kitchen-docker 3.3.4 → 3.4.1

data/lib/kitchen/transport/docker.rb

@@ -15,6 +15,7 @@ require "kitchen"
 
 require_relative "../docker/container/linux"
 require_relative "../docker/container/windows"
+require_relative "../docker/docker_version"
 
 require_relative "../docker/helpers/inspec_helper"
 
@@ -31,19 +32,24 @@ module Kitchen
       # Raised when a docker command against the container fails.
       class DockerFailed < TransportFailed; end
 
-      # kitchen_transport_api_version 1
-      plugin_version Kitchen::VERSION
+      # Reported by `kitchen diagnose`. plugin_version was Kitchen::VERSION,
+      # which is Test Kitchen's version rather than this gem's, so a diagnose
+      # reported the transport as 4.1.1 while kitchen-docker was at 3.3.4.
+      kitchen_transport_api_version 1
+      plugin_version Kitchen::Docker::DOCKER_VERSION
 
       default_config :binary,        "docker"
       default_config :env_variables, nil
       default_config :interactive,   false
       default_config :privileged,    false
+      default_config :sudo_command,  nil
       default_config :tls,           false
       default_config :tls_cacert,    nil
       default_config :tls_cert,      nil
       default_config :tls_key,       nil
       default_config :tls_verify,    false
       default_config :tty,           false
+      default_config :use_sudo,      false
       default_config :working_dir,   nil
 
       default_config :socket do |transport|
@@ -77,6 +83,8 @@ module Kitchen
       # than from Test Kitchen's configuration.
       #
       # @param state [Hash] instance state naming the container
+      # @param block [Proc, nil] forwarded to the connection's constructor, which
+      #   yields the new connection to it; the connection is not closed afterwards
       # @yieldparam connection [Connection] if a block is given
       # @return [Connection]
       def connection(state, &block)

data/spec/cli_helper_spec.rb

@@ -298,6 +298,55 @@ describe Kitchen::Docker::Helpers::CliHelper do
     end
   end
 
+  describe "#docker_command" do
+    # `binary` is set to `echo` and `sudo_command` to `echo SUDO`, so the
+    # assembled command line is observable as output without needing real
+    # sudo -- or a real docker -- on the machine running the specs.
+    def echoed(config = {})
+      helper({ binary: "echo", socket: nil, sudo_command: "echo SUDO" }.merge(config))
+        .docker_command("ps -a")
+    end
+
+    it "runs the command as the invoking user by default" do
+      expect(echoed).to eq "ps -a\n"
+    end
+
+    # Cases from the README's "Permission denied talking to the daemon"
+    # advice. `use_sudo` reached only the `verify_dependencies` probe, so
+    # every command that actually touches the daemon still ran unprivileged
+    # and the documented fix did nothing.
+    it "runs the command through sudo when use_sudo is set" do
+      expect(echoed(use_sudo: true)).to eq "SUDO echo ps -a\n"
+    end
+
+    it "leaves the sudo command at its default when none is configured" do
+      expect(helper(binary: "echo", socket: nil, use_sudo: true).docker_sudo_opts({}))
+        .to eq(use_sudo: true)
+    end
+  end
+
+  describe "#docker_sudo_opts" do
+    it "adds nothing when use_sudo is unset" do
+      expect(helper.docker_sudo_opts(suppress_output: true)).to eq(suppress_output: true)
+    end
+
+    it "adds the sudo options the shell-out layer reads" do
+      expect(helper(use_sudo: true, sudo_command: "doas").docker_sudo_opts({}))
+        .to eq(use_sudo: true, sudo_command: "doas")
+    end
+
+    it "keeps the options it was given" do
+      expect(helper(use_sudo: true).docker_sudo_opts(suppress_output: true))
+        .to eq(suppress_output: true, use_sudo: true)
+    end
+
+    it "does not mutate the options it was given" do
+      options = {}
+      helper(use_sudo: true).docker_sudo_opts(options)
+      expect(options).to eq({})
+    end
+  end
+
   describe "#docker_shell_opts" do
     it "translates suppress_output into silencing the live stream" do
       expect(helper.docker_shell_opts(suppress_output: true)).to eq(live_stream: nil)

data/spec/container_helper_spec.rb

@@ -333,12 +333,164 @@ describe Kitchen::Docker::Helpers::ContainerHelper do
     end
   end
 
