alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

tests: verify exec traffic is policy-checked in caps proxy test

Browse Source 
Extend testBuildPolicyCapsProxy so that instead of only checking that
the network proxy was enabled, the build runs a command that makes an
HTTP request to a local test server. The policy denies that URL as an
HTTP source, so the test now verifies that exec traffic actually flows
through the proxy and is subject to source policy, including the deny
message and DENY decision in the build output.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
This commit is contained in:
Tonis Tiigi
2026-06-10 08:58:48 -07:00
parent 4da04e3bf4
commit 25db0fb050
1 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/policy_build.go
+22 -9
View File
@@ -44,27 +44,37 @@ var policyBuildTests = []func(t *testing.T, sb integration.Sandbox){
testBuildPolicyCapsProxyUnsupported,
}
var policyCapsProxyFile = []byte(`
func policyCapsProxyFile(serverURL string) []byte {
return fmt.Appendf(nil, `
package docker
default allow = true
default deny_msg := []
default caps := {}
caps := {"exec.proxy": true} if input.env.capsRequest
decision := {"allow": allow, "caps": caps}
`)
allow := false if input.http.url == "%s/file"
deny_msg := ["exec proxy http source denied by policy"] if input.http.url == "%s/file"
decision := {"allow": allow, "deny_msg": deny_msg, "caps": caps}
`, serverURL, serverURL)
}
func testBuildPolicyCapsProxy(t *testing.T, sb integration.Sandbox) {
if buildkitTag() != "master" {
skipNoCompatBuildKit(t, sb, ">= 0.31.0-0", "network proxy requires BuildKit v0.31.0+")
}
resp := &httpserver.Response{Content: []byte("policy-caps-proxy")}
server := httpserver.NewTestServer(map[string]*httpserver.Response{
"/file": resp,
})
defer server.Close()
dockerfile := []byte(`
FROM scratch
COPY foo /foo
FROM busybox:latest
RUN wget -O- ` + server.URL + `/file
`)
dir := tmpdir(
t,
fstest.CreateFile("Dockerfile", dockerfile, 0600),
fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
fstest.CreateFile("foo", []byte("foo"), 0600),
fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(server.URL), 0600),
)
cmd := buildxCmd(sb, withDir(dir), withArgs(
@@ -74,8 +84,11 @@ COPY foo /foo
dir,
))
out, err := cmd.CombinedOutput()
require.NoError(t, err, string(out))
require.Error(t, err, string(out))
require.Contains(t, string(out), "policy enabled network proxy")
require.Contains(t, string(out), "exec proxy http source denied by policy")
require.Contains(t, string(out), "policy decision for source "+server.URL+"/file")
require.Contains(t, string(out), "DENY")
}
func testBuildPolicyCapsProxyUnsupported(t *testing.T, sb integration.Sandbox) {
@@ -90,7 +103,7 @@ COPY foo /foo
dir := tmpdir(
t,
fstest.CreateFile("Dockerfile", dockerfile, 0600),
fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile, 0600),
fstest.CreateFile("Dockerfile.rego", policyCapsProxyFile(""), 0600),
fstest.CreateFile("foo", []byte("foo"), 0600),
)