Publish curated Unraid-AppOps-Gateway source from 1350d8bf6527e085bbfa950ec0d1ee3e973d618e

backend/tests/test_runner_resource_envelope.py

@@ -484,8 +484,7 @@ def test_host_probe_contract_is_bounded_and_never_mounts_host_proc_or_docker_soc
     assert args[-3:] == [image_id, "/opt/gitea-deploy/runner_resource_envelope.py", "--host-probe"]
 
 
-def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
-    envelope = _module()
+def _host_probe_fixture(envelope):
     image_id = "sha256:" + "a" * 64
     code_source = f"{envelope._HOST_VOLUME_ROOT}/controller-artifacts/{'c' * 40}"
     base = {
@@ -552,6 +551,12 @@ def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
         ],
     }
 
+    return base, image_id, code_source
+
+
+def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
+    envelope = _module()
+    base, image_id, code_source = _host_probe_fixture(envelope)
     assert envelope._validate_host_probe_inspect(
         base, mode="snapshot", image_id=image_id, code_source=code_source
     )
@@ -614,6 +619,115 @@ def test_host_probe_inspection_rejects_namespace_mount_and_resource_drift():
         )
 
 
+@pytest.mark.parametrize("mode", ["snapshot", "family", "ensure", "rollback"])
+def test_inherited_image_labels_are_exact_and_owned_probe_cleanup_is_bounded(monkeypatch, mode):
+    envelope = _module()
+    probe, image_id, code_source = _host_probe_fixture(envelope)
+    inherited = {"io.buildah.version": "1.35.0", "org.opencontainers.image.title": "Official runner image"}
+    probe["Config"]["Labels"].update(inherited)
+    rw = mode in {"ensure", "rollback"}
+    source = "/sys/fs/cgroup/itworx-ci" if mode == "snapshot" else "/sys/fs/cgroup"
+    probe["Mounts"][0].update(Source=source, RW=rw)
+    probe["HostConfig"]["Mounts"][0].update(Source=source, ReadOnly=not rw)
+    probe["HostConfig"]["CapAdd"] = ["DAC_OVERRIDE"] if rw else []
+    assert envelope._validate_host_probe_inspect(
+        probe, mode=mode, image_id=image_id, code_source=code_source, image_labels=inherited
+    )
+    for mutate in (
+        lambda item: item["Config"]["Labels"].update(unknown="extra"),
+        lambda item: item["Config"]["Labels"].update({"org.opencontainers.image.title": "changed"}),
+        lambda item: item["Config"]["Labels"].pop("io.buildah.version"),
+        lambda item: item["Config"]["Labels"].update({"tech.itworx.owner": "foreign"}),
+        lambda item: item.update(Image="sha256:" + "f" * 64),
+    ):
+        candidate = copy.deepcopy(probe)
+        mutate(candidate)
+        assert not envelope._validate_host_probe_inspect(
+            candidate, mode=mode, image_id=image_id, code_source=code_source, image_labels=inherited
+        )
+    monkeypatch.setattr(envelope, "_host_probe_image_labels", lambda _: inherited)
+    inspected = iter([probe, copy.deepcopy(probe), None])
+    monkeypatch.setattr(envelope, "_inspect_host_probe_by_name", lambda: next(inspected))
+    calls = []
+    monkeypatch.setattr(envelope, "_run", lambda args, **kw: calls.append(args))
+    assert envelope.cleanup_stopped_host_probe(image_id=image_id, code_source=code_source)
+    assert calls == [["docker", "rm", probe["Id"]]]
+
+
+@pytest.mark.parametrize("drift", ["running", "foreign_source", "race", "missing_state"])
+def test_probe_cleanup_refuses_foreign_running_or_changed_identity(monkeypatch, drift):
+    envelope = _module()
+    probe, image_id, code_source = _host_probe_fixture(envelope)
+    fresh = copy.deepcopy(probe)
+    if drift == "running":