+  describe "#create_dir_on_container" do
+    def dir_maker(state)
+      helper.tap do |h|
+        @commands = []
+        allow(h).to receive(:replace_env_variables) { |_s, path| path }
+        allow(h).to receive(:docker_command) { |cmd, _opts = {}| @commands << cmd; "" }
+      end
+    end
+
+    it "creates the directory inside the container" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "/tmp")
+      expect(argv(@commands.first)).to include_consecutive("mkdir", "-p", "/tmp")
+    end
+
+    it "expands an environment variable reference before creating it" do
+      h = helper
+      allow(h).to receive(:container_env_variables).and_return("TEMP" => "/var/tmp")
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; "" }
+      h.create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "$TEMP/kitchen")
+      expect(argv(@cmd)).to include_consecutive("mkdir", "-p", "/var/tmp/kitchen")
+    end
+
+    # A temp_dir with a space in it reached `mkdir -p` unquoted, so the shell
+    # tore it in two and mkdir made two directories -- neither of them the one
+    # asked for. Every later upload then landed somewhere that did not exist.
+    it "keeps a path containing a space as one argument" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" },
+        "/var/tmp/kitchen docker")
+      expect(argv(@commands.first)).to include_consecutive("mkdir", "-p", "/var/tmp/kitchen docker")
+    end
+
+    it "uses PowerShell on a Windows container" do
+      dir_maker(nil).create_dir_on_container({ container_id: "abc", platform: "windows-2022" }, 'C:\\Temp')
+      expect(@commands.first).to include("powershell").and include("New-Item")
+    end
+
+    it "says which directory it could not create" do
+      h = helper
+      allow(h).to receive(:replace_env_variables) { |_s, path| path }
+      allow(h).to receive(:docker_command).and_raise("boom")
+      expect { h.create_dir_on_container({ container_id: "abc", platform: "ubuntu-24.04" }, "/tmp/kitchen") }
+        .to raise_error(RuntimeError, %r{Failed to create directory /tmp/kitchen})
+    end
+  end
+
+  describe "#container_exec" do
+    it "runs the command through docker exec" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; "output" }
+      expect(h.container_exec({ container_id: "abc" }, "echo hi")).to eq "output"
+      expect(argv(@cmd)).to include_consecutive("exec", "abc", "echo", "hi")
+    end
+
+    it "names the container operation when the command fails" do
+      h = helper
+      allow(h).to receive(:docker_command).and_raise("boom")
+      expect { h.container_exec({ container_id: "abc" }, "echo hi") }
+        .to raise_error(RuntimeError, /Failed to execute command on Docker container/)
+    end
+  end
+
+  describe "#run_container" do
+    it "returns the id docker printed for the container it started" do
+      h = helper(instance_name: "kitchen-test")
+      allow(h).to receive(:docker_command).and_return(DockerOutput::RUN_CLEAN)
+      expect(h.run_container({ image_id: "sha256:abc" }, 22)).to eq DockerOutput::RUN_CONTAINER_ID
+    end
+
+    it "publishes the port it was given" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; DockerOutput::RUN_CLEAN }
+      h.run_container({ image_id: "sha256:abc" }, 22)
+      expect(argv(@cmd)).to include_consecutive("-p", "22")
+    end
+
+    it "publishes no port when there is none, as for a Windows container" do
+      h = helper
+      allow(h).to receive(:docker_command) { |cmd, _opts = {}| @cmd = cmd; DockerOutput::RUN_CLEAN }
+      h.run_container(image_id: "sha256:abc")
+      expect(argv(@cmd)).not_to include("-p")
+    end
+  end
+
   describe "#copy_file_to_container" do
+    let(:state) { { container_id: "abc", platform: "ubuntu-24.04" } }
