22 lines
777 B
Rust
22 lines
777 B
Rust
#[test]
|
|
fn compose_is_a_hardened_read_only_sidecar() {
|
|
let compose = include_str!("../compose.example.yml");
|
|
assert!(compose.contains("minecraft-data:/data:ro"));
|
|
assert!(compose.contains("read_only: true"));
|
|
assert!(compose.contains("cap_drop: [ALL]"));
|
|
assert!(compose.contains("no-new-privileges:true"));
|
|
assert!(!compose.contains("docker.sock"));
|
|
assert!(!compose.contains("ports:"));
|
|
}
|
|
#[test]
|
|
fn runtime_has_no_node_and_runs_non_root() {
|
|
let dockerfile = include_str!("../Dockerfile");
|
|
let runtime = dockerfile
|
|
.split("FROM debian:bookworm-slim AS runtime")
|
|
.nth(1)
|
|
.unwrap();
|
|
assert!(!runtime.contains("npm "));
|
|
assert!(!runtime.contains("node "));
|
|
assert!(runtime.contains("USER 10001:10001"));
|
|
}
|