.2").redirectOutput(new File("postgres-stdout.txt"))
+                "-e", "POSTGRES_PASSWORD=" + PASSWORD, "postgres:15-alpine").redirectOutput(new File("postgres-stdout.txt"))
                 .redirectError(new File("postgres-stderr.txt")).start();
 
         // Wait until connection can be established
diff --git a/tests/src/org.testcontainers/testcontainers/1.17.6/required-docker-images.txt b/tests/src/org.testcontainers/testcontainers/1.17.6/required-docker-images.txt
@@ -0,0 +1 @@
+nginx:1-alpine-slim
diff --git a/tests/src/org.testcontainers/testcontainers/1.17.6/src/test/java/org_testcontainers/testcontainers/TestcontainersTest.java b/tests/src/org.testcontainers/testcontainers/1.17.6/src/test/java/org_testcontainers/testcontainers/TestcontainersTest.java
@@ -17,17 +17,32 @@
 
 import static org.assertj.core.api.Assertions.assertThat;
 
+// This test is pulling testcontainers/ryuk docker image version with many known vulnerabilities. It should be ignored until testcontainers change this image.
+// ISSUE: https://github.com/oracle/graalvm-reachability-metadata/issues/250
 class TestcontainersTest {
     private static final boolean DEBUG = false;
 
+    // DO NOT REMOVE THIS! READ THE COMMENT ABOVE THE CLASS
+    // tests should be disabled until testconatiners/ryuk is fixed
+    private static final boolean IS_DISABLED = true;
+
     @BeforeAll
     static void beforeAll() {
+        // DO NOT REMOVE THIS! READ THE COMMENT ABOVE THE CLASS
+        if (IS_DISABLED) {
+            return;
+        }
         System.setProperty("org.slf4j.simpleLogger.defaultLogLevel", DEBUG ? "debug" : "warn");
     }
 
     @Test
     void test() throws Exception {
-        try (GenericContainer<?> nginx = new GenericContainer<>("nginx:1.23")) {
+        // DO NOT REMOVE THIS! READ THE COMMENT ABOVE THE CLASS
+        if (IS_DISABLED) {
+            return;
+        }
+
+        try (GenericContainer<?> nginx = new GenericContainer<>("nginx:1-alpine-slim")) {
             nginx.withExposedPorts(80).start();
             HttpClient httpClient = HttpClient.newBuilder().build();
             String url = String.format("http://%s:%d", nginx.getHost(), nginx.getFirstMappedPort());
diff --git a/tests/src/samples/docker/image-pull/build.gradle b/tests/src/samples/docker/image-pull/build.gradle
@@ -0,0 +1,25 @@
+/*
+ * Copyright and related rights waived via CC0
+ *
+ * You should have received a copy of the CC0 legalcode along with this
+ * work. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+plugins {
+    id "org.graalvm.internal.tck"
+}
+
+tasks.withType(JavaCompile) {
+    options.release = 17
+}
+
+dependencies {
+    testImplementation 'org.assertj:assertj-core:3.22.0'
+}
+
+graalvmNative {
+    binaries {
+        test {
+            buildArgs.add('--no-fallback')
+        }
+    }
+}
diff --git a/tests/src/samples/docker/image-pull/gradle.properties b/tests/src/samples/docker/image-pull/gradle.properties
@@ -0,0 +1 @@
+metadata.dir = samples/docker/image-pull
diff --git a/tests/src/samples/docker/image-pull/required-docker-images.txt b/tests/src/samples/docker/image-pull/required-docker-images.txt
@@ -0,0 +1 @@
+mysql/mysql-server:8.0
diff --git a/tests/src/samples/docker/image-pull/settings.gradle b/tests/src/samples/docker/image-pull/settings.gradle
@@ -0,0 +1,14 @@
+pluginManagement {
+    def tckPath = Objects.requireNonNullElse(
+            System.getenv("GVM_TCK_TCKDIR"),
+            "../../../../tck-build-logic"
+    )
+    includeBuild(tckPath)
+}
+
+plugins {
+    id "org.graalvm.internal.tck-settings" version "1.0.0-SNAPSHOT"
+}
+
+rootProject.name = 'docker-image-pull-tests'
+
diff --git a/tests/src/samples/docker/image-pull/src/test/java/image/pull/DockerImagePullTests.java b/tests/src/samples/docker/image-pull/src/test/java/image/pull/DockerImagePullTests.java
@@ -0,0 +1,42 @@
+/*
+ * Copyright and related rights waived via CC0
+ *
+ * You should have received a copy of the CC0 legalcode along with this
+ * work. If not, see <http://creativecommons.org/publicdomain/zero/1.0/>.
+ */
+package image.pull;
+
+import java.io.File;
+import java.util.concurrent.TimeUnit;
+
+import org.junit.jupiter.api.Test;
+
+
+class DockerImagePullTests {
+
+    private void runImage(String image, boolean shouldSucceed) throws Exception {
+        Process process = new ProcessBuilder("docker", "run", image)
+                .redirectOutput(new File("hello-world-stdout.txt"))
+                .redirectError(new File("hello-world-stderr.txt")).start();
+
+        boolean finished = process.waitFor(5, TimeUnit.SECONDS);
+        int retCode = finished ? process.exitValue() : 0;
+        if (!shouldSucceed && retCode == 0) {
+            throw new IllegalStateException("Docker image should not be pulled successfully");
+        }
+
+        if (shouldSucceed && retCode != 0) {
+            throw new IllegalStateException("Docker image should be pulled successfully");
+        }
+    }
+
+    @Test
+    void pullAllowedImage() throws Exception {
+        runImage("mysql/mysql-server:8.0", true);
+    }
+
+    @Test
+    void pullNotAllowedImage() throws Exception {
+        runImage("hello-world", false);
+    }
+}
diff --git a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck-harness.gradle
@@ -10,10 +10,13 @@ plugins {
 }
 