+
+    # Records every docker subcommand, and answers the copy check with
+    # `landed`. `docker cp` itself prints nothing on success, so the probe is
+    # the only call whose output matters.
+    def copier(landed:)
+      helper.tap do |h|
+        @commands = []
+        allow(h).to receive(:replace_env_variables) { |_s, path| path }
+        allow(h).to receive(:docker_command) do |cmd, _opts = {}|
+          @commands << cmd
+          cmd.include?(described_class::COPIED_MARKER) && landed ? "#{described_class::COPIED_MARKER}\n" : ""
+        end
+      end
+    end
+
     it "addresses the destination as container:path" do
-      h = helper
-      allow(h).to receive(:replace_env_variables) { |_state, path| path }
-      expect(h).to receive(:docker_command).with("cp /local/f.rb abc:/tmp/f.rb")
-      h.copy_file_to_container({ container_id: "abc", platform: "ubuntu-24.04" }, "/local/f.rb", "/tmp/f.rb")
+      copier(landed: true).copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb")
+      expect(@commands.first).to eq "cp /local/f.rb abc:/tmp/f.rb"
+    end
+
+    it "says nothing when the file arrived" do
+      expect { copier(landed: true).copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb") }
+        .not_to raise_error
+    end
+
+    # From #387. `docker cp` writes to the container's filesystem layer, which
+    # a tmpfs or volume mounted over the destination then hides -- and it exits
+    # 0, so nothing about the copy says it did not happen. Left unchecked the
+    # first sign is the next command failing with "No such file or directory",
+    # which names neither the copy nor the mount.
+    context "when docker exits 0 but wrote nothing, as it does into a mount" do
+      it "fails at the copy rather than somewhere later" do
+        expect { copier(landed: false).copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb") }
+          .to raise_error(RuntimeError, %r{Failed to copy file /local/f\.rb})
+      end
+
+      it "names the mount as the cause" do
+        expect { copier(landed: false).copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb") }
+          .to raise_error(RuntimeError, /cannot write into a mount/)
+      end
+
+      it "names the settings that move the destination off the mount" do
+        expect { copier(landed: false).copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb") }
+          .to raise_error(RuntimeError, /temp_dir.*root_path/m)
+      end
+    end
+
+    it "checks the path docker copies into, not the directory it was given" do
+      copier(landed: true).copy_file_to_container(state, "/local/f.rb", "/tmp")
+      # The probe is handed both parts and picks between them inside the
+      # container, since only there is it known whether /tmp is a directory.
+      expect(@commands.last).to include("/tmp f.rb")
+    end
+
+    it "does not print the probe's marker to the console" do
+      h = copier(landed: true)
+      allow(h).to receive(:logger).and_return(double(debug?: false, debug: nil))
+      opts = []
+      allow(h).to receive(:docker_command) { |_cmd, o = {}| opts << o; "" }
+      begin
+        h.copy_file_to_container(state, "/local/f.rb", "/tmp/f.rb")
+      rescue RuntimeError
+        nil
+      end
+      expect(opts.last).to eq(suppress_output: true)
+    end
+
+    # Windows containers have no tmpfs, and `docker cp` against them is a
+    # different code path in Docker, so they keep the behaviour they had.
+    it "does not probe a Windows container" do
+      h = copier(landed: false)
+      h.copy_file_to_container({ container_id: "abc", platform: "windows-2022" }, "C:\\f.rb", "C:\\Temp")
+      expect(@commands.length).to eq 1
     end
   end
 end

