Skip to content

Commit 7cfd148

Browse files
sohankshirsagarjy-tan
sohankshirsagar
and
jy-tan
authored
test: enforce strict replay sandboxing in e2e fixtures (#79)
Co-authored-by: JY Tan <jy8230@gmail.com>
1 parent 1751303 commit 7cfd148

41 files changed

Lines changed: 261 additions & 31 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/e2e.yml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,39 @@ jobs:
108108
chmod +x ./drift/instrumentation/${{ matrix.library }}/e2e-tests/run.sh
109109
cd ./drift/instrumentation/${{ matrix.library }}/e2e-tests && ./run.sh 8000
110110
111+
- name: Print replay logs for ${{ matrix.library }}
112+
if: always()
113+
run: |
114+
log_dir=./drift/instrumentation/${{ matrix.library }}/e2e-tests/.tusk/logs
115+
if ! sudo test -d "$log_dir"; then
116+
echo "No replay log directory found"
117+
exit 0
118+
fi
119+
120+
sudo chmod -R a+rX "$log_dir" || true
121+
sudo chown -R "$(id -u):$(id -g)" "$log_dir" || true
122+
123+
shopt -s nullglob
124+
logs=("$log_dir"/*)
125+
if [ ${#logs[@]} -eq 0 ]; then
126+
echo "No replay logs found"
127+
exit 0
128+
fi
129+
130+
for f in "${logs[@]}"; do
131+
echo "=== $f ==="
132+
cat "$f"
133+
done
134+
135+
- name: Upload replay logs for ${{ matrix.library }}
136+
if: always()
137+
uses: actions/upload-artifact@v4
138+
with:
139+
name: e2e-${{ matrix.library }}-replay-logs
140+
path: ./drift/instrumentation/${{ matrix.library }}/e2e-tests/.tusk/logs
141+
if-no-files-found: ignore
142+
include-hidden-files: true
143+
111144
- name: Cleanup Docker resources
112145
if: always()
113146
run: |
@@ -186,6 +219,39 @@ jobs:
186219
chmod +x ./drift/stack-tests/${{ matrix.test }}/run.sh
187220
cd ./drift/stack-tests/${{ matrix.test }} && ./run.sh 8000
188221
222+
- name: Print replay logs for ${{ matrix.test }}
223+
if: always()
224+
run: |
225+
log_dir=./drift/stack-tests/${{ matrix.test }}/.tusk/logs
226+
if ! sudo test -d "$log_dir"; then
227+
echo "No replay log directory found"
228+
exit 0
229+
fi
230+
231+
sudo chmod -R a+rX "$log_dir" || true
232+
sudo chown -R "$(id -u):$(id -g)" "$log_dir" || true
233+
234+
shopt -s nullglob
235+
logs=("$log_dir"/*)
236+
if [ ${#logs[@]} -eq 0 ]; then
237+
echo "No replay logs found"
238+
exit 0
239+
fi
240+
241+
for f in "${logs[@]}"; do
242+
echo "=== $f ==="
243+
cat "$f"
244+
done
245+
246+
- name: Upload replay logs for ${{ matrix.test }}
247+
if: always()
248+
uses: actions/upload-artifact@v4
249+
with:
250+
name: stack-${{ matrix.test }}-replay-logs
251+
path: ./drift/stack-tests/${{ matrix.test }}/.tusk/logs
252+
if-no-files-found: ignore
253+
include-hidden-files: true
254+
189255
- name: Cleanup Docker resources
190256
if: always()
191257
run: |
@@ -257,6 +323,39 @@ jobs:
257323
chmod +x ./drift/instrumentation/requests/e2e-tests/run.sh
258324
cd ./drift/instrumentation/requests/e2e-tests && ./run.sh 8000
259325
326+
- name: Print replay logs for requests smoke test
327+
if: always()
328+
run: |
329+
log_dir=./drift/instrumentation/requests/e2e-tests/.tusk/logs
330+
if ! sudo test -d "$log_dir"; then
331+
echo "No replay log directory found"
332+
exit 0
333+
fi
334+
335+
sudo chmod -R a+rX "$log_dir" || true
336+
sudo chown -R "$(id -u):$(id -g)" "$log_dir" || true
337+
338+
shopt -s nullglob
339+
logs=("$log_dir"/*)
340+
if [ ${#logs[@]} -eq 0 ]; then
341+
echo "No replay logs found"
342+
exit 0
343+
fi
344+
345+
for f in "${logs[@]}"; do
346+
echo "=== $f ==="
347+
cat "$f"
348+
done
349+
350+
- name: Upload replay logs for requests smoke test
351+
if: always()
352+
uses: actions/upload-artifact@v4
353+
with:
354+
name: requests-smoke-replay-logs
355+
path: ./drift/instrumentation/requests/e2e-tests/.tusk/logs
356+
if-no-files-found: ignore
357+
include-hidden-files: true
358+
260359
- name: Cleanup Docker resources
261360
if: always()
262361
run: |

