mirror of
https://github.com/docker/compose.git
synced 2026-08-03 22:27:30 +00:00
eb4b1cc3f6
Replace the "flag any literal env var" check with a key-name heuristic backed by the upstream DefangLabs keyword detector (password, secret, token, api_key, …), and convert the hard error into a prompt matching the existing checkForBindMount / checkForSensitiveData UX. --with-env silences the env prompt; literal config.content gets its own prompt. The previous check flagged benign vars like LOG_LEVEL=info, blocking the 99% case, while still missing low-entropy real secrets the existing secret-detector skips (MYSQL_ROOT_PASSWORD=toto slips through on entropy ~1.5). Refs: docker/compose#13394 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Signed-off-by: Guillaume Lours <glours@users.noreply.github.com>
208 lines
10 KiB
Go
208 lines
10 KiB
Go
/*
|
|
Copyright 2020 Docker Compose CLI authors
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package e2e
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"gotest.tools/v3/assert"
|
|
"gotest.tools/v3/icmd"
|
|
"gotest.tools/v3/poll"
|
|
)
|
|
|
|
func TestPublishChecks(t *testing.T) {
|
|
c := NewParallelCLI(t)
|
|
const projectName = "compose-e2e-explicit-profiles"
|
|
|
|
t.Run("publish prompt env_file declined", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-env-file.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("n\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 130})
|
|
out := res.Combined()
|
|
assert.Assert(t, strings.Contains(out, "you are about to publish env-related declarations within your OCI artifact."), out)
|
|
assert.Assert(t, strings.Contains(out, `service "serviceA": env_file declared`), out)
|
|
assert.Assert(t, strings.Contains(out, "Are you ok to publish these env declarations?"), out)
|
|
assert.Assert(t, !strings.Contains(out, "test/test published"), out)
|
|
})
|
|
|
|
t.Run("publish prompt suspicious env declined", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-environment.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("n\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 130})
|
|
out := res.Combined()
|
|
assert.Assert(t, strings.Contains(out, `service "serviceA": literal value for "MYSQL_ROOT_PASSWORD"`), out)
|
|
})
|
|
|
|
t.Run("publish success interpolated env", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmd(t, "-f", "./fixtures/publish/compose-interpolated-env.yml",
|
|
"-p", projectName, "publish", "test/test", "-y", "--dry-run")
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test publishing"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test published"), res.Combined())
|
|
})
|
|
|
|
t.Run("publish prompt aggregates env_file and suspicious literals", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-multi-env-config.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("n\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 130})
|
|
out := res.Combined()
|
|
// Order is non-deterministic between services; assert each line independently.
|
|
assert.Assert(t, strings.Contains(out, `service "serviceB": env_file declared`), out)
|
|
assert.Assert(t, strings.Contains(out, `service "serviceA": literal value for "DB_PASSWORD"`), out)
|
|
assert.Assert(t, strings.Contains(out, `service "serviceB": literal value for "API_KEY"`), out)
|
|
assert.Assert(t, strings.Contains(out, "Use --with-env to silence this prompt"), out)
|
|
})
|
|
|
|
t.Run("publish success environment", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmd(t, "-f", "./fixtures/publish/compose-environment.yml",
|
|
"-p", projectName, "publish", "test/test", "--with-env", "-y", "--dry-run")
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test publishing"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test published"), res.Combined())
|
|
})
|
|
|
|
t.Run("publish success env_file", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmd(t, "-f", "./fixtures/publish/compose-env-file.yml",
|
|
"-p", projectName, "publish", "test/test", "--with-env", "-y", "--dry-run")
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test publishing"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test published"), res.Combined())
|
|
})
|
|
|
|
t.Run("publish with extends", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmd(t, "-f", "./fixtures/publish/compose-with-extends.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test published"), res.Combined())
|
|
})
|
|
|
|
t.Run("refuse to publish with bind mount", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-bind-mount.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("n\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 130})
|
|
out := res.Combined()
|
|
assert.Assert(t, strings.Contains(out, "you are about to publish bind mounts declaration within your OCI artifact."), out)
|
|
assert.Assert(t, strings.Contains(out, "e2e/fixtures/publish:/user-data"), out)
|
|
assert.Assert(t, strings.Contains(out, "Are you ok to publish these bind mount declarations?"), out)
|
|
assert.Assert(t, !strings.Contains(out, "serviceA published"), out)
