test.sh

#!/bin/sh
# Integration tests for docker-socket-policy.
# Sends HTTP requests directly to the proxy's Docker API and checks status codes,
# and the deny message on every expected proxy 403.
# The proxy's RegistryGate, MountSourceGate, EnvFileGate, HostConfigGate (#88),
# CmdGate, NetworkEndpointsGate and ContainerConfigMutator are all exercised,
# the last two by starting real containers (#87); exec and attach are denied by the
# router, protocol upgrades by the handler (#76), non-read methods on the read
# endpoints by the router and CONNECT by the handler (#78), and every write on a
# second proxy run with --readonly (#75). Creates select their policy by
# container name (#85), and lifecycle actions reach only covered containers
# (#86).

set -e

PASS=0
FAIL=0

# The proxy listens on a Unix socket only, shared with this container through
# a volume. The host part of the URL is ignored when curl is given
# --unix-socket, but it still has to be present for the URL to parse.
PROXY_SOCK="${PROXY_SOCK:-/sock/proxy.sock}"
PROXY="http://localhost"

# busybox wget cannot speak to a Unix socket, so the helpers below need curl.
# It is baked into Dockerfile.test rather than installed here, so a run does
# not depend on the Alpine CDN being reachable.
if ! command -v curl >/dev/null 2>&1; then
  echo "ERROR: curl is missing from the test image (see deploy/Dockerfile.test)"
  exit 1
fi

# Bound every request. curl has no default overall timeout, so without this a
# proxy that accepts the connection and then never answers would hang the run
# instead of failing it — and the readiness counter below would never advance.
TIMEOUT="--max-time 10 --connect-timeout 2"

# The --readonly proxy (#75) serves the same config on its own socket.
PROXY_RO_SOCK="${PROXY_RO_SOCK:-/sock/readonly.sock}"

# Wait for a proxy to create and serve its socket.
wait_for_sock() {
  echo "Waiting for proxy at $1..."
  i=0
  while [ $i -lt 30 ]; do
    if curl -sf $TIMEOUT --unix-socket "$1" "$PROXY/_ping" >/dev/null 2>&1; then
      echo "Proxy ready."
      break
    fi
    printf "."
    sleep 1
    i=$((i + 1))
  done
  if [ $i -eq 30 ]; then
    echo ""
    echo "ERROR: Proxy at $1 failed to respond within 30s"
    exit 1
  fi
  echo ""
}
wait_for_sock "$PROXY_SOCK"
wait_for_sock "$PROXY_RO_SOCK"

# Helpers: report the HTTP status code of a request sent over the Unix socket.
# curl exits non-zero when it cannot connect at all, which under `set -e` would
# abort the run instead of reporting a failed assertion, so connection failures
# are normalised to the synthetic status 000.
# curl still prints %{http_code} when it exits non-zero, so the fallback only
# applies when it produced nothing at all. Overwriting unconditionally would
# discard a real status on a mid-response error and report it as 000.
# The response body goes to $BODY for check_denied. It is truncated first, so a
# request that gets no body cannot pass on the previous request's body.
BODY=$(mktemp)
trap 'rm -f "$BODY"' EXIT
get_status() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" "$1" 2>/dev/null || true)
  echo "${out:-000}"
}
post_json() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
    -X POST -H "Content-Type: application/json" -d "$1" "$2" 2>/dev/null || true)
  echo "${out:-000}"
}
post_empty() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
    -X POST -H "Content-Type: application/json" -d "" "$1" 2>/dev/null || true)
  echo "${out:-000}"
}
delete_status() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
    -X DELETE "$1" 2>/dev/null || true)
  echo "${out:-000}"
}

check() {
  desc="$1"
  expected="$2"
  actual="$3"
  if [ "$actual" = "$expected" ]; then
    echo "  PASS: $desc"
    PASS=$((PASS+1))
  else
    echo "  FAIL: $desc (expected $expected, got $actual)"
    FAIL=$((FAIL+1))
  fi
}

# check_denied DESC ACTUAL_STATUS BODY_FILE WANT_SUBSTRING [WANT_SUBSTRING...]
# Passes only on a 403 whose body contains one of the WANT_SUBSTRINGs, so a
# 403 from the daemon (or a different proxy deny) cannot pass for the one the
# check is about. The proxy's body is its plain-text deny message.
check_denied() {
  desc="$1"
  actual="$2"
  body_file="$3"
  shift 3
  if [ "$actual" = "403" ]; then
    for want in "$@"; do
      if grep -qF -- "$want" "$body_file"; then
        echo "  PASS: $desc"
        PASS=$((PASS+1))
        return 0
      fi
    done
  fi
  echo "  FAIL: $desc (expected 403 with \"$*\", got $actual: $(head -c 200 "$body_file"))"
  FAIL=$((FAIL+1))
}

echo ""
echo "============================================"
echo "  docker-socket-policy integration tests"
echo "============================================"
echo ""

# ─── Transport: Unix socket only ────────────────────────────────

# Regression guard. Every other assertion in this file goes over the Unix
# socket and would pass just as happily if the proxy were also serving TCP,
# so without this nothing here would notice a TCP listener coming back.
echo "--- Transport ---"

# Assert the specific failure rather than "curl failed somehow": exit 7 is
# connection refused, which proves the host resolved and nothing accepted on
# 2375. Treating any non-zero exit as success would also pass when the name
# does not resolve (exit 6), which proves nothing at all.
# `|| rc=$?` keeps set -e from aborting here: this curl is expected to fail,
# and a bare failing command would terminate the script before rc is read.
rc=0
curl -s -o /dev/null --max-time 3 --connect-timeout 2 \
  "http://${PROXY_HOST:-proxy}:2375/_ping" 2>/dev/null || rc=$?
case "$rc" in
  0)
    echo "  FAIL: proxy answered on TCP 2375 (it must listen on a Unix socket only)"
    FAIL=$((FAIL+1))
    ;;
  7)
    echo "  PASS: no TCP listener on 2375 (connection refused)"
    PASS=$((PASS+1))
    ;;
  *)
    echo "  FAIL: inconclusive TCP probe of ${PROXY_HOST:-proxy}:2375 (curl exit $rc);"
    echo "        expected 7 (connection refused). Exit 6 means the name did not"
    echo "        resolve, so this assertion would prove nothing."
    FAIL=$((FAIL+1))
    ;;
esac

