kitchen-docker 3.2.4 → 3.3.1

data/spec/dockerfile_helper_spec.rb

@@ -13,97 +13,133 @@
 #
 
 require "spec_helper"
-require "kitchen/docker/helpers/dockerfile_helper"
 
 describe Kitchen::Docker::Helpers::DockerfileHelper do
-  let(:helper_class) do
-    Class.new do
-      include Kitchen::Docker::Helpers::DockerfileHelper
-      attr_accessor :config
+  # Every platform name the driver accepts, and the method it must route to.
+  # Adding a distribution means adding a `when` branch and a method, and it is
+  # easy to add one and forget the other -- the result being a platform that
+  # raises "Unknown platform" or, worse, quietly bootstraps with the wrong
+  # package manager.
+  PLATFORM_ROUTES = {
+    "arch" => :arch_platform,
+    "debian" => :debian_platform,
+    "ubuntu" => :debian_platform,
+    "fedora" => :fedora_platform,
+    "gentoo" => :gentoo_platform,
+    "gentoo-paludis" => :gentoo_paludis_platform,
+    "opensuse" => :opensuse_platform,
+    "opensuse/leap" => :opensuse_platform,
+    "opensuse/tumbleweed" => :opensuse_platform,
+    "sles" => :opensuse_platform,
+    "rhel" => :rhel_platform,
+    "centos" => :rhel_platform,
+    "oraclelinux" => :rhel_platform,
+    "amazonlinux" => :amazonlinux_platform,
+    "centosstream" => :centosstream_platform,
+    "almalinux" => :almalinux_platform,
+    "rockylinux" => :rockylinux_platform,
+    "photon" => :photonos_platform,
+  }.freeze
 
-      def initialize(config = {})
-        @config = config
+  describe "#dockerfile_platform" do
+    PLATFORM_ROUTES.each do |platform, method|
+      it "routes #{platform} to ##{method}" do
+        # Compared by output rather than by stubbing the method, so this also
+        # proves the branch is wired to a method that actually exists.
+        h = helper(platform: platform, disable_upstart: true)
+        expect(h.dockerfile_platform).to eq h.public_send(method)
       end
     end
+
+    it "names the platform it could not handle" do
+      # The error is what a user sees after a typo in kitchen.yml, so it has to
+      # contain the value they typed.
+      expect { helper(platform: "ubunut").dockerfile_platform }
+        .to raise_error(Kitchen::ActionFailed, /Unknown platform 'ubunut'/)
+    end
   end
 
-  let(:helper) { helper_class.new(platform:) }
+  # Test Kitchen reaches a Linux container over SSH as a sudo-capable user, so
+  # an image that lacks either an SSH server or sudo is useless no matter which
+  # distribution it is. These hold for every supported platform.
+  describe "invariants every platform's setup must satisfy" do
+    PLATFORM_ROUTES.values.uniq.each do |method|
+      context "##{method}" do
+        subject(:fragment) { helper(platform: "ubuntu", disable_upstart: true).public_send(method) }
+
+        it "installs sudo" do
+          expect(fragment).to match(/\bsudo\b/)
+        end
+
+        it "installs an SSH server" do
+          expect(fragment).to match(/openssh|\bssh\b/)
+        end
+
+        it "contains only Dockerfile instructions" do
+          # Catches a fragment that has picked up a stray shell line, which
+          # would fail the build with a parse error rather than anything that
+          # points back here.
+          instructions = fragment.lines.map(&:strip).reject(&:empty?)
+          continued = false
+          instructions.each do |line|
+            expect(line).to match(/\A(RUN|ENV|ARG|COPY|ADD|WORKDIR|USER)\b/) unless continued
+            continued = line.end_with?("\\")
+          end
+        end
+      end
+    end
+  end
 
   describe "#amazonlinux_platform" do
-    let(:platform) { "amazonlinux" }
+    subject(:fragment) { helper(platform: "amazonlinux").amazonlinux_platform }
 
-    it "includes --allowerasing flag for yum install" do
-      result = helper.amazonlinux_platform
-      expect(result).to include("yum install -y --allowerasing")
+    it "allows erasing conflicting packages, which Amazon Linux 2023 needs" do
+      expect(fragment).to include "--allowerasing"
     end
 
-    it "installs required packages including curl" do
-      result = helper.amazonlinux_platform
-      expect(result).to include("sudo openssh-server openssh-clients which curl")
+    it "installs curl" do
+      expect(fragment).to match(/curl/)
     end
 
