mirror of
https://github.com/NousResearch/hermes-agent.git
synced 2026-07-31 19:16:29 +00:00
3e89edf830
Add a module-scoped `shared_container` fixture to tests/docker/conftest.py that boots one `sleep infinity` container per test module and tears it down at module exit. Convert read-only tests that previously used `docker run --rm --entrypoint sh/cat/test/su` (bypassing s6 to check static image properties) or `docker run -d` + `docker exec` (starting identical containers per test) to use `docker exec` on the shared container instead. Converted files: test_immutable_install_permissions.py — 2 throwaway runs → 2 execs test_license_file_present.py — 1 throwaway run → 1 exec test_tini_compat_shim.py — 1 throwaway run → 1 exec test_tui_prebuilt_bundle.py — 2 throwaway runs → 2 execs test_dump_build_sha.py — 2 throwaway runs → 2 execs test_immutable_install.py — 3 detached runs → 1 shared + 1 isolated test_dashboard.py — 2 detached runs → 0 (use shared) Local profiling shows docker run calls in these 7 files dropped from ~25 to 7 (the 7 are shared_container boots per module + the one test that needs a restart). Each eliminated `docker run` was paying 1-9s of s6 cont-init startup; the replacement `docker exec` calls average 0.10s — an ~50x speedup per operation. Tests that mutate state (restarts, config changes, gateway starts) still use their own containers via `container_name` + `start_container`.
49 lines
1.7 KiB
Python
49 lines
1.7 KiB
Python
"""Docker smoke tests for immutable install permissions."""
|
|
from __future__ import annotations
|
|
|
|
import textwrap
|
|
|
|
from tests.docker.conftest import docker_exec_sh
|
|
|
|
|
|
def test_container_sets_hosted_write_policy_env(shared_container: str) -> None:
|
|
script = (
|
|
'test "$HERMES_HOME" = "/opt/data" && '
|
|
'test "$HERMES_WRITE_SAFE_ROOT" = "/opt/data" && '
|
|
'test "$HERMES_DISABLE_LAZY_INSTALLS" = "1" && '
|
|
'test "$PYTHONDONTWRITEBYTECODE" = "1"'
|
|
)
|
|
r = docker_exec_sh(shared_container, script, timeout=30)
|
|
assert r.returncode == 0, r.stderr[-2000:]
|
|
|
|
|
|
def test_hermes_user_cannot_modify_install_but_can_write_data(
|
|
shared_container: str,
|
|
) -> None:
|
|
script = textwrap.dedent(
|
|
r"""
|
|
set -eu
|
|
/opt/hermes/.venv/bin/python - <<'PY'
|
|
from pathlib import Path
|
|
|
|
install_file = Path("/opt/hermes/agent/message_sanitization.py")
|
|
try:
|
|
with install_file.open("a", encoding="utf-8") as handle:
|
|
handle.write("\n# unexpected hosted mutation\n")
|
|
except PermissionError:
|
|
pass
|
|
else:
|
|
raise SystemExit("install source write unexpectedly succeeded")
|
|
|
|
skill_dir = Path("/opt/data/skills/permission-smoke")
|
|
skill_dir.mkdir(parents=True, exist_ok=True)
|
|
skill_file = skill_dir / "SKILL.md"
|
|
skill_file.write_text("# Permission smoke\n", encoding="utf-8")
|
|
if skill_file.read_text(encoding="utf-8") != "# Permission smoke\n":
|
|
raise SystemExit("data write verification failed")
|
|
PY
|
|
"""
|
|
).strip()
|
|
# Run as hermes user via docker_exec_sh's default user context.
|
|
r = docker_exec_sh(shared_container, script, timeout=60)
|
|
assert r.returncode == 0, r.stderr[-2000:]
|