# ─── Read-only endpoints (GET and HEAD allowed, #78) ────────────

echo "--- Read-only endpoints ---"

S=$(get_status "$PROXY/_ping")
check "GET /_ping -> 200" "200" "$S"

S=$(get_status "$PROXY/v1.45/_ping")
check "GET /v1.45/_ping -> 200 (API version stripped)" "200" "$S"

S=$(get_status "$PROXY/version")
check "GET /version -> 200" "200" "$S"

S=$(get_status "$PROXY/info")
check "GET /info -> 200" "200" "$S"

S=$(get_status "$PROXY/containers/json")
check "GET /containers/json -> 200" "200" "$S"

# ─── Denied endpoints ───────────────────────────────────────

echo ""
echo "--- Denied endpoints ---"

S=$(post_empty "$PROXY/containers/test/exec")
check_denied "POST /containers/*/exec -> 403" "$S" "$BODY" 'exec is not allowed'

S=$(post_empty "$PROXY/exec/abc123/start")
check_denied "POST /exec/*/start -> 403" "$S" "$BODY" 'exec is not allowed'

S=$(post_empty "$PROXY/build")
check_denied "POST /build -> 403" "$S" "$BODY" 'build is not allowed'

S=$(post_empty "$PROXY/commit")
check_denied "POST /commit -> 403" "$S" "$BODY" 'commit is not allowed'

S=$(post_empty "$PROXY/auth")
check_denied "POST /auth -> 403" "$S" "$BODY" 'auth endpoint is not allowed'

# ─── Container create — image validation ───────────────────

echo ""
echo "--- Image validation ---"

# Allowed image reaches Docker daemon, which returns 404 (image doesn't exist)
# The key is that the proxy does NOT return 403 — the request is allowed.
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: create with allowed image -> $S (not 403)"
  PASS=$((PASS+1))
else
  echo "  FAIL: create with allowed image (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

S=$(post_json '{"Image":"alpine:latest","Cmd":["sh"]}' "$PROXY/containers/create")
check_denied "create with unlisted image -> 403" "$S" "$BODY" 'image alpine:latest not allowed by any policy'

# Another allowed image prefix
S=$(post_json '{"Image":"ethpandaops/lodestar:latest","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: create with ethpandaops image -> $S (not 403)"
  PASS=$((PASS+1))
else
  echo "  FAIL: create with ethpandaops image (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

S=$(post_json '{"Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "create with no image -> 403" "$S" "$BODY" 'image field is required'

# ─── Container create — privileged mode ──────────────────

echo ""
echo "--- Privileged mode ---"

# ContainerConfigMutator sets HostConfig.Privileged=false, so request passes
# through to Docker. Daemon returns 404 (image doesn't exist).
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","HostConfig":{"Privileged":true},"Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: create with privileged=true -> $S (mutated, not denied)"
  PASS=$((PASS+1))
else
  echo "  FAIL: create with privileged=true (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

# ─── Volume validation ───────────────────────────────────

echo ""
echo "--- Volume validation ---"

S=$(post_json '{"Image":"chainsafe/lodestar:beacon","HostConfig":{"Binds":["/home/beacon:/data"]},"Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: create with allowed volume -> $S (not 403)"
  PASS=$((PASS+1))
else
  echo "  FAIL: create with allowed volume (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

S=$(post_json '{"Image":"chainsafe/lodestar:beacon","HostConfig":{"Binds":["/tmp:/tmp"]},"Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "create with unlisted volume -> 403" "$S" "$BODY" 'volume mount "/tmp" is not in the whitelist'

# ─── HostConfig default-deny (#88) ───────────────────────

# Before #88 only the host path of HostConfig.Binds was checked, so each of
# these reached the daemon unchanged. /etc/jwt_dir is read_write: false in
# deploy/config/beacon.yaml. The allowed creates reach the daemon, which
# answers 404 (image not present) or 201: anything but a proxy 403.
echo ""
echo "--- HostConfig default-deny ---"

# check_not_denied DESC ACTUAL_STATUS [ALSO_OK]
# ALSO_OK is one more daemon status to accept: a Mounts bind whose source is
# missing on the daemon's host gets 400 from the daemon, not from the proxy.
check_not_denied() {
  if [ "$2" = "201" ] || [ "$2" = "404" ] || { [ -n "${3:-}" ] && [ "$2" = "$3" ]; }; then
    echo "  PASS: $1 -> $2 (not 403)"
    PASS=$((PASS+1))
  else
    echo "  FAIL: $1 (expected 201|404, got $2: $(head -c 200 "$BODY"))"
    FAIL=$((FAIL+1))
  fi
}

# create_hc HOSTCONFIG_JSON: a create for the beacon policy with this HostConfig.
create_hc() {
  post_json "{\"Image\":\"chainsafe/lodestar:beacon\",\"Cmd\":[\"--rcConfig\",\"/data/config.yml\"],\"HostConfig\":$1}" "$PROXY/containers/create"
}

S=$(create_hc '{"Mounts":[{"Type":"bind","Source":"/","Target":"/host"}]}')
check_denied "create with Mounts bind of / -> 403" "$S" "$BODY" 'mount source "/" is not in the whitelist'

S=$(create_hc '{"Mounts":[{"Type":"volume","Source":"dsp-test","Target":"/v"}]}')
check_denied "create with a volume-type mount -> 403" "$S" "$BODY" 'mount type "volume" is not allowed'

S=$(create_hc '{"Mounts":[{"Type":"bind","Source":"/etc/jwt_dir","Target":"/jwtdir"}]}')
check_denied "create with read-only volume in Mounts without ReadOnly -> 403" "$S" "$BODY" 'mount of "/etc/jwt_dir" must be read-only'

S=$(create_hc '{"Mounts":[{"Type":"bind","Source":"/etc/jwt_dir","Target":"/jwtdir","ReadOnly":true}]}')
check_not_denied "create with read-only volume in Mounts, ReadOnly: true" "$S" 400

