From cddad6791c2919b35b03753418743a29802a9472 Mon Sep 17 00:00:00 2001
From: Claudiu Belu <claudiu.belu@canonical.com>
Date: Thu, 17 Oct 2024 08:30:46 +0000
Subject: [PATCH] Changes rock base to bare

Switching to a bare-based image will reduce the overall image size and
reduces attack surface area.

``ddptool`` is not statically built, so it still depends on ``/lib`` and
``/lib64``, which is why we're adding ``base-files``. The image is
expected to run a bash script as the entrypoint.

We can no longer use ensure_image_contains_paths to check if files exist
in the rock images, since they are now bare-based. Instead, we can use
ensure_image_contains_paths_bare, which checks the image layers instead.
Because of this, we need sufficient permissions to check the
``/var/lib/docker`` folder.
---
 3.6.2/rockcraft.yaml                         | 9 ++++++++-
 tests/sanity/test_sriov_net_device_plugin.py | 4 ++--
 tests/tox.ini                                | 4 +++-
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/3.6.2/rockcraft.yaml b/3.6.2/rockcraft.yaml
index 1d74953..c630665 100644
--- a/3.6.2/rockcraft.yaml
+++ b/3.6.2/rockcraft.yaml
@@ -11,7 +11,7 @@ description: |
 license: Apache-2.0
 version: 3.6.2
 
-base: ubuntu@22.04
+base: bare
 build-base: ubuntu@22.04
 run-user: _daemon_
 
@@ -34,6 +34,13 @@ services:
 entrypoint-service: install-cni
 
 parts:
+  add-base-files:
+    plugin: nil
+    stage-packages:
+      - base-files
+      - bash
+      - coreutils
+
   build-deps:
     plugin: nil
     build-snaps:
diff --git a/tests/sanity/test_sriov_net_device_plugin.py b/tests/sanity/test_sriov_net_device_plugin.py
index 5c2aafe..0e30c01 100644
--- a/tests/sanity/test_sriov_net_device_plugin.py
+++ b/tests/sanity/test_sriov_net_device_plugin.py
@@ -20,7 +20,7 @@ def test_sriov_dpdk_rock():
     image = rock.image
 
     # check rock filesystem.
-    docker_util.ensure_image_contains_paths(image, ROCK_EXPECTED_FILES)
+    docker_util.ensure_image_contains_paths_bare(image, ROCK_EXPECTED_FILES)
 
     # check binary.
     process = docker_util.run_in_docker(image, ["sriovdp", "--help"], False)
@@ -31,5 +31,5 @@ def test_sriov_dpdk_rock():
     assert "DDPTool version 1.0.1.12" in process.stdout
 
     # check /entrypoint.sh script.
-    process = docker_util.run_in_docker(image, ["/entrypoint.sh"], False)
+    process = docker_util.run_in_docker(image, ["bash", "-x", "/entrypoint.sh"], False)
     assert "open /etc/pcidp/config.json: no such file or directory" in process.stderr
diff --git a/tests/tox.ini b/tests/tox.ini
index ffc76ce..a2e5fc3 100644
--- a/tests/tox.ini
+++ b/tests/tox.ini
@@ -35,8 +35,10 @@ commands =
 description = Run integration tests
 deps =
     -r {tox_root}/requirements-test.txt
+allowlist_externals =
+    sudo
 commands =
-    pytest -v \
+    sudo -E {envpython} -m pytest -v \
         --maxfail 1 \
         --tb native \
         --log-cli-level DEBUG \