Refactor how we build unikernels for testing #2316
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -67,23 +67,23 @@ build_chainloader(){ | |
| } | ||
|
|
||
| build_example(){ | ||
| nix-build $CCACHE_FLAG unikernel.nix | ||
| } | ||
|
|
||
| multicore_subset(){ | ||
| nix-build ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --arg doCheck true | ||
|
|
||
| # The following tests are not using multiple CPU's, but have been equippedd with some anyway | ||
| # to make sure core functionality is not broken by missing locks etc. when waking up more cores. | ||
| nix-shell ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp --arg doCheck true | ||
| nix-build ./unikernel.nix --arg smp true $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --arg doCheck true | ||
| } | ||
|
|
||
| smoke_tests(){ | ||
| nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/net/integration/udp --arg doCheck true | ||
| nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/net/integration/tcp --arg doCheck true | ||
| nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/paging --arg doCheck true | ||
| nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ./test/kernel/integration/smp --arg doCheck true | ||
| } | ||
|
|
||
| run unittests "Build and run unit tests" | ||
|
|
@@ -137,21 +137,31 @@ run_testsuite() { | |
|
|
||
| for subfolder in "$base_folder"/*/; do | ||
| local skip=false | ||
| local sandboxed=true | ||
|
There was a problem hiding this comment. Can we have a cli option for enabling (or disabling) the tests that require the sandbox to be disabled? It should be possible to run tests on systems without the bridge available (even if the net tests are skipped). There was a problem hiding this comment. I'm also wondering if "sandbox" is the right name here. While it is true that these tests run without a sandbox, the common feature is that they all require access to a network bridge, so being able to run a command that specifically enables them, e.g. "./test.sh --enable-network-bridge-tests", would make more sense to me. But as this has already passed one review I'm happy to leave this as it is for now - we can iterate on this later if needed There was a problem hiding this comment. I agree with the naming: I was also thinking of calling it I was considering taking another look at There was a problem hiding this comment. Regarding enabling/disabling the sandbox, I'm not sure I see the value. Introducing conditionals could lead to giving false positives, especially if it sets the precedent for more edge cases. Forcing them to stay enabled pushes people to actually set this up properly. See also includeos/vmrunner#45. There was a problem hiding this comment. It's useful to be able to skip the network tests that require bridge-access in environments where you'd still like to run the regular tests (like CI). Ideally we should find a way to run them without special permissions, but we're not quite there yet. If they just fail I'm ok with that for now - but we may have to make this more flexible for CI later There was a problem hiding this comment. Yep. Regarding building specific tests, there is also the drafted #2314 which I will probably redo from scratch later. Might add a flag like |
||
|
|
||
| for exclude in "${exclusion_list[@]}"; do | ||
| if [[ "$subfolder" == *"$exclude"* ]]; then | ||
| skip=true | ||
| break | ||
| fi | ||
| done | ||
| if [ "$skip" = true ]; then | ||
| continue | ||
| fi | ||
|
|
||
| for unsandbox in "${unsandbox_list[@]}"; do | ||
| if [[ "$subfolder" == *"$unsandbox"* ]]; then | ||
| sandboxed=false | ||
| break | ||
| fi | ||
| done | ||
|
|
||
| # The command to run, as string to be able to print the fully expanded command | ||
| if $sandboxed; then | ||
| cmd="nix-build ./unikernel.nix $CCACHE_FLAG --argstr unikernel ${subfolder%/} --arg doCheck true" | ||
| else | ||
| cmd="nix-shell ./unikernel.nix $CCACHE_FLAG --argstr unikernel ${subfolder%/} --arg doCheck true" | ||
|
There was a problem hiding this comment. It might look like that, but I'm reasonably sure this actually still is pure. Let me explain.