S=$(create_hc '{"Binds":["/etc/jwt_dir:/jwtdir:rw"]}')
check_denied "create with read-only volume bound :rw -> 403" "$S" "$BODY" 'volume mount "/etc/jwt_dir" must be read-only (:ro)'

S=$(create_hc '{"Binds":["/etc/jwt_dir:/jwtdir"]}')
check_denied "create with read-only volume bound with no mode -> 403" "$S" "$BODY" 'volume mount "/etc/jwt_dir" must be read-only (:ro)'

S=$(create_hc '{"Binds":["/etc/jwt_dir:/jwtdir:ro"]}')
check_not_denied "create with read-only volume bound :ro" "$S"

S=$(create_hc '{"Binds":["/home/beacon:/data:rshared"]}')
check_denied "create with an rshared bind -> 403" "$S" "$BODY" 'bind option "rshared" on volume mount "/home/beacon" is not allowed'

S=$(create_hc '{"CapAdd":["SYS_ADMIN"]}')
check_denied "create with CapAdd -> 403" "$S" "$BODY" 'HostConfig.CapAdd is not allowed for service beacon'

S=$(create_hc '{"PidMode":"host"}')
check_denied "create with PidMode host -> 403" "$S" "$BODY" 'HostConfig.PidMode value "host" is not allowed'

S=$(create_hc '{"Devices":[{"PathOnHost":"/dev/null","PathInContainer":"/dev/x","CgroupPermissions":"rwm"}]}')
check_denied "create with Devices -> 403" "$S" "$BODY" 'HostConfig.Devices is not allowed'

S=$(create_hc '{"GroupAdd":["0"]}')
check_denied "create with GroupAdd -> 403" "$S" "$BODY" 'HostConfig.GroupAdd is not allowed'

S=$(create_hc '{"MaskedPaths":[]}')
check_denied "create with MaskedPaths [] -> 403" "$S" "$BODY" 'HostConfig.MaskedPaths is not allowed'

# The daemon matches field names without regard to case, so this would set
# Privileged after the mutator's "Privileged": false.
S=$(create_hc '{"privileged":true}')
check_denied "create with lower-case privileged -> 403" "$S" "$BODY" 'HostConfig.privileged is not allowed'

# At the top level: the router picks the policy and RegistryGate checks the
# image from "Image", but the daemon would run the one under "image".
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","image":"alpine:latest","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "create with an extra lower-case image -> 403" "$S" "$BODY" 'image is not allowed for service beacon (the daemon reads it as Image)'

# The same inside NetworkingConfig: NetworkEndpointsGate (#87) reads only
# EndpointsConfig, and the daemon would attach the network under
# endpointsconfig as well.
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml"],"NetworkingConfig":{"EndpointsConfig":{"default":{}},"endpointsconfig":{"evil-net":{}}}}' "$PROXY/containers/create")
check_denied "create with lower-case endpointsconfig -> 403" "$S" "$BODY" 'NetworkingConfig.endpointsconfig is not allowed'

# The body Docker CLI 29 sends for `docker create <image> <cmd>`, sent on API
# v1.45 like the rest of the suite: the CI runner's daemon is older than CLI 29.
S=$(post_json '{"Hostname":"","Domainname":"","User":"","AttachStdin":false,"AttachStdout":true,"AttachStderr":true,"Tty":false,"OpenStdin":false,"StdinOnce":false,"Env":null,"Cmd":["--rcConfig","/data/config.yml"],"Image":"chainsafe/lodestar:beacon","Volumes":{},"WorkingDir":"","Entrypoint":null,"Labels":{},"HostConfig":{"Binds":null,"ContainerIDFile":"","LogConfig":{"Type":"","Config":{}},"NetworkMode":"default","PortBindings":{},"RestartPolicy":{"Name":"no","MaximumRetryCount":0},"AutoRemove":false,"VolumeDriver":"","VolumesFrom":null,"ConsoleSize":[0,0],"CapAdd":null,"CapDrop":null,"CgroupnsMode":"","Dns":null,"DnsOptions":[],"DnsSearch":[],"ExtraHosts":null,"GroupAdd":null,"IpcMode":"","Cgroup":"","Links":null,"OomScoreAdj":0,"PidMode":"","Privileged":false,"PublishAllPorts":false,"ReadonlyRootfs":false,"SecurityOpt":null,"UTSMode":"","UsernsMode":"","ShmSize":0,"Isolation":"","CpuShares":0,"Memory":0,"NanoCpus":0,"CgroupParent":"","BlkioWeight":0,"BlkioWeightDevice":[],"BlkioDeviceReadBps":[],"BlkioDeviceWriteBps":[],"BlkioDeviceReadIOps":[],"BlkioDeviceWriteIOps":[],"CpuPeriod":0,"CpuQuota":0,"CpuRealtimePeriod":0,"CpuRealtimeRuntime":0,"CpusetCpus":"","CpusetMems":"","Devices":[],"DeviceCgroupRules":null,"DeviceRequests":null,"MemoryReservation":0,"MemorySwap":0,"MemorySwappiness":-1,"OomKillDisable":false,"PidsLimit":0,"Ulimits":null,"CpuCount":0,"CpuPercent":0,"IOMaximumIOps":0,"IOMaximumBandwidth":0,"MaskedPaths":null,"ReadonlyPaths":null},"NetworkingConfig":{"EndpointsConfig":{"default":{}}}}' "$PROXY/v1.45/containers/create")
check_not_denied "create with the Docker CLI 29 default body" "$S"

# ─── Inline env vars (env_file is set in policy) ─────────

echo ""
echo "--- Inline environment variables ---"

S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Env":["VALIDATOR_KEY=secret"],"Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "create with inline env -> 403" "$S" "$BODY" 'inline environment variables are not allowed for service'

# ─── CLI flag validation ────────────────────────────────

echo ""
echo "--- CLI flag validation ---"

# --privileged is in denied_flags -> proxy denies
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--privileged","--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "create with --privileged flag -> 403" "$S" "$BODY" 'flag "--privileged" is denied for service'