-    it "sets container environment variable" do
-      result = helper.amazonlinux_platform
-      expect(result).to include("ENV container=docker")
+    it "marks the image as running in a container" do
+      expect(fragment).to include "ENV container=docker"
     end
 
-    it "generates SSH host key if missing" do
-      result = helper.amazonlinux_platform
-      expect(result).to include("ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key")
+    it "generates an SSH host key only if one is missing" do
+      # Regenerating on every build would change the host key under a user who
+      # already accepted it.
+      expect(fragment).to include '[ -f "/etc/ssh/ssh_host_rsa_key" ] ||'
     end
   end
 
   describe "#rhel_platform" do
-    let(:platform) { "rhel" }
+    subject(:fragment) { helper(platform: "rhel").rhel_platform }
 
-    it "does not include --allowerasing flag" do
-      result = helper.rhel_platform
-      expect(result).not_to include("--allowerasing")
+    it "does not pass --allowerasing, which older yum does not accept" do
+      expect(fragment).not_to include "--allowerasing"
     end
 
-    it "installs required packages including curl if needed" do
-      result = helper.rhel_platform
-      expect(result).to include("sudo openssh-server openssh-clients which")
-      expect(result).to include("which curl || yum install -y curl")
+    it "installs curl if it is not already present" do
+      expect(fragment).to match(/curl/)
     end
   end
 
-  describe "#dockerfile_platform" do
-    context "when platform is amazonlinux" do
-      let(:platform) { "amazonlinux" }
-
-      it "calls amazonlinux_platform method" do
-        expect(helper).to receive(:amazonlinux_platform).and_call_original
-        result = helper.dockerfile_platform
-        expect(result).to include("--allowerasing")
-      end
-    end
-
-    context "when platform is rhel" do
-      let(:platform) { "rhel" }
-
-      it "calls rhel_platform method" do
-        expect(helper).to receive(:rhel_platform).and_call_original
-        result = helper.dockerfile_platform
-        expect(result).not_to include("--allowerasing")
-      end
+  describe "#debian_platform" do
+    it "neutralises initctl when disable_upstart is set" do
+      expect(helper(platform: "ubuntu", disable_upstart: true).debian_platform)
+        .to include "dpkg-divert"
     end
 
-    context "when platform is centos" do
-      let(:platform) { "centos" }
-
-      it "calls rhel_platform method" do
-        expect(helper).to receive(:rhel_platform).and_call_original
-        helper.dockerfile_platform
-      end
+    it "leaves initctl alone when disable_upstart is false" do
+      expect(helper(platform: "ubuntu", disable_upstart: false).debian_platform)
+        .not_to include "dpkg-divert"
     end
 
-    context "when platform is oraclelinux" do
-      let(:platform) { "oraclelinux" }
-
-      it "calls rhel_platform method" do
-        expect(helper).to receive(:rhel_platform).and_call_original
-        helper.dockerfile_platform
+    it "keeps apt non-interactive either way" do
+      # A prompt during the build hangs it until Docker times out.
+      [true, false].each do |setting|
+        expect(helper(platform: "ubuntu", disable_upstart: setting).debian_platform)
+          .to include "ENV DEBIAN_FRONTEND=noninteractive"
       end
     end
   end

data/spec/erb_context_spec.rb

@@ -0,0 +1,60 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "tmpdir"
+
+describe Kitchen::Docker::ERBContext do
+  def render(template, config)
+    ERB.new(template).result(described_class.new(config).get_binding)
+  end
+
+  # A user-supplied `dockerfile:` is rendered through ERB with the driver
+  # configuration exposed as instance variables. That is a documented part of
+  # the driver's interface -- test/Dockerfile depends on it -- so the exposure
+  # rules are worth pinning.
+  it "exposes each configuration key as an instance variable" do
+    expect(render("<%= @image %>", image: "ubuntu:24.04")).to eq "ubuntu:24.04"
+  end
+
+  it "exposes keys the driver has no option for" do
+    # kitchen.yml's dockerfile platform passes `password`, which the driver
+    # itself never reads; the template is the only consumer.
+    expect(render("<%= @password %>", password: "secret")).to eq "secret"
+  end
+
+  it "renders a missing key as empty rather than failing the build" do
+    expect(render("[<%= @nope %>]", {})).to eq "[]"
+  end
+
+  it "accepts string keys as well as symbols" do
+    expect(render("<%= @image %>", "image" => "alpine")).to eq "alpine"
+  end
+
+  it "allows a template to read a file, as test/Dockerfile does with the public key" do
+    Dir.mktmpdir do |dir|
+      key = File.join(dir, "k.pub")
+      File.write(key, "ssh-rsa AAAA test\n")
+      expect(render("<%= IO.read(@public_key).strip %>", public_key: key))
+        .to eq "ssh-rsa AAAA test"
+    end
+  end
+
+  it "keeps values verbatim, without escaping" do
+    # The template author decides on quoting; silently escaping here would
+    # corrupt Dockerfiles that already quote correctly.
+    expect(render("<%= @run_command %>", run_command: 'sshd -o "UseDNS=no"'))
+      .to eq 'sshd -o "UseDNS=no"'
+  end
+end

