pgdevkit 0.7.2__tar.gz → 0.9.0__tar.gz

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgdevkit
-Version: 0.7.2
+Version: 0.9.0
 Summary: A helper for developing with Postgres
 Requires-Python: >=3.14
 Requires-Dist: docker>=7.1.0
@@ -261,11 +261,25 @@ worktree and wants to know exactly which DB(s) go with it.
 
 Container connection defaults (`localhost:54322`, `postgres`/`testpwd`) can
 be overridden with `PGDEVKIT_TESTDB_HOST`, `PGDEVKIT_TESTDB_PORT`,
-`PGDEVKIT_TESTDB_USER`, `PGDEVKIT_TESTDB_PASSWORD`. Before touching the
-Docker API, pgdevkit first checks (with a short timeout) whether Postgres
-is already reachable at that address and skips container management if so.
-Set `PGDEVKIT_SKIP_CONTAINER=1` to always assume it's already there and skip
-that check too.
+`PGDEVKIT_TESTDB_USER`, `PGDEVKIT_TESTDB_PASSWORD`, and the image with
+`PGDEVKIT_TESTDB_IMAGE`. Before touching the Docker API, pgdevkit first
+checks (with a short timeout) whether Postgres is already reachable at that
+address and skips container management if so. Set `PGDEVKIT_SKIP_CONTAINER=1`
+to always assume it's already there and skip that check too.
+
+Docker-level resource knobs are unset by default (Docker/Podman's own
+defaults apply) and can be overridden with `PGDEVKIT_TESTDB_SHM_SIZE` (e.g.
+`256m`, useful when Docker's 64MB default shared-memory size is too small
+for parallel query workers), `PGDEVKIT_TESTDB_MEM_LIMIT` (e.g. `1g`),
+`PGDEVKIT_TESTDB_CPUS` (e.g. `2` or `0.5`), and `PGDEVKIT_TESTDB_TMPFS` —
+docker-CLI `--tmpfs` syntax (`/path:options`), semicolon-separated for
+multiple mounts, e.g. `/var/lib/postgresql/data:size=512m`.
+
+All of the above (including `_HOST`/`_PORT`/`_USER`/`_PASSWORD`/`_IMAGE`)
+only take effect when pgdevkit actually creates the container, not when it
+finds and restarts an existing stopped one with the same name — remove the
+existing container (`docker rm -f pgdevkit-postgres`) first if you've
+changed any of these on a machine that already has one.
 
 Container management goes through the Docker API (the `docker` package,
 `docker.from_env()`, falling back to Podman's rootful/rootless socket) — it
@@ -291,6 +305,17 @@ Container defaults (`localhost:14330`, `sa`/a generated complexity-valid
 password) can be overridden with `PGDEVKIT_TESTDB_MSSQL_HOST`, `_PORT`,
 `_USER`, `_PASSWORD`, `_IMAGE`, `_MEMORY_LIMIT_MB`. The container only
 bootstraps the `sa` login — additional logins are a known limitation.
+
+The same Docker-level resource knobs as the Postgres container are
+available here too: `PGDEVKIT_TESTDB_MSSQL_SHM_SIZE`,
+`PGDEVKIT_TESTDB_MSSQL_MEM_LIMIT` (a container-level cgroup limit, distinct
+from `_MEMORY_LIMIT_MB` above which only tunes SQL Server's own internal
+memory management), `PGDEVKIT_TESTDB_MSSQL_CPUS`, and
+`PGDEVKIT_TESTDB_MSSQL_TMPFS`. As with the Postgres container, these only
+take effect when pgdevkit creates the container, not when restarting an
+existing stopped one (`docker rm -f pgdevkit-mssql` first if you've changed
+any of them).
+
 `pgdb testdb shell` execs into
 [`sqlcmd`](https://github.com/microsoft/go-sqlcmd) (an external prerequisite,
 the same category as `psql` for the Postgres path) rather than a Python

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/README.md

@@ -240,11 +240,25 @@ worktree and wants to know exactly which DB(s) go with it.
 