# Allowed flags, request passes through to Docker
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml","--logLevel","info"]}' "$PROXY/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: create with allowed flags -> $S (not 403)"
  PASS=$((PASS+1))
else
  echo "  FAIL: create with allowed flags (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

# ─── Docker API passthrough ─────────────────────────────

echo ""
echo "--- Docker API passthrough ---"

# #83: image pulls are routed on the query string, as the Docker CLI sends
# them: fromImage (fully qualified, URL-encoded) and tag, with an empty body.
# config/pull-allowed.yaml allows busybox:latest, a few MB, so the allowed pull
# runs to completion against the daemon: 200 and a stream with no error in it.
# The image is sent as docker.io/library/busybox, so the check also covers
# normalisation of the policy's bare busybox prefix (#84). Before
# #83 every such pull was denied with "empty request body".
# pull_query QUERY [BODY [CONTENT_TYPE [HEADER]]]: POST /images/create?QUERY,
# empty body unless given, JSON unless CONTENT_TYPE is given.
pull_query() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' --max-time 120 --connect-timeout 2 --unix-socket "$PROXY_SOCK" \
    -X POST -H "Content-Type: ${3:-application/json}" ${4:+-H "$4"} -d "${2:-}" \
    "$PROXY/v1.45/images/create?$1" 2>/dev/null || true)
  echo "${out:-000}"
}

S=$(pull_query 'fromImage=docker.io%2Flibrary%2Fbusybox&tag=latest')
if [ "$S" = "200" ] && grep -q '"status"' "$BODY" && ! grep -q '"error' "$BODY"; then
  echo "  PASS: pull allowed image the CLI way -> 200 (pulled)"
  PASS=$((PASS+1))
else
  echo "  FAIL: pull allowed image the CLI way (expected 200 and a clean pull, got $S: $(head -c 200 "$BODY"))"
  FAIL=$((FAIL+1))
fi

S=$(pull_query 'fromImage=docker.io%2Flibrary%2Falpine&tag=latest')
check_denied "pull unlisted image the CLI way -> 403" "$S" "$BODY" 'image docker.io/library/alpine not allowed by any policy'

S=$(pull_query 'fromImage=alpine&tag=latest')
check_denied "pull alpine (unlisted, short name) -> 403" "$S" "$BODY" 'image alpine not allowed by any policy'

# #83: pull-allowed.yaml's tag pattern applies to pulls as it does to creates.
S=$(pull_query 'fromImage=busybox&tag=musl')
check_denied "pull allowed image with a tag outside the pattern -> 403" "$S" "$BODY" 'image tag "musl" does not match pattern'

# #83: a pull has no body. Before #83 an allowed image in a JSON body
# forwarded a pull of the query's image (alpine here, pulled for real). The
# daemon reads a form body over the query, so routing on the query and
# forwarding the body would let a form body name any image: with busybox
# (allowed) in the query and alpine in the form body, the daemon pulls
# alpine. Every body is denied, whatever its Content-Type or framing.
body_msg='image pull must not have a request body'
S=$(pull_query 'fromImage=alpine&tag=latest' '{"fromImage":"chainsafe/lodestar"}')
check_denied "pull with allowed image in JSON body, unlisted in query -> 403" "$S" "$BODY" "$body_msg"

S=$(pull_query 'fromImage=busybox&tag=latest' 'fromImage=alpine&tag=3.19' 'application/x-www-form-urlencoded')
check_denied "pull with allowed image in query, unlisted in form body -> 403" "$S" "$BODY" "$body_msg"

S=$(pull_query 'fromImage=busybox&tag=latest' 'fromImage=alpine&tag=3.19' 'application/x-www-form-urlencoded' 'Transfer-Encoding: chunked')
check_denied "pull with a chunked form body -> 403" "$S" "$BODY" "$body_msg"

# #83: an import (fromSrc) would store any tarball under an allowed name.
S=$(pull_query 'fromSrc=http%3A%2F%2F127.0.0.1%3A9%2Fx.tar&repo=chainsafe%2Flodestar&tag=imported')
check_denied "image import (fromSrc) -> 403" "$S" "$BODY" 'image import (fromSrc) is not allowed'

# ─── Endpoint completeness ─────────────────────────────

echo ""
echo "--- Unrecognized endpoints ---"

S=$(post_empty "$PROXY/networks/create")
check_denied "POST /networks/create -> 403" "$S" "$BODY" 'endpoint POST /networks/create is not allowed'

S=$(post_empty "$PROXY/volumes/create")
check_denied "POST /volumes/create -> 403" "$S" "$BODY" 'endpoint POST /volumes/create is not allowed'

S=$(post_empty "$PROXY/containers/test")
check_denied "POST /containers/test -> 403 (no action segment)" "$S" "$BODY" 'endpoint POST /containers/test is not allowed'

# Reserved path segments (#24). /containers/json is the list endpoint, not a
# container called "json". Treating it as a container name sent the request
# down the lifecycle path, where an unknown container is allowed through, so Go
# allowed this while Rust and TypeScript denied it.
S=$(delete_status "$PROXY/containers/json")
check_denied "DELETE /containers/json -> 403 (reserved, not a container)" "$S" "$BODY" 'endpoint DELETE /containers/json is not allowed'

S=$(delete_status "$PROXY/containers/create")
check_denied "DELETE /containers/create -> 403 (reserved, not a container)" "$S" "$BODY" 'endpoint DELETE /containers/create is not allowed'

# Listing must still work: it reaches the GET/HEAD passthrough instead.
S=$(get_status "$PROXY/containers/json")
check "GET /containers/json -> 200 (still the list endpoint)" "200" "$S"

# Empty name segment (#48). /containers/ and /containers//start carry no
# container name. Treating "" as a name sent the request down the lifecycle
# path, where an unknown container is allowed through, so Rust forwarded these
# while Go and TypeScript denied them.
S=$(delete_status "$PROXY/containers/")
check_denied "DELETE /containers/ -> 403 (empty name, not a container)" "$S" "$BODY" 'endpoint DELETE /containers/ is not allowed'

