Skip to content

test(hermes): fail closed on missing Linux Docker #7507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cv merged 2 commits into from
Jul 26, 2026
Merged

test(hermes): fail closed on missing Linux Docker #7507

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d337a51
test(hermes): fail closed on missing Linux Docker
cjagwani Jul 24, 2026
38be1ae
merge(main): refresh PR #7507
cv Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 23 additions & 11 deletions test/hermes-runtime-config-guard-topology.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
// SPDX-License-Identifier: Apache-2.0

import { spawnSync } from "node:child_process";
import { execFileSync, spawnSync } from "node:child_process";
import { readFileSync } from "node:fs";
import path from "node:path";
import { describe, expect, it } from "vitest";

import { dockerSpawnSync } from "../src/lib/adapters/docker/exec";
import { isWsl } from "../src/lib/platform";

const RUNTIME_CONFIG_GUARD = path.join(
import.meta.dirname,
Expand All @@ -17,12 +18,19 @@ const RUNTIME_CONFIG_GUARD = path.join(
);
const ROOT_RUNTIME_IMAGE =
"python:3.12-slim@sha256:cab2dbf575e971934a81e4622f5aba17aa7929719bd7e31033a3a83b97fd0464";
const ROOT_CONTAINER_RUNTIME_AVAILABLE =
process.platform === "linux" &&
dockerSpawnSync(["info"], {
stdio: "ignore",
timeout: 15_000,
}).status === 0;
function dockerAvailable(): boolean {
try {
execFileSync("docker", ["info"], { stdio: "ignore", timeout: 15_000 });
return true;
} catch {
return false;
}
}

// WSL does not require Docker. Native Linux must attempt this security contract
// so a missing or broken Docker boundary fails the test.
const shouldAttemptRootContainerContract =
process.platform === "linux" && (!isWsl() || dockerAvailable());
const ROOT_CONTAINER_DRIVER = String.raw`
import json
import os
Expand Down Expand Up @@ -512,7 +520,7 @@ print(json.dumps({
});

// source-shape-contract: security -- Executes the shipped guard as root to prove real Linux repair and rollback metadata
it.skipIf(!ROOT_CONTAINER_RUNTIME_AVAILABLE)(
it.skipIf(!shouldAttemptRootContainerContract)(
"restores exact locked posture after root-separated repair and later failure (#7033)",
() => {
const result = runRootContainerHarness(`${loadGuardModule}
Expand Down Expand Up @@ -633,9 +641,13 @@ with tempfile.TemporaryDirectory() as tmp:
}))
`);

expect(result.status, result.error?.message || String(result.stderr || result.stdout)).toBe(
0,
);
const failureDetails = [
`status: ${String(result.status)}`,
`signal: ${String(result.signal)}`,
`spawn error: ${result.error ? String(result.error) : "none"}`,
`stderr: ${String(result.stderr)}`,
].join("\n");
expect(result.status, failureDetails).toBe(0);
expect(JSON.parse(String(result.stdout))).toEqual({
aborting_state: "shields-transition-aborting",
applied_state: "shields-transition-applied",
Expand Down
Loading