data/spec/image_helper_spec.rb

@@ -0,0 +1,142 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+
+describe Kitchen::Docker::Helpers::ImageHelper do
+  describe "#parse_image_id" do
+    # Docker has changed how it reports the built image's id several times, and
+    # each change has broken this parser. Every format the driver claims to
+    # support gets a case here, against output copied from a real build.
+    {
+      "Docker 29.7 with BuildKit" =>
+        [DockerOutput::BUILD_29_7_BUILDKIT, DockerOutput::BUILD_29_7_IMAGE_ID],
+      "BuildKit emitting 'writing image'" =>
+        [DockerOutput::BUILD_BUILDKIT_WRITING_IMAGE, DockerOutput::BUILD_BUILDKIT_WRITING_IMAGE_ID],
+      "the pre-BuildKit builder" =>
+        [DockerOutput::BUILD_LEGACY, DockerOutput::BUILD_LEGACY_IMAGE_ID],
+    }.each do |description, (output, expected_id)|
+      context "with output from #{description}" do
+        it "finds the image id" do
+          expect(helper.parse_image_id(output)).to eq expected_id
+        end
+
+        it "returns something that looks like an image id" do
+          # Two of the three patterns pull the id out with a bare `split.last`,
+          # which will return whatever trailing token a matching line happens to
+          # end with. Asserting the shape catches a match on the wrong line.
+          expect(helper.parse_image_id(output)).to match(/\A(sha256:[0-9a-f]{64}|[0-9a-f]{12})\z/)
+        end
+      end
+    end
+
+    it "fails loudly when the output holds no image id" do
+      # Returning nil here would put nil into state[:image_id] and fail much
+      # later, while `docker run` complained about an empty image name.
+      expect { helper.parse_image_id("#1 [internal] load build definition\n#1 DONE 0.0s\n") }
+        .to raise_error(Kitchen::ActionFailed, /Could not parse Docker build output/)
+    end
+
+    it "fails loudly on empty output" do
+      expect { helper.parse_image_id("") }
+        .to raise_error(Kitchen::ActionFailed, /Could not parse Docker build output/)
+    end
+
+    it "prefers the last id in the output" do
+      # The scan runs in reverse so that a rebuild's final export wins over
+      # anything earlier in the log.
+      doubled = DockerOutput::BUILD_BUILDKIT_WRITING_IMAGE + DockerOutput::BUILD_29_7_BUILDKIT
+      expect(helper.parse_image_id(doubled)).to eq DockerOutput::BUILD_29_7_IMAGE_ID
+    end
+  end
+
+  describe "#build_image" do
+    # build_image writes a temp Dockerfile and shells out. Stubbing the shell-out
+    # leaves the part worth testing: the command line it assembles.
+    let(:built) { [] }
+
+    def build(config = {})
+      h = helper({ build_tempdir: ".", build_context: false, use_cache: true }.merge(config))
+      allow(h).to receive(:docker_command) do |cmd, _opts|
+        built << cmd
+        DockerOutput::BUILD_29_7_BUILDKIT
+      end
+      h.build_image({}, "FROM alpine:3.20\n")
+      argv(built.last)
+    end
+
+    it "builds, reading the Dockerfile from stdin when there is no build context" do
+      expect(build).to eq %w{build -}
+    end
+
+    it "passes a build context as the final argument when one is configured" do
+      expect(build(build_context: true).last).to eq "."
+    end
+
+    it "names the Dockerfile with -f when there is a build context" do
+      expect(build(build_context: true)).to include "-f"
+    end
+
+    it "disables the cache when use_cache is false" do
+      expect(build(use_cache: false)).to include "--no-cache"
+    end
+
+    it "uses the cache when use_cache is true, as the driver defaults it" do
+      expect(build).not_to include "--no-cache"
+    end
+
+    it "passes docker_platform through" do
+      expect(build(docker_platform: "linux/arm64")).to include "--platform=linux/arm64"
+    end
+
+    it "appends build_options" do
+      expect(build(build_options: { "build-arg" => "VERSION=1.2.3" }))
+        .to include "--build-arg=VERSION=1.2.3"
+    end
+
+    it "returns the parsed image id" do
+      h = helper(build_tempdir: ".", build_context: false, use_cache: true)
+      allow(h).to receive(:docker_command).and_return(DockerOutput::BUILD_29_7_BUILDKIT)
+      expect(h.build_image({}, "FROM alpine:3.20\n")).to eq DockerOutput::BUILD_29_7_IMAGE_ID
+    end
+
+    it "removes the temp Dockerfile even when the build fails" do
+      # A failed build that leaves Dockerfile-kitchen files behind pollutes the
+      # cookbook directory, and they end up in the next build's context.
+      before = Dir.glob("Dockerfile-kitchen*")
+      h = helper(build_tempdir: ".", build_context: false, use_cache: true)
+      allow(h).to receive(:docker_command).and_raise(Kitchen::ShellOut::ShellCommandFailed, "boom")
+      expect { h.build_image({}, "FROM alpine:3.20\n") }.to raise_error(Kitchen::ShellOut::ShellCommandFailed)
+      expect(Dir.glob("Dockerfile-kitchen*")).to eq before
+    end
+  end
+
+  describe "#remove_image" do
+    let(:state) { { image_id: "sha256:abc" } }
+
+    it "removes the image when nothing is using it" do
+      h = helper
+      allow(h).to receive(:image_in_use?).and_return(false)
+      expect(h).to receive(:docker_command).with("rmi sha256:abc")
+      h.remove_image(state)
+    end
+
+    it "leaves the image alone when a container still references it" do
+      h = helper
+      allow(h).to receive(:image_in_use?).and_return(true)
+      expect(h).not_to receive(:docker_command)
+      h.remove_image(state)
+    end
+  end
+end

