Skip to content

Commit 6af1b97

Browse files
vincentkocvincentkoc
committed
fix(e2e): validate docker pids limits
1 parent 4ca0e52 commit 6af1b97

3 files changed

Lines changed: 99 additions & 3 deletions

File tree

‎scripts/lib/docker-e2e-container.sh‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ docker_e2e_docker_cmd() {
141141
local timeout_value="${DOCKER_COMMAND_TIMEOUT:-600s}"
142142
if [ "${1:-}" = "run" ]; then
143143
shift
144-
docker_e2e_docker_run_resource_args "$@"
144+
docker_e2e_docker_run_resource_args "$@" || return $?
145145
if [ "${#DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" -gt 0 ]; then
146146
docker_e2e_timeout_cmd "$timeout_value" docker run "${DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" "$@"
147147
else
@@ -156,7 +156,7 @@ docker_e2e_docker_run_cmd() {
156156
local timeout_value="${DOCKER_COMMAND_TIMEOUT:-${OPENCLAW_DOCKER_E2E_RUN_TIMEOUT:-3600s}}"
157157
if [ "${1:-}" = "run" ]; then
158158
shift
159-
docker_e2e_docker_run_resource_args "$@"
159+
docker_e2e_docker_run_resource_args "$@" || return $?
160160
if [ "${#DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" -gt 0 ]; then
161161
docker_e2e_timeout_cmd "$timeout_value" docker run "${DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" "$@"
162162
else
@@ -229,6 +229,15 @@ docker_e2e_run_arg_present() {
229229
return 1
230230
}
231231

232+
docker_e2e_resolve_pids_limit() {
233+
local pids_limit="$1"
234+
if [[ ! "$pids_limit" =~ ^[0-9]+$ ]] || (( 10#$pids_limit < 1 )); then
235+
echo "invalid OPENCLAW_DOCKER_E2E_PIDS_LIMIT: $pids_limit" >&2
236+
return 2
237+
fi
238+
printf '%s\n' "$((10#$pids_limit))"
239+
}
240+
232241
docker_e2e_docker_run_resource_args() {
233242
DOCKER_E2E_RUN_RESOURCE_ARGS=()
234243
if docker_e2e_resource_limits_disabled; then
@@ -247,6 +256,7 @@ docker_e2e_docker_run_resource_args() {
247256
DOCKER_E2E_RUN_RESOURCE_ARGS+=(--cpus "$cpus")
248257
fi
249258
if ! docker_e2e_resource_value_disabled "$pids_limit" && ! docker_e2e_run_arg_present --pids-limit "$@"; then
259+
pids_limit="$(docker_e2e_resolve_pids_limit "$pids_limit")" || return $?
250260
DOCKER_E2E_RUN_RESOURCE_ARGS+=(--pids-limit "$pids_limit")
251261
fi
252262
}

‎scripts/lib/docker-e2e-package.sh‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,15 @@ if ! declare -F docker_e2e_docker_run_resource_args >/dev/null 2>&1; then
7676
return 1
7777
}
7878

79+
docker_e2e_resolve_pids_limit() {
80+
local pids_limit="$1"
81+
if [[ ! "$pids_limit" =~ ^[0-9]+$ ]] || (( 10#$pids_limit < 1 )); then
82+
echo "invalid OPENCLAW_DOCKER_E2E_PIDS_LIMIT: $pids_limit" >&2
83+
return 2
84+
fi
85+
printf '%s\n' "$((10#$pids_limit))"
86+
}
87+
7988
docker_e2e_docker_run_resource_args() {
8089
DOCKER_E2E_RUN_RESOURCE_ARGS=()
8190
if docker_e2e_resource_limits_disabled; then
@@ -94,6 +103,7 @@ if ! declare -F docker_e2e_docker_run_resource_args >/dev/null 2>&1; then
94103
DOCKER_E2E_RUN_RESOURCE_ARGS+=(--cpus "$cpus")
95104
fi
96105
if ! docker_e2e_resource_value_disabled "$pids_limit" && ! docker_e2e_run_arg_present --pids-limit "$@"; then
106+
pids_limit="$(docker_e2e_resolve_pids_limit "$pids_limit")" || return $?
97107
DOCKER_E2E_RUN_RESOURCE_ARGS+=(--pids-limit "$pids_limit")
98108
fi
99109
}
@@ -102,7 +112,7 @@ if ! declare -F docker_e2e_docker_run_cmd >/dev/null 2>&1; then
102112
docker_e2e_docker_run_cmd() {
103113
if [ "${1:-}" = "run" ]; then
104114
shift
105-
docker_e2e_docker_run_resource_args "$@"
115+
docker_e2e_docker_run_resource_args "$@" || return $?
106116
if declare -F docker_e2e_timeout_cmd >/dev/null 2>&1; then
107117
if [ "${#DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" -gt 0 ]; then
108118
docker_e2e_timeout_cmd "${DOCKER_COMMAND_TIMEOUT:-${OPENCLAW_DOCKER_E2E_RUN_TIMEOUT:-3600s}}" docker run "${DOCKER_E2E_RUN_RESOURCE_ARGS[@]}" "$@"

