Distribute docker container to run ATH

Jenkinsfile

@@ -0,0 +1,25 @@
+// For ci.jenkins.io
+// https://github.com/jenkins-infra/documentation/blob/master/ci.adoc
+
+def mavenName = 'mvn'
+def jdkName = 'jdk8'
+
+node('highram&&docker') {
+    withEnv([
+        "JAVA_HOME=${tool jdkName}",
+        "PATH+MAVEN=${tool mavenName}/bin:${env.JAVA_HOME}/bin"
+    ]) {
+        changelog scm
+
+        sh 'docker build --build-arg=uid=$(id -u) --build-arg=gid=$(id -g) -t jenkins/ath src/main/resources/ath-container'
+        String containerArgs = '-v /var/run/docker.sock:/var/run/docker.sock'
+        docker.image('jenkins/ath').inside(containerArgs) {
+            sh '''
+                eval $(./vnc.sh)
+                ./run.sh firefox latest -Dmaven.test.failure.ignore=true -DforkCount=1 -B
+            '''
+        }
+
+        junit 'target/surefire-reports/TEST-*.xml'
+    }
+}

README.md

@@ -33,6 +33,7 @@ it's own sandboxed workspace.
 * [Obtaining a report of plugins that were exercised](docs/EXERCISEDPLUGINSREPORTER.md)
 * [Managing the versions of Jenkins and plugins](docs/SUT-VERSIONS.md)
 * [Investigation](docs/INVESTIGATION.md)
+* [Running tests in container](docs/DOCKER.md)
 * Selecting tests based on plugins they cover (TODO)
 
 ### Writing tests

docs/DOCKER.md

@@ -0,0 +1,20 @@
+# Running tests in docker container
+
+Depending on the CI infrastructure setup one may need to run the ATH itself in a docker container with access to the host docker service, following a strategy similar to the one described in [this article](http://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/). When this is needed, the docker fixtures should not be accessed through mapped ports on the docker host, but directly through their container IP and port since they are "sibling" containers to the ATH. To enable this, set the environment variable SHARED_DOCKER_SERVICE=true, and then the functions ipBound(n) and port(n) will just return the container's IP and port where the fixture can be accessed.
+
+TO-DO: Instead of depending on setting this environment variable, in the future we could try to somehow automatically detect the situation.
+
+Interactive shell:
+
+    $ docker build --build-arg=uid=$(id -u) --build-arg=gid=$(id -g) -t jenkins/ath src/main/resources/ath-container
+    $ docker run -it --rm -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):/home/ath-user/ath --user ath-user jenkins/ath bash -c 'cd $HOME/ath && bash'
+    $ eval $(./vnc.sh)
+    $ ./run.sh firefox latest -Dmaven.test.failure.ignore=true -DforkCount=1 -B
+
+Jenkinsfile:
+
+    ... // Checkout ATH
+    sh 'docker build --build-arg=uid=$(id -u) --build-arg=gid=$(id -g) -t jenkins/ath src/main/resources/ath-container'
+    docker.image('jenkins/ath').inside {
+        sh 'eval $(./vnc.sh) && ./run.sh firefox latest -Dmaven.test.failure.ignore=true -DforkCount=1 -B'
+    }

docs/FIXTURES.md

@@ -76,15 +76,3 @@ public class TestContainer extends DockerContainer {
 ```
 
 In this case the docker file must be located at classpath and in `org/ame/fixture/test` instead of the default location.
-
-## Running the ATH itself as a docker container
-Depending on the CI infrastructure setup one may need to run the ATH itself in a docker container with access to the host docker service,
-following a strategy similar to the one described in [this article](http://jpetazzo.github.io/2015/09/03/do-not-use-docker-in-docker-for-ci/).
-
-When this is needed, the docker fixtures should not be accessed through mapped ports on the docker host, but directly
-through their container IP and port since they are "sibling" containers to the ATH.
-
-To enable this, set the environment variable `SHARED_DOCKER_SERVICE=true`, and then the functions ipBound(n) and port(n)
-will just return the container's IP and port where the fixture can be accessed.
-
-TO-DO: Instead of depending on setting this environment variable, in the future we could try to somehow automatically detect the situation.

src/main/resources/ath-container/Dockerfile

@@ -0,0 +1,44 @@
+# Dockerfile to be used to run ATH itself.
+#
+# see docs/DOCKER.md for usage
+#
+
+FROM debian:sid
+MAINTAINER ogondza@gmail.com
+
+RUN apt-get -y update && \
+    apt-get install -y \
+        curl \
+        docker.io \
+        imagemagick \
+        iptables \
+        firefox-esr \
+        maven \
+        openjdk-8-jdk \
+        vnc4server
+
+# Allow injecting uid and git to match directory ownership
+ARG uid=1000
+ENV uid $uid
+ARG gid=1000
+ENV gid $gid
+
+# So it is owned by root and has the permissions vncserver seems to require:
+RUN mkdir /tmp/.X11-unix && chmod 1777 /tmp/.X11-unix/
+
+RUN groupadd ath-user -g $gid && \
+    useradd ath-user -u $uid -g $gid -m -d /home/ath-user
+
+# TODO seems this can be picked up from the host, which is unwanted:
+ENV XAUTHORITY /home/ath-user/.Xauthority
+
+USER ath-user
+RUN mkdir /home/ath-user/.vnc && (echo ath-user; echo ath-user) | vncpasswd /home/ath-user/.vnc/passwd
+# Default content includes x-window-manager, which is not installed, plus other stuff we do not need (vncconfig, x-terminal-emulator, etc.):
+RUN touch /home/ath-user/.vnc/xstartup && chmod a+x /home/ath-user/.vnc/xstartup
+
+# Set SUID and SGID for docker binary so it can communicate with mapped socket its uid:gid we can not control. Alternative
+# approach used for this is adding ath-user to the group of /var/run/docker.sock but that require root permission we do not
+# have in ENTRYPOINT as the container is started as ath-user.
+USER root
+RUN chmod ug+s "$(which docker)"

vnc.sh

@@ -9,6 +9,8 @@ fi
 
 vncserver -kill $display
 vncserver -geometry 1750x1250 $display > /dev/null
-(vncviewer $display || vncviewer localhost$display) > /dev/null &
+if command -v vncviewer >/dev/null 2>&1; then
+  (vncviewer $display || vncviewer localhost$display) > /dev/null &
+fi
 
 echo export BROWSER_DISPLAY=$display