nordisk/heimdall

scripts/trace-tests.sh

#!/bin/sh
# SPDX-License-Identifier: AGPL-3.0-only
# heimdall-trace kernel tests (the #[ignore]d tests in
# crates/heimdall-trace/tests/kernel.rs): real dynamic-trace jobs in
# HeimdallRunner containers. Heimdall is a defensive sandbox; the packages
# these tests trace are their own fixtures and attack only their own job.
#
# On the host: builds the worker image (crates/heimdall-trace/tests/worker,
# node + npm + python3 + pip, needs the network once) unless the OCI layout
# already exists, exports it as an OCI image layout, then runs the tests in a
# privileged toolchain container (rootless podman is enough), like
# scripts/container-tests.sh. Inside: delegates the cgroup controllers,
# builds the heimdall-container shim and the static tracer (musl), runs
#   cargo test -p nordisk-heimdall-trace --test kernel -- --ignored
#
# Environment:
#   HEIMDALL_TEST_IMAGE   toolchain image with libseccomp-dev and the musl target
#                         (default localhost/nordisk-cargo-toolchain:heim-m0)
#   HEIMDALL_TRACE_LAYOUT the worker image's OCI layout (default
#                         $CARGO_TARGET_DIR/trace-worker/layout; rebuilt when missing)
#   CARGO_TARGET_DIR, CARGO_HOME as in scripts/container-tests.sh
#   HEIMDALL_TRACE_TEST_ARGS  extra arguments after `--` (e.g. a test name)
set -eu
cd "$(dirname "$0")/.."

if [ "${HEIMDALL_CONTAINER_INNER:-}" != 1 ]; then
  img=${HEIMDALL_TEST_IMAGE:-localhost/nordisk-cargo-toolchain:heim-m0}
  tgt=${CARGO_TARGET_DIR:-$PWD/target}
  lay=${HEIMDALL_TRACE_LAYOUT:-$tgt/trace-worker/layout}
  mkdir -p "$tgt"
  if [ ! -f "$lay.digest" ] || [ ! -f "$lay/index.json" ]; then
    podman build --network host -t localhost/heimdall-trace-worker:test \
      crates/heimdall-trace/tests/worker
    mkdir -p "$(dirname "$lay")"
    rm -f "$lay.digest"
    podman push --digestfile "$lay.digest" localhost/heimdall-trace-worker:test "oci:$lay:worker"
  fi
  base=$(cat "$lay.digest")
  extra=""
  if [ -n "${CARGO_HOME:-}" ]; then extra="-v $CARGO_HOME:/ch -e CARGO_HOME=/ch"; fi
  # shellcheck disable=SC2086
  exec podman run --rm --privileged --cgroupns=private \
    -v "$PWD":/src -v "$tgt":/tgt -e CARGO_TARGET_DIR=/tgt -v "$lay":/layout $extra \
    -e HEIMDALL_CONTAINER_INNER=1 -e HEIMDALL_TRACE_LAYOUT=/layout -e HEIMDALL_TRACE_BASE="$base" \
    -e HEIMDALL_TRACE_TEST_ARGS="${HEIMDALL_TRACE_TEST_ARGS:-}" \
    -e CARGO_BUILD_JOBS="${CARGO_BUILD_JOBS:-8}" \
    -w /src "$img" scripts/trace-tests.sh
fi

# Inside the container: leave the root cgroup, enable the controllers.
cg=/sys/fs/cgroup
if [ ! -w "$cg/cgroup.subtree_control" ]; then
  echo "cgroup v2 is not writable here (need --privileged and cgroup v2)" >&2
  exit 2
fi
mkdir -p "$cg/init"
for p in $(cat "$cg/cgroup.procs"); do echo "$p" > "$cg/init/cgroup.procs" 2>/dev/null || true; done
for c in cpu memory pids; do
  if grep -qw "$c" "$cg/cgroup.controllers"; then
    echo "+$c" > "$cg/cgroup.subtree_control"
  else
    echo "controller $c is not delegated to this container" >&2
    exit 2
  fi
done
echo "controllers enabled: $(cat "$cg/cgroup.subtree_control")"

cargo build -p nordisk-heimdall-container --features youki --bins
cargo build --release --target x86_64-unknown-linux-musl -p nordisk-heimdall-trace --bin heimdall-trace
# shellcheck disable=SC2086
HEIMDALL_CONTAINER_SHIM="$CARGO_TARGET_DIR/debug/heimdall-container-shim" \
HEIMDALL_TRACE_TRACER="$CARGO_TARGET_DIR/x86_64-unknown-linux-musl/release/heimdall-trace" \
  cargo test -p nordisk-heimdall-trace --test kernel -- --ignored --test-threads=3 ${HEIMDALL_TRACE_TEST_ARGS:-}