‎test/scripts/docker-build-helper.test.ts‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1114,6 +1114,40 @@ OPENCLAW_DOCKER_E2E_DISABLE_RESOURCE_LIMITS=1 docker_e2e_docker_cmd run demo
11141114
}
11151115
});
11161116

1117+
it("rejects invalid Docker run pids limits before invoking docker", () => {
1118+
const workDir = mkdtempSync(join(tmpdir(), "openclaw-docker-resource-pids-"));
1119+
1120+
try {
1121+
const rootDir = process.cwd();
1122+
const script = `
1123+
set -euo pipefail
1124+
ROOT_DIR=${shellQuote(rootDir)}
1125+
TMPDIR=${shellQuote(workDir)}
1126+
export ROOT_DIR TMPDIR
1127+
1128+
docker() {
1129+
printf invoked >"$TMPDIR/docker-seen"
1130+
}
1131+
export -f docker
1132+
1133+
source "$ROOT_DIR/scripts/lib/docker-e2e-container.sh"
1134+
1135+
set +e
1136+
OPENCLAW_DOCKER_E2E_PIDS_LIMIT=many docker_e2e_docker_cmd run demo 2>"$TMPDIR/stderr"
1137+
status="$?"
1138+
set -e
1139+
1140+
[[ "$status" = "2" ]]
1141+
[[ "$(<"$TMPDIR/stderr")" = *"invalid OPENCLAW_DOCKER_E2E_PIDS_LIMIT: many"* ]]
1142+
[[ ! -e "$TMPDIR/docker-seen" ]]
1143+
`;
1144+
1145+
execFileSync("bash", ["-lc", script], { encoding: "utf8" });
1146+
} finally {
1147+
rmSync(workDir, { recursive: true, force: true });
1148+
}
1149+
});
1150+
11171151
for (const [shellSignal, expectedStatus] of [
11181152
["TERM", "143"],
11191153
["HUP", "129"],
@@ -1324,6 +1358,48 @@ stderr="$(<"$TMPDIR/stderr")"
13241358
}
13251359
});
13261360

1361+
it("rejects invalid package-backed Docker run pids limits before invoking docker", () => {
1362+
const workDir = mkdtempSync(join(tmpdir(), "openclaw-docker-package-pids-"));
1363+
1364+
try {
1365+
const rootDir = process.cwd();
1366+
const script = `
1367+
set -euo pipefail
1368+
ROOT_DIR=${shellQuote(rootDir)}
1369+
TMPDIR=${shellQuote(workDir)}
1370+
export ROOT_DIR TMPDIR
1371+
1372+
dirname() {
1373+
/usr/bin/dirname "$@"
1374+
}
1375+
1376+
docker_e2e_docker_cmd() {
1377+
return 0
1378+
}
1379+
1380+
docker() {
1381+
printf invoked >"$TMPDIR/docker-seen"
1382+
}
1383+
export -f docker_e2e_docker_cmd docker
1384+
1385+
source "$ROOT_DIR/scripts/lib/docker-e2e-package.sh"
1386+
1387+
set +e
1388+
OPENCLAW_DOCKER_E2E_PIDS_LIMIT=many docker_e2e_docker_run_cmd run demo 2>"$TMPDIR/stderr"
1389+
status="$?"
1390+
set -e
1391+
1392+
[[ "$status" = "2" ]]
1393+
[[ "$(<"$TMPDIR/stderr")" = *"invalid OPENCLAW_DOCKER_E2E_PIDS_LIMIT: many"* ]]
1394+
[[ ! -e "$TMPDIR/docker-seen" ]]
1395+
`;
1396+
1397+
execFileSync("bash", ["-lc", script], { encoding: "utf8" });
1398+
} finally {
1399+
rmSync(workDir, { recursive: true, force: true });
1400+
}
1401+
});
1402+
13271403
it("uses gtimeout for package-backed Docker runs without the shared timeout helper", () => {
13281404
const workDir = mkdtempSync(join(tmpdir(), "openclaw-docker-package-gtimeout-"));
13291405

0 commit comments

Comments
 (0)