S=$(post_empty "$PROXY/containers//start")
check_denied "POST /containers//start -> 403 (empty name, not a container)" "$S" "$BODY" 'empty path segment not allowed'

# Dotted API-version prefix (#52). The Docker CLI versions every request
# (/v1.45/containers/...). The proxy must strip the prefix and route the rest
# like the unversioned path: a lifecycle call reaches the lifecycle branch, and
# a reserved segment is still denied. No policy covers no-such-container, so
# the proxy asks the daemon (404) and denies it as unmanaged (#86); the
# default deny would name the endpoint instead.
# TypeScript only stripped undotted prefixes, so these fell to the default deny.
S=$(post_empty "$PROXY/v1.45/containers/no-such-container/start")
check_denied "POST /v1.45/containers/*/start -> 403 (lifecycle branch, unmanaged)" "$S" "$BODY" 'container no-such-container is not managed by any policy'

S=$(delete_status "$PROXY/v1.45/containers/json")
check_denied "DELETE /v1.45/containers/json -> 403 (reserved survives version strip)" "$S" "$BODY" 'endpoint DELETE /containers/json is not allowed'

# #57: /volumes/ is not an API-version prefix. The daemon would run a volume
# removal; the proxy must not classify it as a container delete.
S=$(delete_status "$PROXY/volumes/containers/no-such-container")
check_denied "DELETE /volumes/containers/no-such-container -> 403 (not a version prefix)" "$S" "$BODY" 'endpoint DELETE /volumes/containers/no-such-container is not allowed'

# #52: versioned create, the `docker run` path. Mirrors the unversioned
# allowed-image create above: the daemon answers 201, or 404 when the image is
# not present locally — anything but a proxy 403.
S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/v1.45/containers/create")
if [ "$S" = "201" ] || [ "$S" = "404" ]; then
  echo "  PASS: POST /v1.45/containers/create with allowed image -> $S (not 403)"
  PASS=$((PASS+1))
else
  echo "  FAIL: POST /v1.45/containers/create with allowed image (expected 201|404, got $S)"
  FAIL=$((FAIL+1))
fi

# #53: percent-encoded paths. The daemon decodes the path before it routes,
# so the proxy and the daemon could read the same request differently; any %
# in the path is denied. curl sends the path as written (it does not decode
# %XX, and there are no dot segments to squash). The query string is never
# inspected: an encoded filter, as `docker ps --filter` sends, still passes.
S=$(delete_status "$PROXY/containers/no-such%20x")
check_denied "DELETE /containers/no-such%20x -> 403 (percent-encoded path)" "$S" "$BODY" 'percent-encoded path not allowed'

S=$(delete_status "$PROXY/containers/%2F")
check_denied "DELETE /containers/%2F -> 403 (percent-encoded path)" "$S" "$BODY" 'percent-encoded path not allowed'

# The handler tests prove the query reaches the daemon unchanged; this check
# proves an encoded query is not denied.
S=$(get_status "$PROXY/v1.45/containers/json?filters=%7B%22status%22%3A%5B%22running%22%5D%7D")
check "GET /v1.45/containers/json?filters=<encoded> -> 200 (query not inspected)" "200" "$S"

# #49: exec and create are matched on whole path segments. Exec is denied for
# every method under /containers/<name>/exec and /exec/, GET included (exec
# inspect leaks command lines). A name that only starts with exec reaches the
# daemon (404, no such container — not a proxy 403). A create path with extra
# segments is not the create endpoint, even with an allowed image.
S=$(delete_status "$PROXY/containers/no-such/exec")
check_denied "DELETE /containers/*/exec -> 403 (exec subpath, any method)" "$S" "$BODY" 'exec is not allowed'

S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create/extra")
check_denied "POST /containers/create/extra -> 403 (not the create endpoint)" "$S" "$BODY" 'endpoint POST /containers/create/extra is not allowed'

S=$(post_empty "$PROXY/containers/exec-nosuch/start")
check_denied "POST /containers/exec-nosuch/start -> 403 (a name, not exec; unmanaged, #86)" "$S" "$BODY" 'container exec-nosuch is not managed by any policy'

S=$(get_status "$PROXY/exec/0000000000000000000000000000000000000000000000000000000000000000/json")
check_denied "GET /exec/*/json -> 403 (exec inspect denied)" "$S" "$BODY" 'exec is not allowed'

# #55: an empty interior segment is denied for every method. Before #55 the
# empty first segment of //exec/... hid the exec namespace and the GET
# passthrough forwarded it. --path-as-is stops curl from collapsing the //.
: >"$BODY"
S=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --path-as-is --unix-socket "$PROXY_SOCK" \
  "$PROXY//exec/0000000000000000000000000000000000000000000000000000000000000000/json" 2>/dev/null || true)
S="${S:-000}"
check_denied "GET //exec/*/json -> 403 (empty segment)" "$S" "$BODY" 'empty path segment not allowed'

# #55: an absolute-form request target. Before #55 the TypeScript router saw
# the raw target, whose first segment is "http:", and forwarded exec inspect;
# the daemon answered 404 for this unknown ID (200 with the command line for a
# real one). Go and Rust route on the parsed path, /exec/..., and deny it as
# exec; TypeScript routes the raw target and denies its "//" as an empty
# segment. Either proxy deny passes; a daemon 403 does not.
: >"$BODY"
S=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
  --request-target "http://docker/exec/0000000000000000000000000000000000000000000000000000000000000000/json" \
  "$PROXY/" 2>/dev/null || true)
S="${S:-000}"
check_denied "GET http://docker/exec/*/json -> 403 (absolute-form target)" "$S" "$BODY" \
  'exec is not allowed' 'empty path segment not allowed'

# #76: attach is denied by the router for every method, and any protocol
# upgrade is refused by the handler before routing. Before #76 a websocket
# attach went through the GET passthrough and Go relayed the daemon's 101,
# handing the caller the container's stdin. The target is this test
# container (its hostname is its short ID), so on a proxy without the fix the
# daemon answers 101, not 404. curl does not speak websocket over http://, so
# it reports the status and waits for the body until --max-time.
upgrade_get() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
    -H 'Upgrade: websocket' -H 'Connection: Upgrade' -H 'Sec-WebSocket-Version: 13' \
    -H 'Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==' "$1" 2>/dev/null || true)
  echo "${out:-000}"
}