 Container connection defaults (`localhost:54322`, `postgres`/`testpwd`) can
 be overridden with `PGDEVKIT_TESTDB_HOST`, `PGDEVKIT_TESTDB_PORT`,
-`PGDEVKIT_TESTDB_USER`, `PGDEVKIT_TESTDB_PASSWORD`. Before touching the
-Docker API, pgdevkit first checks (with a short timeout) whether Postgres
-is already reachable at that address and skips container management if so.
-Set `PGDEVKIT_SKIP_CONTAINER=1` to always assume it's already there and skip
-that check too.
+`PGDEVKIT_TESTDB_USER`, `PGDEVKIT_TESTDB_PASSWORD`, and the image with
+`PGDEVKIT_TESTDB_IMAGE`. Before touching the Docker API, pgdevkit first
+checks (with a short timeout) whether Postgres is already reachable at that
+address and skips container management if so. Set `PGDEVKIT_SKIP_CONTAINER=1`
+to always assume it's already there and skip that check too.
+
+Docker-level resource knobs are unset by default (Docker/Podman's own
+defaults apply) and can be overridden with `PGDEVKIT_TESTDB_SHM_SIZE` (e.g.
+`256m`, useful when Docker's 64MB default shared-memory size is too small
+for parallel query workers), `PGDEVKIT_TESTDB_MEM_LIMIT` (e.g. `1g`),
+`PGDEVKIT_TESTDB_CPUS` (e.g. `2` or `0.5`), and `PGDEVKIT_TESTDB_TMPFS` —
+docker-CLI `--tmpfs` syntax (`/path:options`), semicolon-separated for
+multiple mounts, e.g. `/var/lib/postgresql/data:size=512m`.
+
+All of the above (including `_HOST`/`_PORT`/`_USER`/`_PASSWORD`/`_IMAGE`)
+only take effect when pgdevkit actually creates the container, not when it
+finds and restarts an existing stopped one with the same name — remove the
+existing container (`docker rm -f pgdevkit-postgres`) first if you've
+changed any of these on a machine that already has one.
 
 Container management goes through the Docker API (the `docker` package,
 `docker.from_env()`, falling back to Podman's rootful/rootless socket) — it
@@ -270,6 +284,17 @@ Container defaults (`localhost:14330`, `sa`/a generated complexity-valid
 password) can be overridden with `PGDEVKIT_TESTDB_MSSQL_HOST`, `_PORT`,
 `_USER`, `_PASSWORD`, `_IMAGE`, `_MEMORY_LIMIT_MB`. The container only
 bootstraps the `sa` login — additional logins are a known limitation.
+
+The same Docker-level resource knobs as the Postgres container are
+available here too: `PGDEVKIT_TESTDB_MSSQL_SHM_SIZE`,
+`PGDEVKIT_TESTDB_MSSQL_MEM_LIMIT` (a container-level cgroup limit, distinct
+from `_MEMORY_LIMIT_MB` above which only tunes SQL Server's own internal
+memory management), `PGDEVKIT_TESTDB_MSSQL_CPUS`, and
+`PGDEVKIT_TESTDB_MSSQL_TMPFS`. As with the Postgres container, these only
+take effect when pgdevkit creates the container, not when restarting an
+existing stopped one (`docker rm -f pgdevkit-mssql` first if you've changed
+any of them).
+
 `pgdb testdb shell` execs into
 [`sqlcmd`](https://github.com/microsoft/go-sqlcmd) (an external prerequisite,
 the same category as `psql` for the Postgres path) rather than a Python

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/migrate.py

@@ -303,6 +303,14 @@ def record_applied(conninfo: str, tracking_table: str, filename: str) -> bool:
             return False
 
 
+def created_table_names(sql: str) -> list[str]:
+    """Table names any CREATE TABLE statement in this raw SQL script targets. Public
+    wrapper around the same detection `apply_migration` uses internally, for callers that
+    run a script directly (e.g. via `execute_sql_script`) instead of through a tracked
+    migration file, and still want to know what tables -- if any -- it created."""
+    return _created_table_names(_split_sql(sql))
+
+
 def verify_created_tables(conninfo: str, stmts: list[str]) -> list[str]:
     """Table names from this migration's CREATE TABLE statements that do NOT exist in the
     database. Empty means everything landed."""
@@ -318,6 +326,39 @@ def verify_created_tables(conninfo: str, stmts: list[str]) -> list[str]:
     return missing
 