I initially tried There was a problem hiding this comment. Also, note that |
||
| fi | ||
|
|
||
| echo "" | ||
| echo "🚧 Step $steps.$substeps" | ||
|
|
@@ -194,7 +204,11 @@ exclusions=( | |
| "modules" # Requires 32-bit build, which our shell.nix is not set up for | ||
| ) | ||
|
|
||
| unsandbox_list=( | ||
| "term" # fails to create the tun device, like the net integration tests | ||
| ) | ||
| run_testsuite "./test/kernel/integration" "${exclusions[@]}" | ||
| unsandbox_list=() | ||
|
|
||
| # | ||
| # C++ STL runtime tests | ||
|
|
@@ -223,7 +237,20 @@ exclusions=( | |
| "websocket" # Linking fails, undefined ref to http_parser_parse_url, http_parser_execute | ||
| ) | ||
|
|
||
| # all the following fail with the following error: | ||
| # <vm> failed to create tun device: Operation not permitted | ||
| # <vm> qemu-system-x86_64: -netdev bridge,id=net0,br=bridge43: bridge helper failed | ||
| unsandbox_list=( | ||
| "./test/net/integration/configure" | ||
| "./test/net/integration/icmp" | ||
| "./test/net/integration/icmp6" | ||
| "./test/net/integration/slaac" | ||
| "./test/net/integration/tcp" | ||
| "./test/net/integration/udp" | ||
| "./test/net/integration/dns" # except this one which times out instead | ||
| ) | ||
| run_testsuite "./test/net/integration" "${exclusions[@]}" | ||
| unsandbox_list=() | ||
|
|
||
| echo -e "\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" | ||
|
|
||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,125 @@ | ||
| { | ||
| # The unikernel to build | ||
| unikernel ? ./example, | ||
|
|
||
| # The test file to run | ||
| test ? "test.py", | ||
|
|
||
| # Boot unikernel after building it | ||
| doCheck ? false, | ||
|
|
||
| # Which architecture to build against | ||
| arch ? "x86_64", | ||
|
|
||
| # Enable multicore suport. | ||
| smp ? false, | ||
|
|
||
| # Enable ccache support. See overlay.nix for details. | ||
| withCcache ? false, | ||
|
|
||
| # Enable stricter requirements | ||
| forProduction ? false, | ||
|
|
||
| # The includeos library to build and link against | ||
| includeos ? import ./default.nix { inherit withCcache; inherit smp; }, | ||
|
|
||
| # vmrunner path, for vmrunner development | ||
| vmrunner ? "", | ||
| }: | ||
| let | ||
| absolutePathOf = base: p: | ||
| if p == null then null else | ||
| if builtins.isPath p then p | ||
| else builtins.toPath (base + "/${p}"); | ||
|
|
||
| unikernelPath = absolutePathOf ./. unikernel; | ||
| vmrunnerPkg = | ||
| if vmrunner == "" then | ||
| includeos.vmrunner | ||
|
There was a problem hiding this comment. Can this just be the default above or isn't ${includeos} available yet in the header? If it's not possible to set the default earlier it would be useful with a comment above the "vmrunner ? .." declaration that it will be set to default if left empty. There was a problem hiding this comment. It can, and personally I agree and prefer what you're suggesting, but did it this way anyway for convenience. The downside of that is that people need to write out Up to you, I prefer the explicit-by-the-user approach. |
||
| else | ||
| includeos.pkgs.callPackage (builtins.toPath /. + vmrunner) {}; | ||
| in | ||
| includeos.stdenv.mkDerivation rec { | ||
| pname = "includeos_example"; | ||
| version = "dev"; | ||
| src = includeos.pkgs.lib.cleanSource unikernelPath; | ||
| dontStrip = true; | ||
| inherit doCheck; | ||
|
|
||
| nativeBuildInputs = [ | ||
| includeos.pkgs.buildPackages.nasm | ||
| includeos.pkgs.buildPackages.cmake | ||
| ]; | ||
|
|
||
| buildInputs = [ | ||
| includeos | ||
| includeos.chainloader | ||
| ]; | ||
|
|
||
| cmakeFlags = [ | ||
| "-DARCH=${arch}" | ||
| "-DINCLUDEOS_PACKAGE=${includeos}" | ||
| "-DCMAKE_MODULE_PATH=${includeos}/cmake" | ||
| "-DFOR_PRODUCTION=${if forProduction then "ON" else "OFF"}" | ||
| ]; | ||
|
|
||
| installPhase = '' | ||
mazunki marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| runHook preInstall | ||
| # we want to place any files required by the test into the output | ||
| find -mindepth 1 -maxdepth 1 -type f -exec install -v -D -t "$out/" {} \; | ||
|
|
||
| # especially the unikernel image, in case it wasn't at the rootdir already | ||
| find -mindepth 2 -name '*.elf.bin' -exec install -v -t "$out/" {} \; | ||
| runHook postInstall | ||
| ''; | ||
|
|
||
|
|
||
| nativeCheckInputs = [ | ||
| includeos.vmrunner | ||
| includeos.pkgs.grub2 | ||
| includeos.pkgs.python3 | ||
| includeos.pkgs.qemu | ||
| includeos.pkgs.iputils | ||
| includeos.pkgs.xorriso | ||
| ]; | ||
|
|
||
| checkInputs = [ | ||
| includeos.lest | ||
| ]; | ||
|
|
||
| # use `nix-build --arg doCheck true` to run tests normally | ||
| checkPhase = '' | ||
| runHook preCheck | ||
| set -e | ||
| if [ -e "${src}/${test}" ]; then | ||
| echo "Running IncludeOS test: ${src}/${test}" | ||
| python3 "${src}/${test}" | ||
| else | ||
| echo "Default test script '${test}', but no test was found 😟" | ||
| echo "For a custom path, consider specifying the path to the test script:" | ||
| echo " --argstr test 'path/to/test.py'" | ||
| exit 1 | ||
| fi | ||
| runHook postCheck | ||
| ''; | ||
|
|
||
| # this is a hack | ||
| # some tests need to be run through a shell because of net_cap_raw+ep and net_cap_admin+ep | ||
| # replace nix-build with nix-shell to test without dropping capabilities | ||
| packages = [ | ||
| (includeos.pkgs.python3.withPackages (p: [ | ||
| vmrunnerPkg | ||
| ])) | ||
| ]; | ||
| shellHook = '' | ||
| set -eu | ||
| pkg="$(nix-build ./unikernel.nix --arg doCheck false --arg unikernel ${unikernel})" | ||
|
|
||
| testPath="$(realpath "${unikernel}/${test}")" | ||
| cd "$pkg" | ||
| "$testPath" || exit 1 | ||
|
|
||
| exit 0 | ||
| ''; | ||
|
|
||
| } | ||
Uh oh!
There was an error while loading. Please reload this page.