S=$(upgrade_get "$PROXY/containers/$(hostname)/attach/ws?stdin=1&stream=1")
check_denied "GET /containers/*/attach/ws with Upgrade: websocket -> 403 (upgrade refused)" "$S" "$BODY" 'protocol upgrade not allowed'

S=$(get_status "$PROXY/containers/no-such-container/attach/ws")
check_denied "GET /containers/*/attach/ws -> 403 (attach denied)" "$S" "$BODY" 'attach is not allowed'

S=$(upgrade_get "$PROXY/_ping")
check_denied "GET /_ping with Upgrade: websocket -> 403 (upgrade refused)" "$S" "$BODY" 'protocol upgrade not allowed'

# #78: the read endpoints admit only GET and HEAD. Before #78 an early router
# clause allowed /_ping, /version, /info and /events… for every method, so the
# daemon answered POST /_ping. CONNECT is refused by the handler before
# routing; before #78 the TypeScript proxy dropped it with no response.
# method_status METHOD URL [CURL_ARGS...]
method_status() {
  : >"$BODY"
  m="$1"
  u="$2"
  shift 2
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --unix-socket "$PROXY_SOCK" \
    -X "$m" "$@" "$u" 2>/dev/null || true)
  echo "${out:-000}"
}

S=$(method_status POST "$PROXY/_ping")
check_denied "POST /_ping -> 403 (read endpoint, GET/HEAD only)" "$S" "$BODY" 'endpoint POST /_ping is not allowed'

S=$(method_status DELETE "$PROXY/version")
check_denied "DELETE /version -> 403 (read endpoint, GET/HEAD only)" "$S" "$BODY" 'endpoint DELETE /version is not allowed'

S=$(method_status OPTIONS "$PROXY/_ping")
check_denied "OPTIONS /_ping -> 403 (CORS preflight denied)" "$S" "$BODY" 'endpoint OPTIONS /_ping is not allowed'

S=$(method_status CONNECT "$PROXY/_ping")
check_denied "CONNECT /_ping -> 403 (CONNECT refused)" "$S" "$BODY" 'CONNECT is not allowed'

S=$(method_status CONNECT "$PROXY/" --request-target localhost:80)
check_denied "CONNECT localhost:80 -> 403 (CONNECT refused, authority form)" "$S" "$BODY" 'CONNECT is not allowed'

S=$(method_status HEAD "$PROXY/_ping" -I)
check "HEAD /_ping -> 200" "200" "$S"

S=$(get_status "$PROXY/events?since=1&until=2")
check "GET /events (bounded) -> 200" "200" "$S"

# #70: a . or .. segment is denied for every method, reads included. Before
# #70 the leading . of /./exec/... (or the x of /x/../exec/...) hid the exec
# namespace and the GET passthrough forwarded it; the daemon answered 301 to
# the clean path. --path-as-is stops curl from resolving the dots.
dot_get() {
  : >"$BODY"
  out=$(curl -s -o "$BODY" -w '%{http_code}' $TIMEOUT --path-as-is --unix-socket "$PROXY_SOCK" \
    "$1" 2>/dev/null || true)
  echo "${out:-000}"
}

S=$(dot_get "$PROXY/./exec/0000000000000000000000000000000000000000000000000000000000000000/json")
check_denied "GET /./exec/*/json -> 403 (dot segment)" "$S" "$BODY" 'dot path segment not allowed'

S=$(dot_get "$PROXY/x/../exec/0000000000000000000000000000000000000000000000000000000000000000/json")
check_denied "GET /x/../exec/*/json -> 403 (dot segment)" "$S" "$BODY" 'dot path segment not allowed'

S=$(dot_get "$PROXY/containers/./json")
check_denied "GET /containers/./json -> 403 (dot segment)" "$S" "$BODY" 'dot path segment not allowed'

# ─── Forced network_mode and NetworkingConfig (#87) ──────

# A policy that forces network_mode must also make the endpoint entries match
# it. Without --network the Docker CLI sends EndpointsConfig {"default": {}};
# before #87 the proxy forwarded that as sent, the create succeeded, and the
# start failed with "network default not found". These create and START real
# containers through the proxy, as the CLI does, under the net-host (host) and
# net-none (none) policies in deploy/config, then remove them.
echo ""
echo "--- Forced network_mode (#87) ---"

# pull IMAGE TAG: pull through the proxy the way the Docker CLI does,
# fromImage and tag in the query string and no body (#83); see pull_query.
pull() {
  pull_query "fromImage=$1&tag=$2"
}

# start_forced NAME IMAGE MODE: create NAME as the CLI does, start it, and
# remove it. A leftover from an earlier run is removed first.
start_forced() {
  delete_status "$PROXY/containers/$1?force=true" >/dev/null
  S=$(post_json "{\"Image\":\"$2\",\"HostConfig\":{},\"NetworkingConfig\":{\"EndpointsConfig\":{\"default\":{}}}}" \
    "$PROXY/containers/create?name=$1")
  check "create $1 with EndpointsConfig {\"default\":{}} -> 201 (network_mode $3)" "201" "$S"
  S=$(post_empty "$PROXY/containers/$1/start")
  check "start $1 -> 204 (network_mode $3)" "204" "$S"
  [ "$S" = "204" ] || echo "        start body: $(head -c 200 "$BODY")"
  S=$(delete_status "$PROXY/containers/$1?force=true")
  check "remove $1 -> 204" "204" "$S"
}

S=$(pull hello-world latest)
check "pull hello-world (net-host policy) -> 200" "200" "$S"
start_forced net-host hello-world:latest host

S=$(pull registry.k8s.io/pause 3.10)
check "pull registry.k8s.io/pause (net-none policy) -> 200" "200" "$S"
start_forced net-none registry.k8s.io/pause:3.10 none