 import groovy.json.JsonOutput
+import org.graalvm.internal.tck.DockerTask
 import org.graalvm.internal.tck.ScaffoldTask
+import org.graalvm.internal.tck.GrypeTask
 import org.graalvm.internal.tck.harness.tasks.CheckstyleInvocationTask
 import org.graalvm.internal.tck.harness.tasks.TestInvocationTask
 
+
 import static org.graalvm.internal.tck.Utils.generateTaskName
 
 logger.lifecycle("GraalVM Reachability Metadata TCK")
@@ -135,9 +138,20 @@ Provider<Task> generateMatrixDiffCoordinates = tasks.register("generateMatrixDif
     }
 }
 
+Provider<Task> getListOfDockerImages = tasks.register("checkAllowedDockerImages", GrypeTask.class) { task ->
+    task.setDescription("Returns list of allowed docker images")
+    task.setGroup(METADATA_GROUP)
+}
+
+
 tasks.register("scaffold", ScaffoldTask.class) { task ->
     task.setDescription("Creates a metadata and test scaffold for the given coordindates")
     task.setGroup(METADATA_GROUP)
     // Format JSON after task has been run
     task.finalizedBy("spotlessApply")
 }
+
+tasks.register("pullAllowedDockerImages", DockerTask.class) { task ->
+    task.setDescription("Pull allowed docker images from list.")
+    task.setGroup(METADATA_GROUP)
+}
diff --git a/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle b/tests/tck-build-logic/src/main/groovy/org.graalvm.internal.tck.gradle
@@ -69,6 +69,10 @@ dependencies {
 
 tasks.named('test') {
     useJUnitPlatform()
+    testLogging {
+        exceptionFormat = 'full'
+        showStackTraces = true
+    }
 }
 
 graalvmNative {
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/AbstractSubprojectTask.groovy
@@ -24,11 +24,11 @@ import javax.inject.Inject
 import java.nio.charset.StandardCharsets
 import java.nio.file.Path
 import java.util.stream.Collectors
+import static org.graalvm.internal.tck.Utils.splitCoordinates;
+import static org.graalvm.internal.tck.Utils.readIndexFile;
+import static org.graalvm.internal.tck.Utils.coordinatesMatch;
 
 import static groovy.io.FileType.FILES
-import static org.graalvm.internal.tck.Utils.coordinatesMatch
-import static org.graalvm.internal.tck.Utils.readIndexFile
-import static org.graalvm.internal.tck.Utils.splitCoordinates
 
 /**
  * Abstract task that is used to invoke test subprojects.
diff --git a/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TestInvocationTask.groovy b/tests/tck-build-logic/src/main/groovy/org/graalvm/internal/tck/harness/tasks/TestInvocationTask.groovy
@@ -13,9 +13,9 @@ import org.gradle.api.tasks.Input
 import javax.inject.Inject
 import java.nio.file.Path
 import java.util.stream.Collectors
+import static org.graalvm.internal.tck.Utils.splitCoordinates;
+import static org.graalvm.internal.tck.Utils.readIndexFile;
 
-import static org.graalvm.internal.tck.Utils.readIndexFile
-import static org.graalvm.internal.tck.Utils.splitCoordinates
 /**
  * Task that is used to start subproject tests.
  */
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/CoordinateUtils.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/CoordinateUtils.java
@@ -0,0 +1,15 @@
+package org.graalvm.internal.tck;
+
+public class CoordinateUtils {
+
+    public static String replace(String template, Coordinates coordinates) {
+        return template
+                .replace("$group$", coordinates.group())
+                .replace("$sanitizedGroup$", coordinates.sanitizedGroup())
+                .replace("$artifact$", coordinates.artifact())
+                .replace("$sanitizedArtifact$", coordinates.sanitizedArtifact())
+                .replace("$capitalizedSanitizedArtifact$", coordinates.capitalizedSanitizedArtifact())
+                .replace("$version$", coordinates.version());
+    }
+
+}
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerTask.java
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/ScaffoldTask.java
diff --git a/tests/tck-build-logic/src/main/resources/AllowedDockerImages.txt b/tests/tck-build-logic/src/main/resources/AllowedDockerImages.txt

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+discard stream tcp nowait root internal`
	`2`	`+discard dgram udp wait root internal`
Original file line number	Diff line number	Diff line change
`@@ -240,5 +240,9 @@`
`240`	`240`	`{`
`241`	`241`	`"directory" : "jakarta.servlet/jakarta.servlet-api",`
`242`	`242`	`"module" : "jakarta.servlet:jakarta.servlet-api"`
	`243`	`+ },`
	`244`	`+ {`
	`245`	`+ "directory" : "samples/docker",`
	`246`	`+ "module" : "samples:docker"`
`243`	`247`	`}`
`244`	`248`	`]`