opencontainers/runtime-tools

# oci-runtime-tool [](https://travis-ci.org/opencontainers/runtime-tools) [](https://goreportcard.com/report/github.com/opencontainers/runtime-tools) oci-runtime-tool 是一组用于处理 [OCI 运行时规范][runtime-spec] 的工具。 要从源代码构建，runtime-tools 需要 Go 1.19.x 或更高版本。 ## 目录 关于本小组运作方式的更多文档： - [行为准则][code-of-conduct] - [安全][security] ## 生成 OCI 运行时规范配置文件 [`oci-runtime-tool generate`][generate.1] 为 [OCI bundle][bundle] 生成 [配置 JSON][config.json]。 像 [runC][] 这样的 [兼容 OCI 的运行时][runtime-spec] 会从 `config.json` 中读取配置。 ``` $ oci-runtime-tool generate --output config.json $ cat config.json { "ociVersion": "0.5.0", … } ``` ## 验证 OCI bundle [`oci-runtime-tool validate`][validate.1] 用于验证 OCI bundle。 如果 OCI bundle 未通过验证过程，将会打印错误信息。 ``` $ oci-runtime-tool generate $ oci-runtime-tool validate INFO[0000] Bundle validation succeeded. ``` ## 测试 OCI 运行时 运行时验证套件使用 [node-tap][]，某些发行版已经包含了它的软件包（例如，它包含在 [Debian 的 `node-tap` 软件包][debian-node-tap] 中）。 如果你的发行版没有打包 node-tap，你可以安装 [npm][]（例如，从 [Gentoo 的 `nodejs` 软件包][gentoo-nodejs] 获取）并使用它： ``` $ npm install tap ``` 构建验证可执行文件： ``` $ make runtimetest validation-executables ``` 运行时验证目前[仅支持](docs/runtime-compliance-testing.md)[OCI 运行时命令行接口](docs/command-line-interface.md)。 如果未来我们添加了对其他 API 的支持，运行时验证将增加一个选项来选择所需的运行时 API。 对于命令行接口，`RUNTIME` 选项用于选择运行时命令（即[OCI 运行时命令行接口](docs/command-line-interface.md)中的 `funC`）。 ``` $ sudo make RUNTIME=runc localvalidation RUNTIME=runc tap validation/pidfile.t validation/linux_cgroups_hugetlb.t validation/linux_cgroups_memory.t validation/linux_rootfs_propagation_shared.t validation/kill.t validation/create.t validation/poststart.t validation/linux_cgroups_network.t validation/poststop_fail.t validation/linux_readonly_paths.t validation/prestart_fail.t validation/hooks_stdin.t validation/default.t validation/linux_masked_paths.t validation/poststop.t validation/misc_props.t validation/prestart.t validation/poststart_fail.t validation/mounts.t validation/linux_cgroups_relative_pids.t validation/process_user.t validation/process.t validation/hooks.t validation/process_capabilities_fail.t validation/process_rlimits_fail.t validation/linux_cgroups_relative_cpus.t validation/process_rlimits.t validation/linux_cgroups_relative_blkio.t validation/linux_sysctl.t validation/linux_seccomp.t validation/linux_devices.t validation/start.t validation/linux_cgroups_pids.t validation/process_capabilities.t validation/process_oom_score_adj.t validation/linux_cgroups_relative_hugetlb.t validation/linux_cgroups_cpus.t validation/linux_cgroups_relative_memory.t validation/state.t validation/root_readonly_true.t validation/linux_cgroups_blkio.t validation/linux_rootfs_propagation_unbindable.t validation/delete.t validation/linux_cgroups_relative_network.t validation/hostname.t validation/killsig.t validation/linux_uid_mappings.t validation/pidfile.t .failed to create the container container_linux.go:348: starting container process caused "process_linux.go:402: container init caused \"process_linux.go:367: setting cgroup config for procHooks process caused \\\"failed to write 56892210544640 to hugetlb.1GB.limit_in_bytes: open /sys/fs/cgroup/hugetlb/cgrouptest/hugetlb.1GB.limit_in_bytes: permission denied\\\"\"" exit status 1 validation/pidfile.t .................................. 1/1 315ms validation/linux_cgroups_hugetlb.t .................... 0/1 not ok validation/linux_cgroups_hugetlb.t timeout: 30000 file: validation/linux_cgroups_hugetlb.t command: validation/linux_cgroups_hugetlb.t args: [] stdio: - 0 - pipe - 2 cwd: /…/go/src/github.com/opencontainers/runtime-tools exitCode: 1 validation/linux_cgroups_memory.t ..................... 9/9 validation/linux_rootfs_propagation_shared.t ...... 252/282 not ok shared root propagation exposes "/target348456609/mount892511628/example376408222" Skipped: 29 /dev/null (default device) has unconfigured permissions … total ........................................... 4381/4962 4381 passing (1m) 567 pending 14 failing make: *** [Makefile:44: localvalidation] Error 1 ``` 你也可以直接运行单个测试可执行文件： ``` $ sudo RUNTIME=runc validation/default/default.t TAP version 13 ok 1 - has expected hostname --- { "actual": "mrsdalloway", "expected": "mrsdalloway" } ... … ok 287 # SKIP linux.gidMappings not set 1..287 ``` 如果你无法安装 node-tap，你大概可以使用其他 [TAP 消费者][tap-consumers] 来运行测试套件。 例如，使用 [`prove`][prove]： ``` $ sudo make TAPTOOL='prove -Q -j9' RUNTIME=runc VALIDATION_TESTS=validation/pidfile/pidfile.t localvalidation RUNTIME=runc prove -Q -j9 validation/pidfile.t All tests successful. Files=1, Tests=1, 0 wallclock secs ( 0.01 usr 0.01 sys + 0.03 cusr 0.03 csys = 0.08 CPU) Result: PASS ```

标签：EVTX分析, MITM代理, 日志审计, 暗色界面