# An extra endpoint entry would attach the container to a network the policy
# does not allow, so it is denied, not dropped.
S=$(post_json '{"Image":"hello-world:latest","NetworkingConfig":{"EndpointsConfig":{"default":{},"bridge":{}}}}' \
  "$PROXY/containers/create?name=net-host")
check_denied "create with an extra endpoint under network_mode host -> 403" "$S" "$BODY" \
  'network "bridge" is not allowed for service net-host; policy forces network_mode host'
# Without the deny the create succeeds; do not leave the container behind.
delete_status "$PROXY/containers/net-host?force=true" >/dev/null

# ─── Container names (#85) and lifecycle coverage (#86) ──────

# deploy/config/dsp-it-a.yaml and dsp-it-b.yaml allow this test runner's own
# image, which every run has locally, under container_names dsp-it-a and
# dsp-it-b, and force different users. This runner's container is covered by
# no policy: it stands for an operator container. Its hostname is its short ID.
echo ""
echo "--- Container names (#85) and lifecycle coverage (#86) ---"

SELF=$(hostname)
: >"$BODY"
curl -s -o "$BODY" $TIMEOUT --unix-socket "$PROXY_SOCK" "$PROXY/containers/$SELF/json" 2>/dev/null || true
SELF_ID=$(sed -n 's/.*"Id":"\([0-9a-f]\{64\}\)".*/\1/p' "$BODY")
SELF_NAME=$(sed -n 's/.*"Name":"\/\([^"]*\)".*/\1/p' "$BODY")
IT_IMAGE=$(sed -n 's/.*"Image":"\(docker-socket-policy-test-[a-z]*-test[^"]*\)".*/\1/p' "$BODY")
if [ -z "$SELF_ID" ] || [ -z "$SELF_NAME" ] || [ -z "$IT_IMAGE" ]; then
  echo "  FAIL: could not inspect the test container (id=$SELF_ID name=$SELF_NAME image=$IT_IMAGE)"
  FAIL=$((FAIL+1))
fi
IT_BODY="{\"Image\":\"$IT_IMAGE\",\"Cmd\":[\"sleep\",\"300\"]}"

# Leftovers from an interrupted run. Both names are covered, so this is allowed.
delete_status "$PROXY/containers/dsp-it-a?force=1" >/dev/null
delete_status "$PROXY/containers/dsp-it-b?force=1" >/dev/null

# #85: both policies allow the image. Before #85 the one applied was whichever
# came first in map order (Go, Rust) or load order (TypeScript), so one of the
# two names got the other's user. Five rounds, each create inspected.
OK_A=0
OK_B=0
i=0
while [ $i -lt 5 ]; do
  for n in a b; do
    case "$n" in a) want='1111:1111' ;; b) want='2222:2222' ;; esac
    S=$(post_json "$IT_BODY" "$PROXY/containers/create?name=dsp-it-$n")
    : >"$BODY"
    curl -s -o "$BODY" $TIMEOUT --unix-socket "$PROXY_SOCK" "$PROXY/containers/dsp-it-$n/json" 2>/dev/null || true
    if [ "$S" = "201" ] && grep -qF "\"User\":\"$want\"" "$BODY"; then
      case "$n" in a) OK_A=$((OK_A+1)) ;; b) OK_B=$((OK_B+1)) ;; esac
    fi
    delete_status "$PROXY/containers/dsp-it-$n?force=1" >/dev/null
  done
  i=$((i + 1))
done
check "create ?name=dsp-it-a x5 -> 201 with policy dsp-it-a's user every time (#85)" "5" "$OK_A"
check "create ?name=dsp-it-b x5 -> 201 with policy dsp-it-b's user every time (#85)" "5" "$OK_B"

# remove_if_created STATUS: a proxy without the fix creates these; remove the
# container so it does not outlive the run (or block the next one).
remove_if_created() {
  if [ "$1" = "201" ]; then
    id=$(sed -n 's/.*"Id":"\([0-9a-f]\{64\}\)".*/\1/p' "$BODY")
    cp "$BODY" "$BODY.keep"
    [ -n "$id" ] && delete_status "$PROXY/containers/$id?force=1" >/dev/null
    mv "$BODY.keep" "$BODY"
  fi
}

S=$(post_json "$IT_BODY" "$PROXY/containers/create?name=dsp-it-c")
remove_if_created "$S"
check_denied "create ?name=dsp-it-c -> 403 (no policy accepts the name, #85)" "$S" "$BODY" "container name dsp-it-c not allowed for image $IT_IMAGE by any policy"

# The daemon takes the first of a repeated name (r.Form.Get); the proxy denies
# the request rather than guess which one an auditor would read.
S=$(post_json "$IT_BODY" "$PROXY/containers/create?name=dsp-it-a&name=dsp-it-c")
remove_if_created "$S"
check_denied "create ?name=dsp-it-a&name=dsp-it-c -> 403 (duplicate name, #85)" "$S" "$BODY" 'duplicate name query parameter'

S=$(post_json "$IT_BODY" "$PROXY/containers/create")
remove_if_created "$S"
check_denied "create without ?name= -> 403 (both policies set container_names, #85)" "$S" "$BODY" "image $IT_IMAGE requires a container name"

# #86: lifecycle actions and DELETE on a covered container, by name, full ID
# and short ID, reach the daemon.
S=$(post_json "$IT_BODY" "$PROXY/containers/create?name=dsp-it-a")
IT_ID=$(sed -n 's/.*"Id":"\([0-9a-f]\{64\}\)".*/\1/p' "$BODY")
check "create ?name=dsp-it-a -> 201" "201" "$S"
IT_SHORT=$(echo "$IT_ID" | cut -c1-12)

S=$(post_empty "$PROXY/containers/dsp-it-a/start")
check "POST /containers/dsp-it-a/start -> 204 (covered name)" "204" "$S"

S=$(post_empty "$PROXY/containers/$IT_ID/kill")
check "POST /containers/<full ID of dsp-it-a>/kill -> 204 (resolved, covered)" "204" "$S"

S=$(post_empty "$PROXY/v1.45/containers/$IT_SHORT/start")
check "POST /v1.45/containers/<short ID of dsp-it-a>/start -> 204 (resolved, covered)" "204" "$S"