 
+def missing_privileges(conninfo: str, role: str, tables: list[str], privilege: str = "select") -> list[str]:
+    """Table names from `tables` that `role` cannot currently exercise `privilege` on
+    (checked via Postgres's own `has_table_privilege`). Empty means the role can access
+    all of them. For guarding against the classic "migration creates a table, nobody
+    grants it to the app's runtime role" gap: check the tables a migration just created
+    against the role that will actually query them at runtime."""
+    if not tables:
+        return []
+    missing = []
+    with psycopg.connect(conninfo) as con:
+        for tbl in tables:
+            row = con.execute("select has_table_privilege(%s, %s, %s)", (role, tbl, privilege)).fetchone()
+            if not (row and row[0]):
+                missing.append(tbl)
+    return missing
+
+
+def _execute_stmts(conninfo: str, stmts: list[str]) -> None:
+    with psycopg.connect(conninfo) as con:
+        for stmt in stmts:
+            con.execute(cast(LiteralString, stmt))
+        con.commit()
+
+
+def execute_sql_script(conninfo: str, sql: str) -> None:
+    """Run a raw SQL script as one committed transaction, split into statements the same
+    statement-boundary-safe way apply_migration is (dollar-quoted blocks, string literals,
+    and line comments never get split mid-statement). Unlike apply_migration, this does
+    no tracking-table bookkeeping and isn't forward-only -- for scripts meant to re-run
+    every time, like an idempotent `GRANT ... ON ALL TABLES IN SCHEMA` privilege sync."""
+    _execute_stmts(conninfo, _split_sql(sql))
+
+
 @dataclass
 class ApplyResult:
     filename: str
@@ -337,11 +378,7 @@ def apply_migration(
     stmts = _split_sql(sql)
 
     if not already_done:
-        # DDL in its own committed transaction.
-        with psycopg.connect(conninfo) as con:
-            for stmt in stmts:
-                con.execute(cast(LiteralString, stmt))
-            con.commit()
+        _execute_stmts(conninfo, stmts)
 
     # Tracking insert is a separate connection/transaction so a missing tracking table
     # never rolls back the DDL that was just applied.

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/testdb/_docker.py

@@ -39,3 +39,36 @@ def client() -> docker.DockerClient:
         "Could not reach a Docker-compatible API. Set DOCKER_HOST, or make sure "
         "Docker or Podman's API socket is running."
     )
+
+
+def _parse_tmpfs(spec: str) -> dict[str, str]:
+    """Parse a docker-CLI-style --tmpfs spec into the dict shape docker-py's
+    `containers.run(tmpfs=...)` expects. Multiple mounts are semicolon-separated
+    (commas are already used by docker's own comma-separated mount options),
+    e.g. "/path:rw,size=64m;/other/path:ro,size=32m", matching `docker run
+    --tmpfs /path:rw,size=64m --tmpfs /other/path:ro,size=32m`."""
+    mounts: dict[str, str] = {}
+    for entry in spec.split(";"):
+        entry = entry.strip()
+        if not entry:
+            continue
+        path, _, options = entry.partition(":")
+        mounts[path] = options
+    return mounts
+
+
+def resource_kwargs(*, tmpfs: str, shm_size: str, mem_limit: str, cpus: str) -> dict:
+    """Build the `containers.run()` kwargs for the tmpfs/shm_size/mem_limit/cpus
+    overrides, omitting any that aren't set so Docker's own defaults apply.
+    Shared by the Postgres and MSSQL container modules -- these are Docker-level
+    resource knobs, not anything specific to either engine."""
+    kwargs: dict = {}
+    if tmpfs:
+        kwargs["tmpfs"] = _parse_tmpfs(tmpfs)
+    if shm_size:
+        kwargs["shm_size"] = shm_size
+    if mem_limit:
+        kwargs["mem_limit"] = mem_limit
+    if cpus:
+        kwargs["nano_cpus"] = int(float(cpus) * 1_000_000_000)
+    return kwargs

