26 lines
1.6 KiB
Bash
26 lines
1.6 KiB
Bash
#!/bin/bash
|
|
set -Eeuo pipefail
|
|
image_id=$(docker image inspect --format '{{.Id}}' "$1")
|
|
expected_version=$(docker image inspect --format '{{index .Config.Labels "dsh-mgr.version"}}' "$image_id")
|
|
[[ -n "$expected_version" && "$expected_version" != '<no value>' ]] || { echo 'FAIL: missing version label.' >&2; exit 1; }
|
|
container_id=$(docker run -d --read-only --cap-drop ALL --security-opt no-new-privileges --memory 2g --cpus 2 --pids-limit 256 --tmpfs /tmp:rw,exec,nosuid,nodev,size=256m --tmpfs /data/dsh-home:rw,uid=1000,gid=1000,size=512m --tmpfs /workspace:rw,uid=1000,gid=1000,size=64m "$image_id")
|
|
cleanup() { docker rm -f "$container_id" >/dev/null; }
|
|
trap cleanup EXIT
|
|
for ((attempt=0; attempt<60; attempt++)); do
|
|
if [[ $(docker inspect --format '{{.State.Running}}' "$container_id") != true ]]; then
|
|
echo 'FAIL: runtime exited before readiness.' >&2
|
|
exit 1
|
|
fi
|
|
if docker logs "$container_id" 2>&1 | grep 'dsh web:.*token=' >/dev/null; then
|
|
docker exec "$container_id" node -e 'fetch("http://127.0.0.1:8080/").then(r=>{console.log("Proxy HTTP status:",r.status);process.exit(r.status>=500?1:0)}).catch(()=>process.exit(1))'
|
|
actual_version=$(docker exec "$container_id" dsh --version)
|
|
[[ "$actual_version" == "$expected_version" ]] || { echo 'FAIL: CLI version does not match image label.' >&2; exit 1; }
|
|
printf 'Verified DSH version: %s\n' "$actual_version"
|
|
echo 'PASS: readiness under read-only rootfs, non-root and dropped capabilities.'
|
|
exit 0
|
|
fi
|
|
sleep 1
|
|
done
|
|
echo 'FAIL: readiness timeout; credential-bearing logs were not printed.' >&2
|
|
exit 1
|