S=$(delete_status "$PROXY/containers/$IT_SHORT?force=1")
check "DELETE /containers/<short ID of dsp-it-a>?force=1 -> 204 (resolved, covered)" "204" "$S"

# #86: this runner's container is covered by no policy. Before #86 each of
# these reached the daemon: start answered 304 (already running) and DELETE
# without force 409 (running). Nothing here can stop the runner.
S=$(post_empty "$PROXY/containers/$SELF_NAME/start")
check_denied "POST /containers/<runner name>/start -> 403 (uncovered, #86)" "$S" "$BODY" "container $SELF_NAME is not managed by any policy"

S=$(post_empty "$PROXY/containers/$SELF_ID/start")
check_denied "POST /containers/<runner full ID>/start -> 403 (uncovered, #86)" "$S" "$BODY" "container $SELF_ID is not managed by any policy"

S=$(delete_status "$PROXY/v1.45/containers/$SELF")
check_denied "DELETE /v1.45/containers/<runner short ID> -> 403 (uncovered, #86)" "$S" "$BODY" "container $SELF is not managed by any policy"

S=$(delete_status "$PROXY/containers/no-such-container")
check_denied "DELETE /containers/no-such-container -> 403 (daemon 404, #86)" "$S" "$BODY" 'container no-such-container is not managed by any policy'

# ─── Forced supplementary groups (#93) ───────────────────

# deploy/config/dsp-it-a.yaml forces group_add ['64190', '64191']; dsp-it-b
# has no group_add. community.docker.docker_container's groups: becomes
# HostConfig.GroupAdd, a list of strings. Each create is inspected through the
# proxy (reads pass) and removed. Before #93 the proxy forced no list and
# denied any non-empty GroupAdd.
echo ""
echo "--- Forced group_add (#93) ---"

FORCED_GROUPS='"GroupAdd":["64190","64191"]'

# create_groups NAME HOSTCONFIG_JSON: create NAME from this runner's image.
create_groups() {
  delete_status "$PROXY/containers/$1?force=1" >/dev/null
  post_json "{\"Image\":\"$IT_IMAGE\",\"Cmd\":[\"sleep\",\"300\"],\"HostConfig\":$2}" "$PROXY/containers/create?name=$1"
}

# inspect_groups NAME: the container's HostConfig.GroupAdd as the daemon
# reports it, or "none"; then remove the container.
inspect_groups() {
  : >"$BODY"
  curl -s -o "$BODY" $TIMEOUT --unix-socket "$PROXY_SOCK" "$PROXY/containers/$1/json" 2>/dev/null || true
  g=$(grep -oE '"GroupAdd":(null|\[[^]]*\])' "$BODY" | head -n 1)
  delete_status "$PROXY/containers/$1?force=1" >/dev/null
  echo "${g:-none}"
}

S=$(create_groups dsp-it-a '{}')
check "create dsp-it-a without GroupAdd -> 201" "201" "$S"
check "dsp-it-a without GroupAdd: the daemon has the forced list" "$FORCED_GROUPS" "$(inspect_groups dsp-it-a)"

S=$(create_groups dsp-it-a '{"GroupAdd":["64190","64191"]}')
check "create dsp-it-a with the forced list -> 201" "201" "$S"
check "dsp-it-a with the forced list: the daemon has it unchanged" "$FORCED_GROUPS" "$(inspect_groups dsp-it-a)"

S=$(create_groups dsp-it-a '{"GroupAdd":["0","docker"]}')
check "create dsp-it-a with another GroupAdd -> 201 (replaced, not denied)" "201" "$S"
check "dsp-it-a with another GroupAdd: the daemon has the forced list" "$FORCED_GROUPS" "$(inspect_groups dsp-it-a)"

S=$(create_groups dsp-it-a '{"groupadd":["0"]}')
remove_if_created "$S"
check_denied "create dsp-it-a with lower-case groupadd -> 403" "$S" "$BODY" 'HostConfig.groupadd is not allowed for service dsp-it-a'

S=$(create_groups dsp-it-b '{"GroupAdd":["64190","64191"]}')
remove_if_created "$S"
check_denied "create dsp-it-b (no group_add) with GroupAdd -> 403" "$S" "$BODY" 'HostConfig.GroupAdd is not allowed for service dsp-it-b'

# ─── Read-only mode (#75) ────────────────────────────────

# The same config behind --readonly. Every request whose method is not GET or
# HEAD is denied by the router. Before #75 the flag only reached the gate
# chain, which runs on create alone, so these reached the daemon (a 404 for
# the unknown container below, i.e. a leak, not a proxy 403).
echo ""
echo "--- Read-only mode ---"

# The request helpers read PROXY_SOCK, so this switches every check below to
# the read-only proxy. Keep this section last.
PROXY_SOCK="$PROXY_RO_SOCK"

S=$(get_status "$PROXY/_ping")
check "GET /_ping -> 200 (read-only)" "200" "$S"

S=$(post_empty "$PROXY/containers/no-such-container/stop")
check_denied "POST /containers/*/stop -> 403 (read-only)" "$S" "$BODY" 'read-only mode: POST requests are not allowed'

S=$(delete_status "$PROXY/containers/no-such-container")
check_denied "DELETE /containers/* -> 403 (read-only)" "$S" "$BODY" 'read-only mode: DELETE requests are not allowed'

S=$(post_json '{"Image":"chainsafe/lodestar:beacon","Cmd":["--rcConfig","/data/config.yml"]}' "$PROXY/containers/create")
check_denied "POST /containers/create with allowed image -> 403 (read-only)" "$S" "$BODY" 'read-only mode: POST requests are not allowed'

S=$(post_empty "$PROXY/images/create?fromImage=chainsafe/lodestar&tag=beacon")
check_denied "POST /images/create?fromImage=chainsafe/lodestar -> 403 (read-only)" "$S" "$BODY" 'read-only mode: POST requests are not allowed'

# ─── Summary ──────────────────────────────────────────

echo ""
echo "============================================"
if [ "$FAIL" -eq 0 ]; then
  echo "  ALL $PASS TESTS PASSED"
else
  echo "  $PASS PASSED, $FAIL FAILED"
fi
echo "============================================"
exit "$FAIL"