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/testdb/constants.py

@@ -5,11 +5,18 @@ import os
 from psycopg.conninfo import make_conninfo
 
 CONTAINER_NAME = "pgdevkit-postgres"
-IMAGE = "pgvector/pgvector:pg18-trixie"
+IMAGE = os.environ.get("PGDEVKIT_TESTDB_IMAGE", "pgvector/pgvector:pg18-trixie")
 HOST = os.environ.get("PGDEVKIT_TESTDB_HOST", "localhost")
 PORT = int(os.environ.get("PGDEVKIT_TESTDB_PORT", "54322"))
 USER = os.environ.get("PGDEVKIT_TESTDB_USER", "postgres")
 PASSWORD = os.environ.get("PGDEVKIT_TESTDB_PASSWORD", "testpwd")
+# Docker-level resource overrides, passed through to `containers.run()` --
+# unset (the default) means "let Docker/Podman use their own defaults".
+# TMPFS uses docker-CLI --tmpfs syntax; see _docker._parse_tmpfs().
+TMPFS = os.environ.get("PGDEVKIT_TESTDB_TMPFS", "")
+SHM_SIZE = os.environ.get("PGDEVKIT_TESTDB_SHM_SIZE", "")
+MEM_LIMIT = os.environ.get("PGDEVKIT_TESTDB_MEM_LIMIT", "")
+CPUS = os.environ.get("PGDEVKIT_TESTDB_CPUS", "")
 PG_SPEED_FLAGS = ["-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
 # Production connects with session timezone=UTC; the container image's own default
 # (baked into its base OS, not something pgdevkit ever set) can differ, silently

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/testdb/container.py

@@ -7,7 +7,7 @@ import docker
 import docker.errors
 import psycopg
 
-from . import constants
+from . import _docker, constants
 from ._docker import client as _client
 
 
@@ -43,6 +43,12 @@ def _create_container(client: docker.DockerClient) -> None:
                 "PGTZ": "UTC",
             },
             command=["postgres", *constants.PG_STARTUP_FLAGS],
+            **_docker.resource_kwargs(
+                tmpfs=constants.TMPFS,
+                shm_size=constants.SHM_SIZE,
+                mem_limit=constants.MEM_LIMIT,
+                cpus=constants.CPUS,
+            ),
         )
     except docker.errors.APIError as e:
         if getattr(e, "status_code", None) == 409 or "already in use" in str(e):
@@ -79,6 +85,10 @@ def ensure_container() -> None:
     except docker.errors.NotFound:
         container = None
     if container is not None:
+        # An existing container (even stopped) is just restarted as-is --
+        # constants like TMPFS/SHM_SIZE/IMAGE/etc. only take effect via
+        # _create_container(), so changing them has no effect here until
+        # the stale container is removed. Documented in the README.
         if container.status != "running":
             container.start()
     else:

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/testdb/mssql/constants.py

@@ -22,6 +22,15 @@ USER = os.environ.get("PGDEVKIT_TESTDB_MSSQL_USER", "sa")
 # default -- see validate_sa_password().
 PASSWORD = os.environ.get("PGDEVKIT_TESTDB_MSSQL_PASSWORD", "TestPwd!2026")
 MEMORY_LIMIT_MB = int(os.environ.get("PGDEVKIT_TESTDB_MSSQL_MEMORY_LIMIT_MB", "2048"))
+# Docker-level resource overrides, passed through to `containers.run()` --
+# unset (the default) means "let Docker/Podman use their own defaults". Distinct
+# from MEMORY_LIMIT_MB above, which only controls SQL Server's own internal memory
+# management, not the container's actual cgroup limit. TMPFS uses docker-CLI
+# --tmpfs syntax; see _docker._parse_tmpfs().
+TMPFS = os.environ.get("PGDEVKIT_TESTDB_MSSQL_TMPFS", "")
+SHM_SIZE = os.environ.get("PGDEVKIT_TESTDB_MSSQL_SHM_SIZE", "")
+MEM_LIMIT = os.environ.get("PGDEVKIT_TESTDB_MSSQL_MEM_LIMIT", "")
+CPUS = os.environ.get("PGDEVKIT_TESTDB_MSSQL_CPUS", "")
 
 
 def validate_sa_password(password: str) -> None:

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pgdevkit/testdb/mssql/container.py