|
|
})
|
|
|
|
t.Run("publish with bind mount", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-bind-mount.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("y\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 0})
|
|
assert.Assert(t, strings.Contains(res.Combined(), "you are about to publish bind mounts declaration within your OCI artifact."), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "Are you ok to publish these bind mount declarations?"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "e2e/fixtures/publish:/user-data"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "test/test published"), res.Combined())
|
|
})
|
|
|
|
t.Run("refuse to publish with build section only", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmdNoCheck(t, "-f", "./fixtures/publish/compose-build-only.yml",
|
|
"-p", projectName, "publish", "test/test", "--with-env", "-y", "--dry-run")
|
|
res.Assert(t, icmd.Expected{ExitCode: 1})
|
|
assert.Assert(t, strings.Contains(res.Combined(), "your Compose stack cannot be published as it only contains a build section for service(s):"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "serviceA"), res.Combined())
|
|
assert.Assert(t, strings.Contains(res.Combined(), "serviceB"), res.Combined())
|
|
})
|
|
|
|
t.Run("refuse to publish with local include", func(t *testing.T) {
|
|
res := c.RunDockerComposeCmdNoCheck(t, "-f", "./fixtures/publish/compose-local-include.yml",
|
|
"-p", projectName, "publish", "test/test", "--dry-run")
|
|
res.Assert(t, icmd.Expected{ExitCode: 1, Err: "cannot publish compose file with local includes"})
|
|
})
|
|
|
|
t.Run("detect sensitive data", func(t *testing.T) {
|
|
cmd := c.NewDockerComposeCmd(t, "-f", "./fixtures/publish/compose-sensitive.yml",
|
|
"-p", projectName, "publish", "test/test", "--with-env", "--dry-run")
|
|
cmd.Stdin = strings.NewReader("n\n")
|
|
res := icmd.RunCmd(cmd)
|
|
res.Assert(t, icmd.Expected{ExitCode: 130})
|
|
|
|
output := res.Combined()
|
|
assert.Assert(t, strings.Contains(output, "you are about to publish sensitive data within your OCI artifact.\n"), output)
|
|
assert.Assert(t, strings.Contains(output, "please double check that you are not leaking sensitive data"), output)
|
|
assert.Assert(t, strings.Contains(output, "AWS Client ID\n\"services.serviceA.environment.AWS_ACCESS_KEY_ID\": A3TX1234567890ABCDEF"), output)
|
|
assert.Assert(t, strings.Contains(output, "AWS Secret Key\n\"services.serviceA.environment.AWS_SECRET_ACCESS_KEY\": aws\"12345+67890/abcdefghijklm+NOPQRSTUVWXYZ+\""), output)
|
|
assert.Assert(t, strings.Contains(output, "Github authentication\n\"GITHUB_TOKEN\": ghp_1234567890abcdefghijklmnopqrstuvwxyz"), output)
|
|
assert.Assert(t, strings.Contains(output, "JSON Web Token\n\"\": eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9."+
|
|
"eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw"), output)
|
|
assert.Assert(t, strings.Contains(output, "Private Key\n\"\": -----BEGIN DSA PRIVATE KEY-----\nwxyz+ABC=\n-----END DSA PRIVATE KEY-----"), output)
|
|
})
|
|
}
|
|
|
|
func TestPublish(t *testing.T) {
|
|
c := NewParallelCLI(t)
|
|
const projectName = "compose-e2e-publish"
|
|
const registryName = projectName + "-registry"
|
|
c.RunDockerCmd(t, "run", "--name", registryName, "-P", "-d", "registry:3")
|
|
port := c.RunDockerCmd(t, "inspect", "--format", `{{ (index (index .NetworkSettings.Ports "5000/tcp") 0).HostPort }}`, registryName).Stdout()
|
|
registry := "localhost:" + strings.TrimSpace(port)
|
|
t.Cleanup(func() {
|
|
c.RunDockerCmd(t, "rm", "--force", registryName)
|
|
})
|
|
|
|
// Wait for registry to be ready
|
|
registryURL := "http://" + registry + "/v2/"
|
|
poll.WaitOn(t, func(l poll.LogT) poll.Result {
|
|
resp, err := http.Get(registryURL) //nolint:gosec,noctx
|
|
if err != nil {
|
|
return poll.Continue("registry not ready: %v", err)
|
|
}
|
|
_ = resp.Body.Close()
|
|
if resp.StatusCode < 500 {
|
|
return poll.Success()
|
|
}
|
|
return poll.Continue("registry not ready, status %d", resp.StatusCode)
|
|
}, poll.WithTimeout(10*time.Second), poll.WithDelay(100*time.Millisecond))
|
|
|
|
res := c.RunDockerComposeCmd(t, "-f", "./fixtures/publish/oci/compose.yaml", "-f", "./fixtures/publish/oci/compose-override.yaml",
|
|
"-p", projectName, "publish", "--with-env", "--yes", "--insecure-registry", registry+"/test:test")
|
|
res.Assert(t, icmd.Expected{ExitCode: 0})
|
|
|
|
// docker exec -it compose-e2e-publish-registry tree /var/lib/registry/docker/registry/v2/
|
|
|
|
cmd := c.NewDockerComposeCmd(t, "--verbose", "--project-name=oci",
|
|
"--insecure-registry", registry,
|
|
"-f", fmt.Sprintf("oci://%s/test:test", registry), "config")
|
|
res = icmd.RunCmd(cmd, func(cmd *icmd.Cmd) {
|
|
cmd.Env = append(cmd.Env, "XDG_CACHE_HOME="+t.TempDir())
|
|
})
|
|
res.Assert(t, icmd.Expected{ExitCode: 0})
|
|
assert.Equal(t, res.Stdout(), `name: oci
|
|
services:
|
|
app:
|
|
environment:
|
|
HELLO: WORLD
|
|
image: alpine
|
|
networks:
|
|
default: null
|
|
networks:
|
|
default:
|
|
name: oci_default
|
|
`)
|
|
}
|