data/spec/docker_spec.rb

@@ -17,6 +17,24 @@
 require "spec_helper"
 
 describe Kitchen::Driver::Docker do
+  # `kitchen diagnose` is what bug reports are asked to include, so what it
+  # says about the plugin has to be true. The transport reported
+  # Kitchen::VERSION, which is Test Kitchen's version, and the driver reported
+  # nothing at all.
+  describe "plugin metadata" do
+    it "reports this gem's version, not Test Kitchen's" do
+      expect(described_class.diagnose[:version]).to eq Kitchen::Docker::DOCKER_VERSION
+    end
+
+    it "does not report Test Kitchen's version" do
+      expect(described_class.diagnose[:version]).not_to eq Kitchen::VERSION
+    end
+
+    it "declares the driver API version it is written against" do
+      expect(described_class.diagnose[:api_version]).to eq 2
+    end
+  end
+
   describe "#config_to_options" do
     let(:config) {}
     subject { described_class.new.send(:config_to_options, config) }
@@ -62,6 +80,159 @@ describe Kitchen::Driver::Docker do
     end # /context with a hash of strings with spaces
   end # /describe #config_to_options
 
+  # `kitchen package`, `kitchen doctor`, and `kitchen list --live` each ask the
+  # driver a question. Driver::Base answers all three with a shrug, and this
+  # driver used to inherit that: package produced nothing, doctor said nothing,
+  # and every instance listed as "unknown". Docker can answer all three.
+  def driver(config = {}, instance_name: "default-ubuntu-2404")
+    described_class.new(config).tap do |d|
+      allow(d).to receive(:instance).and_return(instance_double("Kitchen::Instance", name: instance_name))
+      allow(d).to receive(:logger).and_return(double(debug?: false, debug: nil))
+      %i{info error debug banner}.each { |level| allow(d).to receive(level) }
+    end
+  end
+
+  describe "#status" do
+    let(:state) { { container_id: "abc123abc123" } }
+
+    def status_of(exists:, running:, state: { container_id: "abc123abc123" })
+      d = driver
+      allow(d).to receive(:container_exists?).and_return(exists)
+      allow(d).to receive(:container_running?).and_return(running)
+      d.status(state)
+    end
+
+    it "reports a running container as live" do
+      expect(status_of(exists: true, running: true))
+        .to include(live: true, state: "running", source: "driver")
+    end
+
+    it "distinguishes a stopped container from a missing one" do
+      expect(status_of(exists: true, running: false)).to include(live: false, state: "stopped")
+      expect(status_of(exists: false, running: false)).to include(live: false, state: "gone")
+    end
+
+    it "reports an instance with no container as not created" do
+      expect(status_of(exists: false, running: false, state: {}))
+        .to include(live: false, state: "not created")
+    end
+
+    it "names the container so `kitchen list --live` can show it" do
+      expect(status_of(exists: true, running: true)[:resource_id]).to eq "abc123abc123"
+    end
+
+    it "does not ask docker about an instance that has no container" do
+      d = driver
+      expect(d).not_to receive(:container_exists?)
+      d.status({})
+    end
+
+    it "stamps when it looked" do
+      expect(status_of(exists: true, running: true)[:checked_at])
+        .to match(/\A\d{4}-\d{2}-\d{2}T[\d:]+Z\z/)
+    end
+  end
+
+  describe "#package" do
+    let(:state) { { container_id: "abc123abc123" } }
+    let(:digest) { "sha256:#{"a" * 64}" }
+
+    it "commits the container to the configured image name" do
+      d = driver({ package_name: "myapp:v1" })
+      allow(d).to receive(:container_exists?).and_return(true)