data/spec/inspec_helper_spec.rb

@@ -7,12 +7,15 @@ RSpec.describe "inspec_helper patches" do
   describe "kitchen-inspec patch" do
     # Test actual post-load state rather than trying to stub Kernel.require,
     # which does not intercept require calls made inside a load'd file in Ruby 3.4.
-    if defined?(Kitchen::Verifier::Inspec)
-      it "adds runner_options_for_docker to Kitchen::Verifier::Inspec" do
+    # The availability check has to happen inside the example: RSpec loads every
+    # spec file before running any example, so a load-time `defined?` would be
+    # decided by whichever spec file happened to require the verifier first.
+    it "patches Kitchen::Verifier::Inspec when the gem is available" do
+      load helper_path
+
+      if defined?(Kitchen::Verifier::Inspec)
         expect(Kitchen::Verifier::Inspec.method_defined?(:runner_options_for_docker)).to be true
-      end
-    else
-      it "Kitchen::Verifier::Inspec not available — patch correctly skipped" do
+      else
         expect(defined?(Kitchen::Verifier::Inspec)).to be_falsy
       end
     end
@@ -32,13 +35,13 @@ RSpec.describe "inspec_helper patches" do
 
   describe "kitchen-cinc-auditor patch" do
     # Test actual post-load state rather than trying to stub Kernel.require.
-    if defined?(Kitchen::Verifier::CincAuditor) &&
-        defined?(Kitchen::Verifier::CincAuditor::TransportOptions)
-      it "adds build_docker to Kitchen::Verifier::CincAuditor::TransportOptions" do
+    # Checked inside the example for the same load-order reason as above.
+    it "patches Kitchen::Verifier::CincAuditor::TransportOptions when the gem is available" do
+      load helper_path
+
+      if defined?(Kitchen::Verifier::CincAuditor::TransportOptions)
         expect(Kitchen::Verifier::CincAuditor::TransportOptions.method_defined?(:build_docker)).to be true
-      end
-    else
-      it "Kitchen::Verifier::CincAuditor not available — patch correctly skipped" do
+      else
         expect(defined?(Kitchen::Verifier::CincAuditor)).to be_falsy
       end
     end