+        probe["State"]["Running"] = True
+    elif drift == "foreign_source":
+        probe["Mounts"][1]["Source"] = code_source.replace("c" * 40, "d" * 40)
+    elif drift == "race":
+        fresh["Id"] = "f" * 64
+    else:
+        probe.pop("State")
+    monkeypatch.setattr(envelope, "_host_probe_image_labels", lambda _: {})
+    inspected = iter([probe, fresh])
+    monkeypatch.setattr(envelope, "_inspect_host_probe_by_name", lambda: next(inspected))
+    monkeypatch.setattr(envelope, "_run", lambda *a, **kw: pytest.fail("No removal or probe execution"))
+    with pytest.raises(RuntimeError, match="resource_cgroup_probe_cleanup_identity_"):
+        envelope.cleanup_stopped_host_probe(image_id=image_id, code_source=code_source)
+
+
+@pytest.mark.parametrize("labels", [None, {}, {"org.opencontainers.image.title": "runner"}])
+def test_probe_label_metadata_comes_from_exact_image(monkeypatch, labels):
+    envelope = _module()
+    image_id = "sha256:" + "a" * 64
+    calls = []
+    def run(args, **kw):
+        calls.append(args)
+        return json.dumps([{"Id": image_id, "Config": {"Labels": labels}}])
+    monkeypatch.setattr(envelope, "_run", run)
+    assert envelope._host_probe_image_labels(image_id) == (labels or {})
+    assert calls == [["docker", "image", "inspect", image_id]]
+
+
+@pytest.mark.parametrize("row", [
+    {"Id": "sha256:" + "b" * 64, "Config": {"Labels": {}}},
+    {"Id": "sha256:" + "a" * 64, "Config": {"Labels": ["foreign"]}},
+    {"Id": "sha256:" + "a" * 64, "Config": {"Labels": {"secret-canary": 123}}},
+    {"Id": "sha256:" + "a" * 64, "Config": {"Labels": {"tech.itworx.owner": "foreign"}}},
+])
+def test_probe_image_metadata_rejects_drift_without_echo(monkeypatch, row):
+    envelope = _module()
+    monkeypatch.setattr(envelope, "_run", lambda *a, **kw: json.dumps([row]))
+    with pytest.raises(RuntimeError, match="^resource_cgroup_probe_image_labels_invalid$"):
+        envelope._host_probe_image_labels("sha256:" + "a" * 64)
+
+
+def test_normal_probe_executes_and_removes_its_image_label_bound_container(monkeypatch):
+    envelope = _module()
+    probe, image_id, code_source = _host_probe_fixture(envelope)
+    inherited = {"org.opencontainers.image.title": "Official runner image"}
+    probe["Config"]["Labels"].update(inherited)
+    monkeypatch.setattr(envelope, "_controller_runtime_identity", lambda: (image_id, code_source))
+    monkeypatch.setattr(envelope, "_host_probe_image_labels", lambda _: inherited)
+    monkeypatch.setattr(envelope, "_inspect_host_probe_by_name", lambda: None)
+    calls = []
+    def run(args, **kw):
+        calls.append(args)
+        if args[:2] == ["docker", "create"]:
+            return probe["Id"]
+        if args[:2] == ["docker", "inspect"]:
+            return json.dumps([probe])
+        assert args == ["docker", "rm", probe["Id"]]
+        return ""
+    def start(args, **kw):
+        assert args == ["docker", "start", "--attach", "--interactive", probe["Id"]]
+        assert json.loads(kw["input"]) == {"op": "snapshot"}
+        return SimpleNamespace(returncode=0, stdout=b'{"ready":true,"result":{"verified":true}}')
+    monkeypatch.setattr(envelope, "_run", run)
+    monkeypatch.setattr(envelope.subprocess, "run", start)
+    assert envelope._run_host_probe("snapshot") == {"verified": True}
+    assert calls[-1] == ["docker", "rm", probe["Id"]]
+
+
 def test_host_probe_image_and_source_come_from_verified_running_controller(monkeypatch):
     envelope = _module()
     revision = "d" * 40