fix: isolate container builds with shared resource limits [CI SKIP]

2026-11-02 17:31:03 +09:00
parent 9f67ee5719
commit db6d8ad8b4
8 changed files with 183 additions and 33 deletions
@@ -0,0 +1,64 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+function run(overrides = {}, args = ['-t', 'test:limited', '.']) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'build-limits-test-'));
+  try {
+    const fake = path.join(dir, 'docker');
+    fs.writeFileSync(fake, `#!${process.execPath}
+const fs = require('node:fs');
+const a = process.argv.slice(2);
+fs.appendFileSync(process.env.CALLS, JSON.stringify(a) + '\\n');
+if (a[0] === 'buildx' && a[1] === 'inspect') {
+  if (process.env.ABSENT && !fs.existsSync(process.env.CREATED)) process.exit(1);
+  console.log('Name: studio-limited\\nDriver: ' + (process.env.DRIVER || 'docker-container') + '\\nNodes:\\nName: ' + (process.env.NODE || 'studio-limited0'));
+}
+if (a[0] === 'buildx' && a[1] === 'create') {
+  if (a.includes('--help')) console.log('--buildkitd-config');
+  else fs.writeFileSync(process.env.CREATED, 'yes');
+}
+if (a[0] === 'inspect') console.log(process.env.LIMITS || '100000 200000 8589934592 8589934592');
+`, { mode: 0o755 });
+    const result = spawnSync('/bin/sh', [path.join(__dirname, 'build-image.sh'), ...args], {
+      encoding: 'utf8',
+      env: { ...process.env, DOCKER_BIN: fake, CALLS: path.join(dir, 'calls'), CREATED: path.join(dir, 'created'), ...overrides },
+    });
+    const calls = fs.readFileSync(path.join(dir, 'calls'), 'utf8').trim().split('\n').map(JSON.parse);
+    return { ...result, calls };
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+test('uses the shared worker and loads the result for existing docker push', () => {
+  const result = run();
+  assert.equal(result.status, 0, result.stderr);
+  assert.deepEqual(result.calls.at(-1), ['buildx', 'build', '--builder', 'studio-limited', '--load', '--progress', 'plain', '-t', 'test:limited', '.']);
+});
+
+test('creates a bounded worker without changing the default builder', () => {
+  const result = run({ ABSENT: '1' });
+  assert.equal(result.status, 0, result.stderr);
+  const create = result.calls.find((a) => a[1] === 'create' && !a.includes('--help'));
+  const options = create[create.indexOf('--driver-opt') + 1];
+  for (const value of ['memory=8g', 'memory-swap=8g', 'cpu-period=100000', 'cpu-quota=200000']) assert.ok(options.includes(value));
+  assert.ok(!create.includes('--use'));
+});
+
+for (const overrides of [{ LIMITS: '0 0 0 0' }, { DRIVER: 'docker' }, { NODE: 'other-node' }]) {
+  test(`refuses an unbounded or unexpected worker: ${JSON.stringify(overrides)}`, () => {
+    const result = run(overrides);
+    assert.notEqual(result.status, 0);
+    assert.ok(!result.calls.some((a) => a[0] === 'buildx' && a[1] === 'build'));
+  });
+}
+
+test('prepare-only never builds an application', () => {
+  const result = run({}, ['--prepare-only']);
+  assert.equal(result.status, 0, result.stderr);
+  assert.ok(!result.calls.some((a) => a[0] === 'buildx' && a[1] === 'build'));
+});