3 ms·
>Think of the pause container image The pause container is very much an implementation detail. That's sort of my point. Why would you try to test implementatio
by crdoconnor 9y ago
>Think of the pause container image
The pause container is very much an implementation detail. That's sort of my point. Why would you try to test implementation details?
>You could add a test to make sure that the ca.crt file is always packaged
I could, but why? If I wrote a command to put ca.crt there I would expect it to be there unless somebody deliberately took it out.
It would be even better if I wrote a command to put ca.crt in the wrong place and then tested to see that it was in the wrong place. The test would be worse than useless in that case - it would fail on a working container and pass on a broken container.
The ca.crt is there because it triggers desired behavior - e.g. that you can connect to services over SSL without errors. Test that instead.
>The use case is more for infrastructure that explicitly deals with or supports containers.
Personally I'd consider containers themselves an implementation detail most of the time - the exception being when you're building containers for other people to use.
I still think it's the wrong approach for that too.
- dlor 9y ago> The ca.crt is there because it triggers desired behavior - e.g. that you can connect to services over SSL without errors. Test that instead. Awesome example here! We have a test that uses container-structure-test to do exactly this over here: https://github.com/GoogleCloudPlatform/distroless/blob/1ea91a52f18cf99cc3f71f55365f6888bb414b05/java/testdata/certs.yaml https://github.com/GoogleCloudPlatform/distroless/blob/1ea91... You can mix and match between tests that check file contents and tests that actually run commands inside the container and make assertions based on their output.
- crdoconnor 9y agoDon't you think that your test for the presence of the cacerts file in java.yaml is kind of redundant in that case?