@@ -40,6 +40,12 @@ def _create_container(client: docker.DockerClient) -> None:
                 "MSSQL_PID": "Developer",
                 "MSSQL_MEMORY_LIMIT_MB": str(constants.MEMORY_LIMIT_MB),
             },
+            **_docker.resource_kwargs(
+                tmpfs=constants.TMPFS,
+                shm_size=constants.SHM_SIZE,
+                mem_limit=constants.MEM_LIMIT,
+                cpus=constants.CPUS,
+            ),
         )
     except docker.errors.APIError as e:
         if getattr(e, "status_code", None) == 409 or "already in use" in str(e):
@@ -83,6 +89,9 @@ def ensure_mssql_container() -> None:
     except docker.errors.NotFound:
         container = None
     if container is not None:
+        # See the Postgres container's ensure_container() -- an existing
+        # (even stopped) container is just restarted as-is, so config
+        # constants only take effect via _create_container().
         if container.status != "running":
             container.start()
     else:

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/pyproject.toml

@@ -11,7 +11,7 @@ packages = ["pgdevkit"]
 
 [project]
 name = "pgdevkit"
-version = "0.7.2"
+version = "0.9.0"
 description = "A helper for developing with Postgres"
 readme = "README.md"
 requires-python = ">=3.14"

pgdevkit-0.9.0/tests/test_migrate_grants.py

@@ -0,0 +1,91 @@
+from __future__ import annotations
+
+import psycopg
+import pytest
+
+from pgdevkit.migrate import created_table_names, execute_sql_script, missing_privileges
+
+ROLE = "pgdevkit_test_grants_role"
+
+
+@pytest.fixture
+def app_role(clean_db: str):
+    """A throwaway, no-login role to check privileges against -- dropped afterwards since
+    roles are cluster-wide, not scoped to the (per-test) database like clean_db's schemas."""
+    with psycopg.connect(clean_db, autocommit=True) as con:
+        con.execute(f"DROP ROLE IF EXISTS {ROLE}")
+        con.execute(f"CREATE ROLE {ROLE} NOLOGIN")
+    yield ROLE
+    with psycopg.connect(clean_db, autocommit=True) as con:
+        # DROP OWNED BY revokes any grants left on tables the role can still see --
+        # otherwise DROP ROLE fails with "cannot be dropped because some objects depend
+        # on it" for as long as the granted-on table (e.g. widgets) still exists.
+        con.execute(f"DROP OWNED BY {ROLE}")
+        con.execute(f"DROP ROLE IF EXISTS {ROLE}")
+
+
+def test_created_table_names_finds_tables_in_a_raw_script():
+    sql = "GRANT SELECT ON foo TO some_role; CREATE TABLE public.widgets (id int primary key);"
+    assert created_table_names(sql) == ["public.widgets"]
+
+
+def test_created_table_names_empty_for_a_script_with_no_create_table():
+    assert created_table_names("GRANT SELECT ON ALL TABLES IN SCHEMA public TO some_role;") == []
+
+
+def test_execute_sql_script_runs_multiple_statements_in_one_transaction(clean_db: str):
+    execute_sql_script(
+        clean_db,
+        """
+        -- a leading comment shouldn't confuse statement splitting
+        CREATE TABLE public.widgets (id int primary key);
+        INSERT INTO public.widgets VALUES (1);
+        """,
+    )
+    with psycopg.connect(clean_db) as con:
+        row = con.execute("select count(*) from public.widgets").fetchone()
+        assert row == (1,)
+
+
+def test_execute_sql_script_rolls_back_all_statements_on_any_failure(clean_db: str):
+    with pytest.raises(psycopg.Error):
+        execute_sql_script(
+            clean_db,
+            "CREATE TABLE public.widgets (id int primary key); NOT VALID SQL HERE;",
+        )
+    with psycopg.connect(clean_db) as con:
+        row = con.execute("select to_regclass('public.widgets')").fetchone()
+        assert row is not None and row[0] is None
+
+
+def test_missing_privileges_reports_table_without_grant(clean_db: str, app_role: str):
+    with psycopg.connect(clean_db, autocommit=True) as con:
+        con.execute("CREATE TABLE public.widgets (id int primary key)")
+    assert missing_privileges(clean_db, app_role, ["public.widgets"]) == ["public.widgets"]
+
+
+def test_missing_privileges_empty_once_granted(clean_db: str, app_role: str):
+    with psycopg.connect(clean_db, autocommit=True) as con:
+        con.execute("CREATE TABLE public.widgets (id int primary key)")
+        con.execute(f"GRANT SELECT ON public.widgets TO {app_role}")
+    assert missing_privileges(clean_db, app_role, ["public.widgets"]) == []
+
+
+def test_missing_privileges_empty_for_no_tables(clean_db: str, app_role: str):
+    assert missing_privileges(clean_db, app_role, []) == []
+
+
+def test_execute_sql_script_grant_on_all_tables_covers_tables_created_after_the_fact(
+    clean_db: str, app_role: str
+):
+    """The actual use case: a re-run of `GRANT ... ON ALL TABLES IN SCHEMA` after a new
+    table appears picks it up automatically -- unlike ALTER DEFAULT PRIVILEGES, which only
+    covers tables created later by the exact role that ran the ALTER DEFAULT PRIVILEGES
+    statement itself."""
+    with psycopg.connect(clean_db, autocommit=True) as con:
+        con.execute("CREATE TABLE public.widgets (id int primary key)")
+    assert missing_privileges(clean_db, app_role, ["public.widgets"]) == ["public.widgets"]
+
+    execute_sql_script(clean_db, f"GRANT SELECT ON ALL TABLES IN SCHEMA public TO {app_role}")
+
+    assert missing_privileges(clean_db, app_role, ["public.widgets"]) == []