+      expect(d).to receive(:docker_command)
+        .with("commit abc123abc123 myapp:v1", hash_including(:suppress_output))
+        .and_return("#{digest}\n")
+      d.package(state)
+    end
+
+    it "names the image after the instance by default" do
+      d = driver
+      expect(d.send(:config)[:package_name]).to eq "default-ubuntu-2404:latest"
+    end
+
+    it "escapes a package name that would otherwise split" do
+      d = driver({ package_name: "my app:v1" })
+      allow(d).to receive(:container_exists?).and_return(true)
+      expect(d).to receive(:docker_command)
+        .with(%q{commit abc123abc123 my\ app:v1}, hash_including(:suppress_output))
+        .and_return("#{digest}\n")
+      d.package(state)
+    end
+
+    it "refuses to package an instance that was never created" do
+      expect { driver.package({}) }
+        .to raise_error(Kitchen::ActionFailed, /has not been created/)
+    end
+
+    it "does not run docker for an instance that was never created" do
+      d = driver
+      expect(d).not_to receive(:docker_command)
+      expect { d.package({}) }.to raise_error(Kitchen::ActionFailed)
+    end
+
+    # `docker commit` on a container that is gone says only "Error response
+    # from daemon: No such container: <64 hex characters>", which names neither
+    # the instance nor what to do about it.
+    it "names the instance when the container is gone" do
+      d = driver
+      allow(d).to receive(:container_exists?).and_return(false)
+      expect { d.package(state) }
+        .to raise_error(Kitchen::ActionFailed, /default-ubuntu-2404.*kitchen destroy/m)
+    end
+  end
+
+  describe "#doctor" do
+    let(:state) { {} }
+
+    def doctor_with(config = {}, daemon: "29.7.2", state: {})
+      d = driver(config)
+      allow(d).to receive(:container_exists?).and_return(true)
+      allow(d).to receive(:docker_command) do
+        raise Kitchen::ShellOut::ShellCommandFailed, "cannot connect" if daemon.nil?
+
+        "#{daemon}\n"
+      end
+      d.doctor(state)
+    end
+
+    it "reports no problem when the daemon answers" do
+      expect(doctor_with).to be false
+    end
+
+    it "reports a problem when the daemon cannot be reached" do
+      expect(doctor_with(daemon: nil)).to be true
+    end
+
+    it "reports a TLS file that is not there" do
+      expect(doctor_with({ tls_cert: "/nope/cert.pem" })).to be true
+    end
+
+    it "reports a dockerfile that is not there" do
+      expect(doctor_with({ dockerfile: "/nope/Dockerfile" })).to be true
+    end
+
+    it "accepts paths that do exist" do
+      expect(doctor_with({ dockerfile: __FILE__ })).to be false
+    end
+
+    it "reports a state file naming a container the daemon does not have" do
+      d = driver
+      allow(d).to receive(:docker_command).and_return("29.7.2\n")
+      allow(d).to receive(:container_exists?).and_return(false)
+      expect(d.doctor(container_id: "abc123abc123")).to be true
+    end
+
+    it "keeps checking after the first problem, so the whole list is reported" do
+      # `kitchen doctor` exists to tell you everything that is wrong at once.
+      d = driver({ tls_cert: "/nope/cert.pem", dockerfile: "/nope/Dockerfile" })
+      allow(d).to receive(:docker_command).and_raise(Kitchen::ShellOut::ShellCommandFailed, "nope")
+      allow(d).to receive(:container_exists?).and_return(false)
+      expect(d).to receive(:error).at_least(4).times
+      d.doctor(container_id: "abc123abc123")
+    end
+  end
+
   describe "socket default config logic" do
     def resolve_socket
       socket = "unix:///var/run/docker.sock"

