1. 1#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
2. 2
3. 3use std::path::PathBuf;
4. 4use std::process::Command;
5. 5use std::time::Duration;
6. 6
7. 7use vak_core::sandbox_docker::DockerSandbox;
8. 8use vak_tools::sandbox::SandboxMode;
9. 9
10. 10/// Run a command exactly like BashTool does: the sandbox wrapper goes
11. 11/// through one more shell layer.
12. 12fn run_wrapped(wrapped: &str, _timeout: Duration) -> (bool, String) {
13. 13 let out = Command::new("sh")
14. 14 .arg("-c")
15. 15 .arg(wrapped)
16. 16 .stdout(std::process::Stdio::piped())
17. 17 .stderr(std::process::Stdio::piped())
18. 18 .output();
19. 19 match out {
20. 20 Ok(o) => {
21. 21 let mut text = String::from_utf8_lossy(&o.stdout).into_owned();
22. 22 text.push_str(&String::from_utf8_lossy(&o.stderr));
23. 23 (o.status.success(), text)
24. 24 }
25. 25 Err(e) => (false, format!("spawn failed: {e}")),
26. 26 }
27. 27}
28. 28
29. 29fn ensure_image(image: &str) {
30. 30 let have = Command::new("docker")
31. 31 .args(["image", "inspect", image])
32. 32 .stdout(std::process::Stdio::null())
33. 33 .stderr(std::process::Stdio::null())
34. 34 .status()
35. 35 .map(|s| s.success())
36. 36 .unwrap_or(false);
37. 37 if !have {
38. 38 let pulled = Command::new("docker")
39. 39 .args(["pull", "-q", image])
40. 40 .status()
41. 41 .map(|s| s.success())
42. 42 .unwrap_or(false);
43. 43 assert!(pulled, "docker pull {image} failed");
44. 44 }
45. 45}
46. 46
47. 47#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
48. 48async fn docker_backend_executes_mounts_and_denies_network() {
49. 49 if !DockerSandbox::available() {
50. 50 println!("skipping: no reachable docker daemon");
51. 51 return;
52. 52 }
53. 53 let dir = tempfile::tempdir().unwrap();
54. 54 let ws: PathBuf = dir.path().to_path_buf();
55. 55 let sb = DockerSandbox::new(SandboxMode::WorkspaceWrite, None, &ws);
56. 56 ensure_image("alpine:3.20");
57. 57
58. 58 // 1. Execution inside the container.
59. 59 let (ok, out) = run_wrapped(
60. 60 &sb.wrap_command("echo container-alive"),
61. 61 Duration::from_secs(60),
62. 62 );
63. 63 assert!(ok, "container exec failed: {out}");
64. 64 assert!(out.contains("container-alive"), "{out}");
65. 65
66. 66 // 2. Writes land in the HOST workspace through the bind mount.
67. 67 let (ok, out) = run_wrapped(
68. 68 &sb.wrap_command("echo from-container > mounted.txt"),
69. 69 Duration::from_secs(60),
70. 70 );
71. 71 assert!(ok, "write failed: {out}");
72. 72 let written = std::fs::read_to_string(ws.join("mounted.txt")).unwrap();
73. 73 assert_eq!(written.trim(), "from-container");
74. 74
75. 75 // 3. Network is denied (--network none); busybox wget must fail fast.
76. 76 let (ok, out) = run_wrapped(
77. 77 &sb.wrap_command(
78. 78 "wget -q -T 3 -O /dev/null http://example.com >/dev/null 2>&1 && echo NETUP || echo NETBLOCKED",
79. 79 ),
80. 80 Duration::from_secs(60),
81. 81 );
82. 82 assert!(ok);
83. 83 assert!(out.contains("NETBLOCKED"), "network must be denied: {out}");
84. 84}
85. 85
86. 86#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
87. 87async fn docker_readonly_mode_blocks_workspace_writes() {
88. 88 if !DockerSandbox::available() {
89. 89 println!("skipping: no reachable docker daemon");
90. 90 return;
91. 91 }
92. 92 let dir = tempfile::tempdir().unwrap();
93. 93 let ws = dir.path().to_path_buf();
94. 94 std::fs::write(ws.join("existing.txt"), "keep").unwrap();
95. 95 ensure_image("alpine:3.20");
96. 96
97. 97 let sb = DockerSandbox::new(SandboxMode::ReadOnly, None, &ws);
98. 98 let (ok, out) = run_wrapped(
99. 99 &sb.wrap_command("(echo x > existing.txt && echo WROTE) || echo ROENFORCED"),
100. 100 Duration::from_secs(60),
101. 101 );
102. 102 assert!(ok);
103. 103 assert!(
104. 104 out.contains("ROENFORCED"),
105. 105 "read-only mount must block writes: {out}"
106. 106 );
107. 107 assert_eq!(
108. 108 std::fs::read_to_string(ws.join("existing.txt")).unwrap(),
109. 109 "keep"
110. 110 );
111. 111}
112. 112
113. 113#[test]
114. 114fn effective_sandbox_name_reports_docker_when_selected() {
115. 115 // Config-level selection flows through Core without needing a daemon.
116. 116 let dir = tempfile::tempdir().unwrap();
117. 117 let project = dir.path().join(".vak");
118. 118 std::fs::create_dir_all(&project).unwrap();
119. 119 std::fs::write(
120. 120 project.join("config.toml"),
121. 121 "[sandbox]\nbackend = \"docker\"\nimage = \"alpine:3.20\"\n",
122. 122 )
123. 123 .unwrap();
124. 124 vak_config::paths::isolate_home_for_tests();
125. 125 let core = vak_core::Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
126. 126 core.set_permission_mode(vak_config::PermissionMode::WorkspaceWrite);
127. 127 let name = core.effective_sandbox_name();
128. 128 assert!(name.starts_with("docker"), "got {name}");
129. 129}
130. 130
131. 131#[cfg(target_os = "macos")]
132. 132#[test]
133. 133fn macos_auto_backend_uses_seatbelt_for_restricted_modes() {
134. 134 let dir = tempfile::tempdir().unwrap();
135. 135 vak_config::paths::isolate_home_for_tests();
136. 136 let core = vak_core::Core::new_with_trust(dir.path().to_path_buf(), true).unwrap();
137. 137 core.set_permission_mode(vak_config::PermissionMode::WorkspaceWrite);
138. 138 core.set_sandbox_backend(Some("auto".into()));
139. 139 assert_eq!(core.effective_sandbox_name(), "seatbelt");
140. 140}
141. 141