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/tests/testdb/test_constants.py

@@ -10,12 +10,22 @@ def test_defaults_when_env_vars_unset(monkeypatch):
     monkeypatch.delenv("PGDEVKIT_TESTDB_PORT", raising=False)
     monkeypatch.delenv("PGDEVKIT_TESTDB_USER", raising=False)
     monkeypatch.delenv("PGDEVKIT_TESTDB_PASSWORD", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_IMAGE", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_TMPFS", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_SHM_SIZE", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_MEM_LIMIT", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_CPUS", raising=False)
     try:
         importlib.reload(constants)
         assert constants.HOST == "localhost"
         assert constants.PORT == 54322
         assert constants.USER == "postgres"
         assert constants.PASSWORD == "testpwd"
+        assert constants.IMAGE == "pgvector/pgvector:pg18-trixie"
+        assert constants.TMPFS == ""
+        assert constants.SHM_SIZE == ""
+        assert constants.MEM_LIMIT == ""
+        assert constants.CPUS == ""
     finally:
         importlib.reload(constants)
 
@@ -37,3 +47,21 @@ def test_env_vars_override_connection_defaults(monkeypatch):
         # override values right back in, leaking them into every later test.
         monkeypatch.undo()
         importlib.reload(constants)
+
+
+def test_env_vars_override_docker_resource_defaults(monkeypatch):
+    monkeypatch.setenv("PGDEVKIT_TESTDB_IMAGE", "otherimage:latest")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_TMPFS", "/var/lib/postgresql/data:size=512m")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_SHM_SIZE", "256m")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_MEM_LIMIT", "1g")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_CPUS", "2")
+    try:
+        importlib.reload(constants)
+        assert constants.IMAGE == "otherimage:latest"
+        assert constants.TMPFS == "/var/lib/postgresql/data:size=512m"
+        assert constants.SHM_SIZE == "256m"
+        assert constants.MEM_LIMIT == "1g"
+        assert constants.CPUS == "2"
+    finally:
+        monkeypatch.undo()
+        importlib.reload(constants)

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/tests/testdb/test_container.py

@@ -79,6 +79,30 @@ def test_create_container_forces_utc_timezone():
     assert client.containers.run_kwargs["environment"]["PGTZ"] == "UTC"
 