‎drift/instrumentation/aiohttp/e2e-tests/.tusk/config.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,6 @@ recording:
2525

2626
replay:
2727
enable_telemetry: false
28+
sandbox:
29+
mode: strict
2830

‎drift/instrumentation/aiohttp/e2e-tests/docker-compose.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ services:
1414
dockerfile: drift/instrumentation/aiohttp/e2e-tests/Dockerfile
1515
args:
1616
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
17+
cap_add:
18+
- SYS_ADMIN
19+
security_opt:
20+
- seccomp=unconfined
21+
- apparmor=unconfined
1722
environment:
1823
- PORT=8000
1924
- TUSK_ANALYTICS_DISABLED=1

‎drift/instrumentation/django/e2e-tests/.tusk/config.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,5 @@ recording:
2525

2626
replay:
2727
enable_telemetry: false
28+
sandbox:
29+
mode: strict

‎drift/instrumentation/django/e2e-tests/docker-compose.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ services:
1414
dockerfile: drift/instrumentation/django/e2e-tests/Dockerfile
1515
args:
1616
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
17+
cap_add:
18+
- SYS_ADMIN
19+
security_opt:
20+
- seccomp=unconfined
21+
- apparmor=unconfined
1722
environment:
1823
- PORT=8000
1924
- TUSK_ANALYTICS_DISABLED=1

‎drift/instrumentation/e2e_common/Dockerfile.base‎

Lines changed: 30 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
# This base image contains:
44
# - Python 3.9 (minimum supported version)
55
# - Tusk CLI (for running replay tests)
6-
# - System utilities (curl, postgresql-client)
6+
# - System utilities (curl, postgresql-client, socat, bubblewrap)
77
#
88
# Build this image before running e2e tests:
99
# docker build -t python-e2e-base:latest -f drift/instrumentation/e2e-common/Dockerfile.base .
@@ -12,38 +12,40 @@ FROM python:3.9-slim
1212

1313
# Install system dependencies
1414
RUN apt-get update && apt-get install -y --no-install-recommends \
15-
curl \
16-
postgresql-client \
17-
&& rm -rf /var/lib/apt/lists/*
15+
curl \
16+
postgresql-client \
17+
socat \
18+
bubblewrap \
19+
&& rm -rf /var/lib/apt/lists/*
1820

