nordisk/edda

crates/jera/tests/container_sandbox.rs

//! A `Container` payload can carry a SANDBOX (lane RELBUILD-RUNA, 2026-10-29): the
//! sealed-container shape a Runa `Sandbox` step lowers to (only the named mounts, tmpfs,
//! no network unless asked, the workdir). Additive: a payload written before it existed
//! still reads, and a payload without one serialises exactly as before.

use jera::agent::{ContainerRun, ContainerSandbox, WorkPayload};

#[test]
fn an_old_container_payload_still_reads_and_has_no_sandbox() {
    let old = r#"{"kind":"container","image":"alpine:3","cmd":["true"],"env":{}}"#;
    let p: WorkPayload = serde_json::from_str(old).unwrap();
    let WorkPayload::Container(c) = &p else { panic!() };
    assert_eq!(c.sandbox, None);
    assert_eq!(serde_json::to_string(&p).unwrap(), old, "byte-identical when no sandbox is named");
}

#[test]
fn a_sandboxed_container_round_trips() {
    let c = ContainerRun {
        image: "localhost/x@sha256:00".into(),
        cmd: vec!["cargo".into(), "vendor".into()],
        sandbox: Some(ContainerSandbox {
            binds: vec!["/srv/r/src:/src:ro".into(), "/srv/r/out:/out".into()],
            tmpfs: vec!["/tmp:rw,size=1024m,mode=1777".into()],
            network: true,
            workdir: "/src".into(),
        }),
        ..Default::default()
    };
    let p = WorkPayload::Container(c.clone());
    let back: WorkPayload = serde_json::from_str(&serde_json::to_string(&p).unwrap()).unwrap();
    assert_eq!(back, p);
}