monocore 0.2.1

`monocore` is a secure MicroVM provisioning system for running untrusted code in isolated environments.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174

use std::{fs, os::unix::fs::PermissionsExt};
use tempfile::tempdir;

use monocore::{
    oci::{
        distribution::{DockerRegistry, OciRegistryPull},
        rootfs,
    },
    utils::MERGED_SUBDIR,
};

//--------------------------------------------------------------------------------------------------
// Tests
//--------------------------------------------------------------------------------------------------

#[test_log::test(tokio::test)]
#[ignore = "requires pulling Docker images"]
async fn test_oci_rootfs_merge_basic_merge() -> anyhow::Result<()> {
    // Create temporary directory for test
    let temp_dir = tempdir()?;
    let registry = DockerRegistry::with_oci_dir(temp_dir.path().to_path_buf());

    // Pull a small image with multiple layers (alpine:latest)
    registry
        .pull_image("library/alpine", Some("latest"))
        .await?;

    // Create merger with temporary destination
    let dest_dir = temp_dir.path().join("merged_test");
    fs::create_dir_all(&dest_dir)?;

    // Merge layers
    rootfs::merge(temp_dir.path(), &dest_dir, "library_alpine__latest").await?;

    // Verify basic Alpine Linux directories exist
    let expected_dirs = vec!["bin", "etc", "home", "root", "usr", "var"];

    for dir in &expected_dirs {
        assert!(
            dest_dir.join(MERGED_SUBDIR).join(dir).exists(),
            "Directory {} should exist",
            dir
        );
    }

    // Cleanup
    rootfs::remove(&dest_dir).await?;

    Ok(())
}

#[test_log::test(tokio::test)]
#[ignore = "requires pulling Docker images"]
async fn test_oci_rootfs_merge_layer_permissions() -> anyhow::Result<()> {
    let temp_dir = tempdir()?;
    let registry = DockerRegistry::with_oci_dir(temp_dir.path().to_path_buf());

    // Pull nginx image which has specific file permissions
    registry.pull_image("library/nginx", Some("alpine")).await?;

    let dest_dir = temp_dir.path().join("merged_perms_test");
    fs::create_dir_all(&dest_dir)?;

    // Merge layers
    rootfs::merge(temp_dir.path(), &dest_dir, "library_nginx__alpine").await?;

    // Verify nginx binary permissions
    let nginx_binary = dest_dir.join("merged/usr/sbin/nginx");
    let metadata = fs::metadata(&nginx_binary)?;
    let mode = metadata.permissions().mode();

    // nginx binary should be executable
    assert!(
        mode & 0o111 != 0,
        "nginx binary should have executable permissions"
    );

    // Cleanup
    rootfs::remove(&dest_dir).await?;

    Ok(())
}

#[test_log::test(tokio::test)]
#[ignore = "requires pulling Docker images"]
async fn test_oci_rootfs_merge_merge_cleanup() -> anyhow::Result<()> {
    let temp_dir = tempdir()?;
    let registry = DockerRegistry::with_oci_dir(temp_dir.path().to_path_buf());

    // Pull a small image
    registry
        .pull_image("library/alpine", Some("latest"))
        .await?;

    let dest_dir = temp_dir.path().join("merged_cleanup_test");
    fs::create_dir_all(&dest_dir)?;

    // Merge layers
    rootfs::merge(temp_dir.path(), &dest_dir, "library_alpine__latest").await?;

    // Verify merged directory is created
    assert!(dest_dir.join(MERGED_SUBDIR).exists());

    // Unmount and cleanup
    rootfs::remove(&dest_dir).await?;

    // Verify merged directory is cleaned up
    assert!(!dest_dir.join(MERGED_SUBDIR).exists());

    Ok(())
}

#[test_log::test(tokio::test)]
#[ignore = "requires pulling Docker images"]
async fn test_oci_rootfs_merge_concurrent_merges() -> anyhow::Result<()> {
    let temp_dir = tempdir()?;
    let registry = DockerRegistry::with_oci_dir(temp_dir.path().to_path_buf());

    // Pull two different images
    let pull_tasks = tokio::join!(
        registry.pull_image("library/alpine", Some("latest")),
        registry.pull_image("library/busybox", Some("latest"))
    );
    pull_tasks.0?;
    pull_tasks.1?;

    // Create two separate merge destinations
    let dest_dir1 = temp_dir.path().join("merged_concurrent_1");
    let dest_dir2 = temp_dir.path().join("merged_concurrent_2");
    fs::create_dir_all(&dest_dir1)?;
    fs::create_dir_all(&dest_dir2)?;

    // Merge concurrently
    let merge_results = tokio::join!(
        rootfs::merge(temp_dir.path(), &dest_dir1, "library_alpine__latest"),
        rootfs::merge(temp_dir.path(), &dest_dir2, "library_busybox__latest")
    );

    // Check results
    merge_results.0?;
    merge_results.1?;

    // Verify both merges succeeded
    assert!(dest_dir1.join("merged/bin").exists());
    assert!(dest_dir2.join("merged/bin").exists());

    // Cleanup
    let cleanup_results = tokio::join!(rootfs::remove(&dest_dir1), rootfs::unmount(&dest_dir2));
    cleanup_results.0?;
    cleanup_results.1?;

    Ok(())
}

#[test_log::test(tokio::test)]
#[ignore = "requires pulling Docker images"]
async fn test_oci_rootfs_merge_error_handling() -> anyhow::Result<()> {
    let temp_dir = tempdir()?;

    // Try to merge non-existent image
    let dest_dir = temp_dir.path().join("merged_error_test");
    fs::create_dir_all(&dest_dir)?;

    // This should fail because no image was pulled
    let result = rootfs::merge(temp_dir.path(), &dest_dir, "nonexistent_image").await;
    assert!(result.is_err());

    // Verify cleanup happened despite error
    assert!(!dest_dir.join("work").exists());
    assert!(!dest_dir.join("upper").exists());
    assert!(!dest_dir.join(MERGED_SUBDIR).exists());

    Ok(())
}