 
+def test_create_container_omits_resource_kwargs_by_default():
+    client = _FakeClient()
+
+    _create_container(client)
+
+    for key in ("tmpfs", "shm_size", "mem_limit", "nano_cpus"):
+        assert key not in client.containers.run_kwargs
+
+
+def test_create_container_passes_through_resource_overrides(monkeypatch):
+    monkeypatch.setattr(constants, "TMPFS", "/var/lib/postgresql/data:size=512m")
+    monkeypatch.setattr(constants, "SHM_SIZE", "256m")
+    monkeypatch.setattr(constants, "MEM_LIMIT", "1g")
+    monkeypatch.setattr(constants, "CPUS", "2")
+    client = _FakeClient()
+
+    _create_container(client)
+
+    assert client.containers.run_kwargs["tmpfs"] == {"/var/lib/postgresql/data": "size=512m"}
+    assert client.containers.run_kwargs["shm_size"] == "256m"
+    assert client.containers.run_kwargs["mem_limit"] == "1g"
+    assert client.containers.run_kwargs["nano_cpus"] == 2_000_000_000
+
+
 def _admin_dsn() -> str:
     return constants.conninfo("postgres", connect_timeout=5)
 

pgdevkit-0.9.0/tests/testdb/test_container_mssql.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from pgdevkit.testdb.mssql import constants
+from pgdevkit.testdb.mssql.container import _create_container
+
+
+class _FakeContainers:
+    def __init__(self):
+        self.run_kwargs: dict | None = None
+
+    def run(self, image, **kwargs):
+        self.run_kwargs = kwargs
+
+
+class _FakeClient:
+    def __init__(self):
+        self.containers = _FakeContainers()
+
+
+def test_create_container_omits_resource_kwargs_by_default():
+    client = _FakeClient()
+
+    _create_container(client)
+
+    for key in ("tmpfs", "shm_size", "mem_limit", "nano_cpus"):
+        assert key not in client.containers.run_kwargs
+
+
+def test_create_container_passes_through_resource_overrides(monkeypatch):
+    monkeypatch.setattr(constants, "TMPFS", "/var/opt/mssql:size=512m")
+    monkeypatch.setattr(constants, "SHM_SIZE", "256m")
+    monkeypatch.setattr(constants, "MEM_LIMIT", "4g")
+    monkeypatch.setattr(constants, "CPUS", "2")
+    client = _FakeClient()
+
+    _create_container(client)
+
+    assert client.containers.run_kwargs["tmpfs"] == {"/var/opt/mssql": "size=512m"}
+    assert client.containers.run_kwargs["shm_size"] == "256m"
+    assert client.containers.run_kwargs["mem_limit"] == "4g"
+    assert client.containers.run_kwargs["nano_cpus"] == 2_000_000_000

pgdevkit-0.9.0/tests/testdb/test_docker.py

@@ -0,0 +1,46 @@
+from __future__ import annotations
+
+from pgdevkit.testdb._docker import _parse_tmpfs, resource_kwargs
+
+
+def test_parse_tmpfs_single_mount():
+    assert _parse_tmpfs("/var/lib/postgresql/data:rw,size=512m") == {
+        "/var/lib/postgresql/data": "rw,size=512m"
+    }
+
+
+def test_parse_tmpfs_multiple_mounts_semicolon_separated():
+    assert _parse_tmpfs("/data:size=512m;/tmp:rw,size=64m") == {
+        "/data": "size=512m",
+        "/tmp": "rw,size=64m",
+    }
+
+
+def test_parse_tmpfs_path_without_options():
+    assert _parse_tmpfs("/tmp") == {"/tmp": ""}
+
+
+def test_parse_tmpfs_ignores_blank_entries():
+    assert _parse_tmpfs("/data:size=512m;;/tmp:size=64m;") == {
+        "/data": "size=512m",
+        "/tmp": "size=64m",
+    }
+
+
+def test_resource_kwargs_all_unset_returns_empty_dict():
+    assert resource_kwargs(tmpfs="", shm_size="", mem_limit="", cpus="") == {}
+
+
+def test_resource_kwargs_only_includes_set_values():
+    kwargs = resource_kwargs(tmpfs="/data:size=512m", shm_size="", mem_limit="1g", cpus="")
+    assert kwargs == {"tmpfs": {"/data": "size=512m"}, "mem_limit": "1g"}
+
+
+def test_resource_kwargs_cpus_converted_to_nano_cpus():
+    assert resource_kwargs(tmpfs="", shm_size="", mem_limit="", cpus="1.5") == {
+        "nano_cpus": 1_500_000_000
+    }
+
+
+def test_resource_kwargs_shm_size_passed_through():
+    assert resource_kwargs(tmpfs="", shm_size="256m", mem_limit="", cpus="") == {"shm_size": "256m"}