1921
# Install Tusk CLI
2022
# The CLI is downloaded from GitHub releases (tar.gz archives)
2123
ARG TUSK_CLI_VERSION=latest
2224
RUN set -ex && \
23-
if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
24-
# Get the latest version tag
25-
VERSION=$(curl -s https://api.github.com/repos/Use-Tusk/tusk-drift-cli/releases/latest | grep '"tag_name"' | cut -d '"' -f 4); \
26-
else \
27-
VERSION="${TUSK_CLI_VERSION}"; \
28-
fi && \
29-
# Remove 'v' prefix if present for the filename
30-
VERSION_NUM=$(echo "$VERSION" | sed 's/^v//') && \
31-
# Detect architecture (x86_64 or arm64)
32-
ARCH=$(uname -m) && \
33-
case "$ARCH" in \
34-
x86_64) ARCH_NAME="x86_64" ;; \
35-
aarch64|arm64) ARCH_NAME="arm64" ;; \
36-
*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
37-
esac && \
38-
# Construct download URL (archives are named like tusk-drift-cli_0.1.35_Linux_x86_64.tar.gz)
39-
DOWNLOAD_URL="https://github.com/Use-Tusk/tusk-drift-cli/releases/download/${VERSION}/tusk-drift-cli_${VERSION_NUM}_Linux_${ARCH_NAME}.tar.gz" && \
40-
echo "Downloading Tusk CLI from: $DOWNLOAD_URL" && \
41-
curl -fsSL "$DOWNLOAD_URL" -o /tmp/tusk.tar.gz && \
42-
tar -xzf /tmp/tusk.tar.gz -C /tmp && \
43-
mv /tmp/tusk /usr/local/bin/tusk && \
44-
chmod +x /usr/local/bin/tusk && \
45-
rm -rf /tmp/tusk.tar.gz /tmp/LICENSE /tmp/README.md && \
46-
tusk --version
25+
if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
26+
# Get the latest version tag
27+
VERSION=$(curl -s https://api.github.com/repos/Use-Tusk/tusk-drift-cli/releases/latest | grep '"tag_name"' | cut -d '"' -f 4); \
28+
else \
29+
VERSION="${TUSK_CLI_VERSION}"; \
30+
fi && \
31+
# Remove 'v' prefix if present for the filename
32+
VERSION_NUM=$(echo "$VERSION" | sed 's/^v//') && \
33+
# Detect architecture (x86_64 or arm64)
34+
ARCH=$(uname -m) && \
35+
case "$ARCH" in \
36+
x86_64) ARCH_NAME="x86_64" ;; \
37+
aarch64|arm64) ARCH_NAME="arm64" ;; \
38+
*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
39+
esac && \
40+
# Construct download URL (archives are named like tusk-drift-cli_0.1.35_Linux_x86_64.tar.gz)
41+
DOWNLOAD_URL="https://github.com/Use-Tusk/tusk-drift-cli/releases/download/${VERSION}/tusk-drift-cli_${VERSION_NUM}_Linux_${ARCH_NAME}.tar.gz" && \
42+
echo "Downloading Tusk CLI from: $DOWNLOAD_URL" && \
43+
curl -fsSL "$DOWNLOAD_URL" -o /tmp/tusk.tar.gz && \
44+
tar -xzf /tmp/tusk.tar.gz -C /tmp && \
45+
mv /tmp/tusk /usr/local/bin/tusk && \
46+
chmod +x /usr/local/bin/tusk && \
47+
rm -rf /tmp/tusk.tar.gz /tmp/LICENSE /tmp/README.md && \
48+
tusk --version
4749

4850
# Upgrade pip
4951
RUN pip install --upgrade pip

‎drift/instrumentation/fastapi/e2e-tests/.tusk/config.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,6 @@ recording:
2525

2626
replay:
2727
enable_telemetry: false
28+
sandbox:
29+
mode: strict
2830

‎drift/instrumentation/fastapi/e2e-tests/docker-compose.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,11 @@ services:
1414
dockerfile: drift/instrumentation/fastapi/e2e-tests/Dockerfile
1515
args:
1616
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
17+
cap_add:
18+
- SYS_ADMIN
19+
security_opt:
20+
- seccomp=unconfined
21+
- apparmor=unconfined
1722
environment:
1823
- PORT=8000
1924
- TUSK_ANALYTICS_DISABLED=1

‎drift/instrumentation/fastapi/e2e-tests/requirements.txt‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,6 @@
22
fastapi>=0.115.0
33
uvicorn>=0.30.0
44
requests>=2.32.5
5-
httpx>=0.27.0
5+
# Strict replay sandbox routes outbound HTTP through a SOCKS proxy.
6+
httpx[socks]>=0.27.0
67

‎drift/instrumentation/flask/e2e-tests/.tusk/config.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,6 @@ recording:
2525

2626
replay:
2727
enable_telemetry: false
28+
sandbox:
29+
mode: strict
2830

0 commit comments

Comments
 (0)