data/spec/linux_container_spec.rb

@@ -0,0 +1,194 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require "spec_helper"
+require "tmpdir"
+
+describe Kitchen::Docker::Container::Linux do
+  around do |example|
+    Dir.mktmpdir do |dir|
+      @tmpdir = dir
+      @public_key = File.join(dir, "docker_id_rsa.pub")
+      File.write(@public_key, "ssh-rsa AAAAB3NzaC1yc2E kitchen_docker_key\n")
+      example.run
+    end
+  end
+
+  def container(config = {})
+    described_class.new({
+      image: "ubuntu:24.04",
+      platform: "ubuntu",
+      username: "kitchen",
+      public_key: @public_key,
+      private_key: File.join(@tmpdir, "docker_id_rsa"),
+    }.merge(config))
+  end
+
+  describe "#parse_container_ssh_port" do
+    def port(output)
+      container.send(:parse_container_ssh_port, output)
+    end
+
+    it "reads the published port from a dual-stack daemon" do
+      expect(port(DockerOutput::PORT_DUAL_STACK)).to eq DockerOutput::PUBLISHED_PORT
+    end
+
+    it "reads the published port from an IPv4-only daemon" do
+      expect(port(DockerOutput::PORT_IPV4_ONLY)).to eq DockerOutput::PUBLISHED_PORT
+    end
+
+    # `_host, port = output.split(":")` assumes the host is everything before
+    # the first colon. On IPv6 output the first two fields are "[" and "", so
+    # the port becomes "".to_i -- and `to_i` never raises, so the method's
+    # rescue clause cannot fire. Test Kitchen is then handed port 0 and fails
+    # far away from here, complaining that SSH was refused.
+    it "reads the published port from an IPv6-only daemon" do
+      pending "BUG: IPv6 output parses to port 0 rather than the published port"
+      expect(port(DockerOutput::PORT_IPV6_ONLY)).to eq DockerOutput::PUBLISHED_PORT
+    end
+
+    it "refuses to report a port it could not parse" do
+      pending "BUG: unparseable output silently yields port 0 instead of raising"
+      expect { port("") }.to raise_error(Kitchen::ActionFailed)
+    end
+
+    it "never returns a port that cannot be connected to" do
+      # The invariant behind both pending examples above: whatever this returns
+      # has to be usable. Zero is not.
+      expect(port(DockerOutput::PORT_DUAL_STACK)).to be_between(1, 65_535)
+    end
+  end
+
+  describe "#container_ssh_port" do
+    it "uses port 22 directly on the internal Docker network" do
+      # On the Docker network the container is addressed by its own IP, so the
+      # published mapping is irrelevant -- and asking for it would fail.
+      c = container(use_internal_docker_network: true)
+      expect(c).not_to receive(:docker_command)
+      expect(c.send(:container_ssh_port, {})).to eq 22
+    end
+
+    it "raises a useful error when docker reports no mapping" do
+      c = container
+      allow(c).to receive(:docker_command).and_raise(StandardError, "no public port")
+      expect { c.send(:container_ssh_port, container_id: "abc") }
+        .to raise_error(Kitchen::ActionFailed, /no ssh port mapped/)
+    end
+  end
+
+  describe "#dockerfile" do
+    subject(:dockerfile) { container.send(:dockerfile) }
+
+    it "starts from the configured image" do
+      expect(dockerfile.lines.first.strip).to eq "FROM ubuntu:24.04"
+    end
+
+    it "authorises the generated public key" do
+      # Without this line the container builds and starts, and then every
+      # connection is refused -- the single most confusing way for this driver
+      # to fail.
+      expect(dockerfile).to match(%r{>> /home/kitchen/\.ssh/authorized_keys})
+    end
+
+    it "escapes the public key so a shell cannot split it" do
+      # The key contains spaces, and it is appended with `RUN echo <key> >> ...`.
+      run_line = dockerfile.lines.grep(/authorized_keys/).last
+      expect(argv(run_line.sub(/\ARUN /, ""))).to include "ssh-rsa AAAAB3NzaC1yc2E kitchen_docker_key"
+    end
+
+    it "creates the login user" do
+      expect(dockerfile).to match(/useradd .*kitchen/)
+    end
+
+    it "puts root's home in the right place" do
+      expect(container(username: "root").send(:dockerfile)).to match(%r{>> /root/\.ssh/authorized_keys})
+    end
+
+    it "appends each provision_command as its own RUN line" do
+      generated = container(provision_command: ["apt-get install -y dnsutils", "apt-get install -y telnet"])
+        .send(:dockerfile)
+      expect(generated).to include "RUN apt-get install -y dnsutils\n"
+      expect(generated).to include "RUN apt-get install -y telnet\n"
+    end
+
+    it "accepts a single provision_command" do
+      expect(container(provision_command: "echo hi").send(:dockerfile)).to include "RUN echo hi\n"
+    end
+
+    it "ends with a newline" do
+      # A Dockerfile whose last line lacks a newline loses that instruction on
+      # some builders.
+      expect(dockerfile).to end_with "\n"
+    end
+
+    it "carries the proxy configuration into the image" do
+      expect(container(http_proxy: "http://proxy:8080").send(:dockerfile))
+        .to include "ENV http_proxy=http://proxy:8080"
+    end
+
+    context "when a custom dockerfile is configured" do
+      it "uses it verbatim, rendered through ERB" do
+        path = File.join(@tmpdir, "Dockerfile")
+        File.write(path, "FROM <%= @image %>\nRUN echo <%= @username %>\n")
+        expect(container(dockerfile: path).send(:dockerfile))
+          .to eq "FROM ubuntu:24.04\nRUN echo kitchen\n"
+      end
+
+      it "does not append the generated SSH setup to it" do
+        # The custom Dockerfile owns the whole image; silently appending would
+        # overwrite what the author set up.
+        path = File.join(@tmpdir, "Dockerfile")
+        File.write(path, "FROM scratch\n")
+        expect(container(dockerfile: path).send(:dockerfile)).not_to include "authorized_keys"
+      end
+    end
+  end
+
+  describe "#generate_keys" do
+    it "writes a usable key pair when none exists" do
+      private_key = File.join(@tmpdir, "generated")
+      public_key = File.join(@tmpdir, "generated.pub")
+      container(private_key: private_key, public_key: public_key).send(:generate_keys)
+
+      expect(File.read(public_key)).to start_with "ssh-rsa "
+      expect { OpenSSL::PKey::RSA.new(File.read(private_key)) }.not_to raise_error
+    end
+
+    it "leaves an existing key pair alone" do
+      # Regenerating would invalidate the authorized_keys baked into images
+      # that were already built.
+      private_key = File.join(@tmpdir, "docker_id_rsa")
+      File.write(private_key, "existing private key")
+      before = File.read(@public_key)
+
+      container(private_key: private_key).send(:generate_keys)
+
+      expect(File.read(@public_key)).to eq before
+      expect(File.read(private_key)).to eq "existing private key"
+    end
+
+    it "regenerates when only one half of the pair is present" do
+      # A half-written pair cannot authenticate, so keeping it would strand the
+      # user with a container they can never reach.
+      File.delete(@public_key)
+      private_key = File.join(@tmpdir, "docker_id_rsa")
+      File.write(private_key, "orphaned private key")
+
+      container(private_key: private_key).send(:generate_keys)
+
+      expect(File.read(@public_key)).to start_with "ssh-rsa "
+      expect(File.read(private_key)).not_to eq "orphaned private key"
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -19,9 +19,35 @@ require "rspec"
 require "rspec/its"
 