pgdevkit-0.9.0/tests/testdb/test_mssql_constants.py

@@ -0,0 +1,65 @@
+from __future__ import annotations
+
+import importlib
+
+import pytest
+
+from pgdevkit.testdb.mssql import constants
+from pgdevkit.testdb.mssql.constants import conninfo, validate_sa_password
+
+
+def test_validate_sa_password_accepts_complexity_valid_password():
+    validate_sa_password("TestPwd!2026")  # must not raise
+
+
+def test_validate_sa_password_rejects_too_short():
+    with pytest.raises(ValueError, match="8 characters"):
+        validate_sa_password("Ab1!")
+
+
+def test_validate_sa_password_rejects_containing_login_name():
+    with pytest.raises(ValueError, match="'sa'"):
+        validate_sa_password("Sup3rSaPass!")
+
+
+def test_validate_sa_password_rejects_insufficient_character_classes():
+    with pytest.raises(ValueError, match="3 of"):
+        validate_sa_password("alllowercase")
+
+
+def test_conninfo_omits_driver_and_app_keys():
+    cs = conninfo("mydb")
+    assert "Driver=" not in cs
+    assert "APP=" not in cs
+    assert "Database=mydb" in cs
+
+
+def test_docker_resource_defaults_unset(monkeypatch):
+    monkeypatch.delenv("PGDEVKIT_TESTDB_MSSQL_TMPFS", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_MSSQL_SHM_SIZE", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_MSSQL_MEM_LIMIT", raising=False)
+    monkeypatch.delenv("PGDEVKIT_TESTDB_MSSQL_CPUS", raising=False)
+    try:
+        importlib.reload(constants)
+        assert constants.TMPFS == ""
+        assert constants.SHM_SIZE == ""
+        assert constants.MEM_LIMIT == ""
+        assert constants.CPUS == ""
+    finally:
+        importlib.reload(constants)
+
+
+def test_docker_resource_env_vars_override_defaults(monkeypatch):
+    monkeypatch.setenv("PGDEVKIT_TESTDB_MSSQL_TMPFS", "/var/opt/mssql:size=512m")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_MSSQL_SHM_SIZE", "256m")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_MSSQL_MEM_LIMIT", "4g")
+    monkeypatch.setenv("PGDEVKIT_TESTDB_MSSQL_CPUS", "2")
+    try:
+        importlib.reload(constants)
+        assert constants.TMPFS == "/var/opt/mssql:size=512m"
+        assert constants.SHM_SIZE == "256m"
+        assert constants.MEM_LIMIT == "4g"
+        assert constants.CPUS == "2"
+    finally:
+        monkeypatch.undo()
+        importlib.reload(constants)

{pgdevkit-0.7.2 → pgdevkit-0.9.0}/uv.lock

@@ -313,7 +313,7 @@ wheels = [
 
 [[package]]
 name = "pgdevkit"
-version = "0.7.2"
+version = "0.9.0"
 source = { editable = "." }
 dependencies = [
     { name = "docker" },

pgdevkit-0.7.2/tests/testdb/test_mssql_constants.py

@@ -1,31 +0,0 @@
-from __future__ import annotations
-
-import pytest
-
-from pgdevkit.testdb.mssql.constants import conninfo, validate_sa_password
-
-
-def test_validate_sa_password_accepts_complexity_valid_password():
-    validate_sa_password("TestPwd!2026")  # must not raise
-
-
-def test_validate_sa_password_rejects_too_short():
-    with pytest.raises(ValueError, match="8 characters"):
-        validate_sa_password("Ab1!")
-
-
-def test_validate_sa_password_rejects_containing_login_name():
-    with pytest.raises(ValueError, match="'sa'"):
-        validate_sa_password("Sup3rSaPass!")
-
-
-def test_validate_sa_password_rejects_insufficient_character_classes():
-    with pytest.raises(ValueError, match="3 of"):
-        validate_sa_password("alllowercase")
-
-
-def test_conninfo_omits_driver_and_app_keys():
-    cs = conninfo("mydb")
-    assert "Driver=" not in cs
-    assert "APP=" not in cs
-    assert "Database=mydb" in cs