data/spec/image_helper_spec.rb

@@ -16,6 +16,30 @@ require "spec_helper"
 
 describe Kitchen::Docker::Helpers::ImageHelper do
   describe "#parse_image_id" do
+    # From #225. `docker build -q` prints the id on a line of its own and
+    # nothing else -- no "writing image", no "naming to", no "successfully
+    # built" -- so every pattern the parser had missed it, and a build with
+    # `build_options: -q` failed with "Could not parse Docker build output for
+    # image ID" rather than producing an instance.
+    context "with a quiet build" do
+      it "reads the id docker printed on its own" do
+        expect(helper.parse_image_id(DockerOutput::BUILD_QUIET))
+          .to eq DockerOutput::BUILD_QUIET_IMAGE_ID
+      end
+
+      it "reads it when docker also wrote a warning to stderr" do
+        expect(helper.parse_image_id("WARNING: something happened\n#{DockerOutput::BUILD_QUIET}"))
+          .to eq DockerOutput::BUILD_QUIET_IMAGE_ID
+      end
+
+      it "does not mistake a digest that is part of a longer line for the id" do
+        # Ordinary build output is full of "... sha256:... done" lines. Only a
+        # line that is nothing but a digest is the quiet form.
+        expect { helper.parse_image_id("#6 exporting manifest sha256:#{"a" * 64} done\n") }
+          .to raise_error(Kitchen::ActionFailed)
+      end
+    end
+
     # Docker has changed how it reports the built image's id several times, and
     # each change has broken this parser. Every format the driver claims to
     # support gets a case here, against output copied from a real build.
@@ -178,4 +202,49 @@ describe Kitchen::Docker::Helpers::ImageHelper do
       h.remove_image(state)
     end
   end
+
+  describe "#image_exists?" do
+    let(:state) { { image_id: "sha256:abc" } }
+
+    def asking(&answer)
+      helper.tap do |h|
+        @opts = nil
+        allow(h).to receive(:logger).and_return(double(debug?: false, debug: nil))
+        allow(h).to receive(:docker_command) { |_cmd, opts = {}| @opts = opts; answer.call }
+      end
+    end
+
+    it "is true when docker knows the image" do
+      expect(asking { "[{}]" }.image_exists?(state)).to be true
+    end
+
+    it "is false when docker does not" do
+      expect(asking { raise Kitchen::ShellOut::ShellCommandFailed, "no such image" }
+        .image_exists?(state)).to be false
+    end
+
+    it "does not ask about an image that state does not name" do
+      h = helper
+      expect(h).not_to receive(:docker_command)
+      expect(h.image_exists?({})).to be false
+    end
+
+    # `kitchen destroy` with remove_images set printed the image's whole
+    # inspect JSON -- config, every layer digest, metadata -- between removing
+    # the container and removing the image. Only whether the command succeeded
+    # is used here, as in every other predicate in this file, all of which
+    # already silence their output.
+    it "does not print the inspect output" do
+      asking { "[{}]" }.image_exists?(state)
+      expect(@opts).to eq(suppress_output: true)
+    end
+
+    it "still prints it under -l debug" do
+      h = helper
+      allow(h).to receive(:logger).and_return(double(debug?: true, debug: nil))
+      allow(h).to receive(:docker_command) { |_cmd, opts = {}| @opts = opts; "[{}]" }
+      h.image_exists?(state)
+      expect(@opts).to eq(suppress_output: false)
+    end
+  end
 end

data/spec/linux_container_spec.rb

@@ -211,6 +211,33 @@ describe Kitchen::Docker::Container::Linux do
       c.execute("echo hi")
       expect(uploaded).to eq "echo hi"
     end
+
+    # The staged script is run by path, and that path is built from temp_dir,
+    # which the user sets.
+    def ran_in(temp_dir)
+      c = container(temp_dir: temp_dir)
+      allow(c).to receive(:create_dir_on_container)
+      allow(c).to receive(:replace_env_variables) { |_cfg, path| path }
+      allow(c).to receive(:upload)
+      ran = nil
+      allow(c).to receive(:container_exec) { |_cfg, cmd| ran = cmd }
+      c.execute("echo hi")
+      ran
+    end
+
+    it "runs the staged script with bash" do
+      ran = ran_in("/tmp")
+      expect(argv(ran).first).to eq "/bin/bash"
+      expect(argv(ran).last).to match(%r{\A/tmp/docker-[0-9a-f-]+\.sh\z})
+    end
+
+    # Interpolated unquoted, a temp_dir with a space in it reached `docker
+    # exec` as two arguments, and bash was handed the first half of the
+    # directory as the script to run.
+    it "keeps a temp_dir containing a space as one argument" do
+      expect(argv(ran_in("/var/tmp/kitchen docker")).last)
+        .to match(%r{\A/var/tmp/kitchen docker/docker-[0-9a-f-]+\.sh\z})
+    end
   end
 
   describe "#generate_keys" do

data/spec/support/docker_output.rb

@@ -81,6 +81,15 @@ module DockerOutput
 
   BUILD_LEGACY_IMAGE_ID = "1a2b3c4d5e6f".freeze
 
+  # `docker build -q` on Docker 29.7.2. Quiet mode prints the id and nothing
+  # else -- no step lines, no exporting lines, none of the wording the other
+  # fixtures here are built around. Reachable through the driver as
+  # `build_options: -q`.
+  BUILD_QUIET = "sha256:ab86ce908a36ffb7de411a72550e416a4d8c268570a0f7313c284c79344d6c0f\n".freeze
+
+  BUILD_QUIET_IMAGE_ID =
+    "sha256:ab86ce908a36ffb7de411a72550e416a4d8c268570a0f7313c284c79344d6c0f".freeze
+
   # `docker run -d`, the ordinary case: the id and nothing else.
   RUN_CONTAINER_ID = "b89e1e8b07664a1ee0bd09decb833146eaf9cc810a152950e3576a56745944db".freeze
   RUN_CLEAN = "#{RUN_CONTAINER_ID}\n".freeze

data/spec/transport_docker_spec.rb

@@ -15,6 +15,26 @@
 require "spec_helper"
 require "kitchen/transport/docker"
 