 require "kitchen/driver/docker"
+require "kitchen/transport/docker"
 
+Dir[File.join(__dir__, "support", "**", "*.rb")].sort.each { |f| require f }
+
+# These specs never talk to a Docker daemon. Everything this gem does is turn
+# configuration into Dockerfiles and `docker` command lines, and turn Docker's
+# output back into ids and ports, so all of it can be exercised as pure string
+# work. Anything that genuinely needs a daemon belongs in the Test Kitchen
+# integration suites -- see CONTRIBUTING.md.
 RSpec.configure do |config|
-  # Basic configuraiton
+  config.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  config.mock_with :rspec do |mocks|
+    # Fail if an example stubs a method the real object does not have. Without
+    # this, a rename in lib/ leaves the specs stubbing a method that no longer
+    # exists and passing while the driver is broken.
+    mocks.verify_partial_doubles = true
+  end
+
+  # Surface deprecations as failures rather than warnings that scroll past.
+  config.raise_errors_for_deprecations!
+
+  config.include ArgvHelpers
+  config.include HelperHarness
+  config.include DockerOutput
+
+  # Basic configuration
   config.run_all_when_everything_filtered = true
   config.filter_run(:focus)
 
@@ -30,4 +56,5 @@ RSpec.configure do |config|
   # the seed, which is printed after each run.
   #     --seed 1234
   config.order = "random"
+  Kernel.srand config.seed
 end