Publish curated Unraid-AppOps-Gateway source from 07800de5cf3d27b80dbdebc13025bddeb58a07e3

backend/tests/test_ci_job_docker.py

@@ -548,3 +548,55 @@ def test_job_docker_daemon_command_uses_fixed_rootlesskit_and_unix_only_engine()
     assert "--storage-driver=overlay2" in daemon_args
     assert "--feature=containerd-snapshotter=false" in daemon_args
     assert "--data-root=/home/itworx-builder/.local/share/docker" in daemon_args
+
+
+def test_nested_build_subordinate_ranges_cover_mapped_nonroot_ids_only():
+    dockerfile = (ROOT / "ops/runner-task-images/build/Dockerfile").read_text()
+    assert "'ubuntu:1:999' 'ubuntu:1001:64536'" in dockerfile
+    assert "sed -i '/^ubuntu:/d'" in dockerfile
+    pins = json.loads((ROOT / "ops/runner-task-images/pins.json").read_text())
+    ranges = pins["jobLocalDocker"]["subordinateIdRanges"]
+    assert ranges == [{"start": 1, "count": 999}, {"start": 1001, "count": 64536}]
+    subordinate = {value for row in ranges for value in range(row["start"], row["start"] + row["count"])}
+    assert len(subordinate) == 65535
+    assert not {0, 1000} & subordinate
+    assert min(subordinate) == 1 and max(subordinate) == 65536
+    # All normal image IDs, including nobody=65534, fit in the inner namespace.
+    assert len(subordinate) >= 65534
+
+
+@pytest.mark.skipif(os.name == "nt", reason="rootless Docker wrapper is Linux-only")
+@pytest.mark.parametrize("bad", ["", "0 0 4294967295\n", "0 1000 1\n1 100000 65535\n",
+                               "0 1000 1\n100000 100000 65536\n", "SECRET-CANARY\n",
+                               "0 1000 1\n1 100000 65536\n2 2 1\n", "x" * 257])
+@pytest.mark.parametrize("kind", ["uid", "gid"])
+def test_private_engine_refuses_wrong_parent_mapping_before_runtime_effects(tmp_path, monkeypatch, bad, kind):
+    sys.path.insert(0, str(ROOT / "ops/runner-task-images/build"))
+    import job_docker
+    for name in ("uid", "gid"):
+        path = tmp_path / (name + "_map")
+        path.write_text(bad if name == kind else "0 1000 1\n1 100000 65536\n")
+        monkeypatch.setattr(job_docker, name.upper() + "_MAP_PATH", path)
+    effects = []
+    monkeypatch.setattr(job_docker, "_ensure_runtime", lambda: effects.append("runtime"))
+    monkeypatch.setattr(job_docker, "_launch_daemon", lambda: effects.append("daemon"))
+    with pytest.raises(job_docker.WrapperError) as caught:
+        job_docker._ensure_daemon()
+    assert str(caught.value) in {"private Docker parent ID mapping invalid",
+                                 "private Docker parent ID mapping unavailable"}
+    assert "SECRET-CANARY" not in str(caught.value)
+    assert effects == []
+
+
+@pytest.mark.skipif(os.name == "nt", reason="rootless Docker wrapper is Linux-only")
+def test_private_engine_accepts_own_supported_parent_maps_and_refuses_missing_map(tmp_path, monkeypatch):
+    sys.path.insert(0, str(ROOT / "ops/runner-task-images/build"))
+    import job_docker
+    for kind in ("uid", "gid"):
+        path = tmp_path / kind
+        path.write_text("         0       1000          1\n         1     100000      65536\n")
+        monkeypatch.setattr(job_docker, kind.upper() + "_MAP_PATH", path)
+    job_docker._validate_parent_id_maps()
+    job_docker.GID_MAP_PATH.unlink()
+    with pytest.raises(job_docker.WrapperError, match="mapping unavailable"):
+        job_docker._validate_parent_id_maps()