+describe Kitchen::Transport::Docker do
+  # `kitchen diagnose` is what bug reports are asked to include, so what it
+  # says about the plugin has to be true.
+  describe "plugin metadata" do
+    it "reports this gem's version, not Test Kitchen's" do
+      expect(described_class.diagnose[:version]).to eq Kitchen::Docker::DOCKER_VERSION
+    end
+
+    it "does not report Test Kitchen's version" do
+      # It did: `plugin_version Kitchen::VERSION` made a diagnose say the
+      # transport was at Test Kitchen's version rather than this gem's.
+      expect(described_class.diagnose[:version]).not_to eq Kitchen::VERSION
+    end
+
+    it "declares the transport API version it is written against" do
+      expect(described_class.diagnose[:api_version]).to eq 1
+    end
+  end
+end
+
 describe Kitchen::Transport::Docker::Connection do
   let(:options) do
     {

data/spec/windows_container_spec.rb

@@ -64,6 +64,60 @@ describe Kitchen::Docker::Container::Windows do
     end
   end
 
+  describe "#execute" do
+    def staged(config = {})
+      c = container({ temp_dir: 'C:\\Temp' }.merge(config))
+      allow(c).to receive(:create_dir_on_container)
+      allow(c).to receive(:replace_env_variables) { |_cfg, path| path }
+      allow(c).to receive(:upload)
+      allow(c).to receive(:container_exec) { |_cfg, cmd| @ran = cmd }
+      c
+    end
+
+    around do |example|
+      Dir.mktmpdir { |dir| Dir.chdir(dir) { example.run } }
+    end
+
+    it "runs the staged script with powershell" do
+      staged.execute("Write-Host hi")
+      expect(@ran).to start_with "powershell -ExecutionPolicy Bypass -NoLogo "
+      expect(@ran).to match(/-File .*docker-[0-9a-f-]+\.ps1/)
+    end
+
+    it "stages the script under the configured temp_dir" do
+      staged.execute("Write-Host hi")
+      expect(@ran).to include 'C:\\Temp\\docker-'
+    end
+
+    it "accepts a temp_dir written with forward slashes" do
+      # Kitchen configuration is YAML that is often shared with Linux suites,
+      # so the separator is normalised rather than rejected.
+      staged(temp_dir: "C:/Temp").execute("Write-Host hi")
+      expect(@ran).to include 'C:\\Temp\\docker-'
+    end
+
+    # A Windows temp_dir routinely contains a space -- $env:TEMP under a user
+    # whose name has one does. PowerShell's -File takes exactly one argument,
+    # so an unquoted path left it looking for a script named after the first
+    # word.
+    it "quotes a script path containing a space" do
+      staged(temp_dir: 'C:\\Users\\Foo Bar\\Temp').execute("Write-Host hi")
+      expect(@ran).to include('-File "C:\\Users\\Foo Bar\\Temp\\docker-').and end_with('.ps1"')
+    end
+
+    it "removes the staged script once the command has run" do
+      staged.execute("Write-Host hi")
+      expect(Dir.glob(".kitchen/temp/docker-*.ps1")).to be_empty
+    end
+
+    it "removes the staged script when the command fails" do
+      c = staged
+      allow(c).to receive(:container_exec).and_raise("command exploded")
+      expect { c.execute("Write-Host hi") }.to raise_error(/Failed to execute command/)
+      expect(Dir.glob(".kitchen/temp/docker-*.ps1")).to be_empty
+    end
+  end
+
   describe "the contract it shares with the Linux container" do
     # The two classes share almost no code but must agree on the state they
     # populate, because the driver and transport read the same keys whichever