Test with Podman in CI (#34)
* Test with Podman in CI * Correct logic to copy Docker image to Podman * Load necessary kernel modules in CI --------- Co-authored-by: Jordan Potter <me@jordanpotter.com>
This commit is contained in:
Jordan Potter
GitHub
parent
eefe2e4c9a
commit
bac385db3e
1 changed files with 46 additions and 29 deletions
75
.github/workflows/ci.yml
vendored
75
.github/workflows/ci.yml
vendored
|
|
@ -22,16 +22,13 @@ jobs:
|
||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Get date
|
- name: Load necessary kernel modules
|
||||||
id: date
|
run: sudo modprobe ip6_tables
|
||||||
uses: josStorer/get-current-time@v2
|
|
||||||
with:
|
|
||||||
format: YYYY-MM-DD
|
|
||||||
|
|
||||||
- name: Install wireguard
|
- name: Install WireGuard
|
||||||
run: sudo apt-get install wireguard
|
run: sudo apt-get install wireguard
|
||||||
|
|
||||||
- name: Download WireGuard config
|
- name: Create WireGuard config
|
||||||
run: echo '${{ secrets.WIREGUARD_CONF }}' > wireguard.conf
|
run: echo '${{ secrets.WIREGUARD_CONF }}' > wireguard.conf
|
||||||
|
|
||||||
- name: Set up QEMU
|
- name: Set up QEMU
|
||||||
|
|
@ -40,45 +37,59 @@ jobs:
|
||||||
- name: Set up Buildx
|
- name: Set up Buildx
|
||||||
uses: docker/setup-buildx-action@v3
|
uses: docker/setup-buildx-action@v3
|
||||||
|
|
||||||
- name: Build local image for testing
|
- name: Build local Docker image for testing
|
||||||
uses: docker/build-push-action@v5
|
uses: docker/build-push-action@v5
|
||||||
with:
|
with:
|
||||||
pull: true
|
pull: true
|
||||||
load: true
|
load: true
|
||||||
tags: wireguard
|
tags: wireguard
|
||||||
|
|
||||||
|
- name: Copy Docker image to Podman
|
||||||
|
run: |
|
||||||
|
sudo podman pull docker-daemon:docker.io/library/wireguard:latest
|
||||||
|
sudo podman save -o ${{ runner.temp }}/wireguard.tar docker.io/library/wireguard:latest
|
||||||
|
podman load -i ${{ runner.temp }}/wireguard.tar
|
||||||
|
|
||||||
- name: Test tunnel
|
- name: Test tunnel
|
||||||
run: |
|
run: |
|
||||||
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
for cmd in "docker" "podman" "sudo podman"; do
|
||||||
normal_ip=$(docker run --rm curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
$cmd run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
||||||
wireguard_ip=$(docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
normal_ip=$($cmd run --rm curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
||||||
if [ "$normal_ip" = "$wireguard_ip" ]; then echo "normal ip and wireguard ip are the same" && exit 1; fi
|
wireguard_ip=$($cmd run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io)
|
||||||
docker stop wireguard
|
if [ "$normal_ip" = "$wireguard_ip" ]; then echo "normal ip and wireguard ip are the same" && exit 1; fi
|
||||||
|
$cmd stop wireguard
|
||||||
|
done
|
||||||
|
|
||||||
- name: Test kill switch
|
- name: Test kill switch
|
||||||
run: |
|
run: |
|
||||||
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
for cmd in "docker" "podman" "sudo podman"; do
|
||||||
docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
$cmd run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf wireguard
|
||||||
docker exec wireguard wg-quick down wg0
|
$cmd run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
||||||
! docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
$cmd exec wireguard wg-quick down wg0
|
||||||
docker stop wireguard
|
! $cmd run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 ifconfig.io
|
||||||
|
$cmd stop wireguard
|
||||||
|
done
|
||||||
|
|
||||||
- name: Test local subnets
|
- name: Test local subnets
|
||||||
run: |
|
run: |
|
||||||
ip_address=$(ip route get 1.2.3.4 | awk '{print $7}')
|
for cmd in "docker" "podman" "sudo podman"; do
|
||||||
docker run --rm -d --name nginx -p 8080:80 nginx
|
ip_address=$(ip route get 1.2.3.4 | awk '{print $7}')
|
||||||
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -e LOCAL_SUBNETS=$ip_address/32 wireguard
|
$cmd run --rm -d --name nginx -p 8080:80 nginx
|
||||||
sleep 3
|
$cmd run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -e LOCAL_SUBNETS=$ip_address/32 wireguard
|
||||||
docker run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 $ip_address:8080
|
sleep 3
|
||||||
docker stop wireguard nginx
|
$cmd run --rm --net=container:wireguard curlimages/curl --retry 3 --retry-delay 5 $ip_address:8080
|
||||||
|
$cmd stop wireguard nginx
|
||||||
|
done
|
||||||
|
|
||||||
- name: Test exposed ports
|
- name: Test exposed ports
|
||||||
run: |
|
run: |
|
||||||
docker run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -p 8080:80 wireguard
|
for cmd in "docker" "podman" "sudo podman"; do
|
||||||
docker run --rm -d --name nginx --net=container:wireguard nginx
|
$cmd run --rm -d --name wireguard --cap-add NET_ADMIN --cap-add NET_RAW --cap-add SYS_MODULE --sysctl net.ipv4.conf.all.src_valid_mark=1 -v ${{ github.workspace }}/wireguard.conf:/etc/wireguard/wg0.conf -p 8080:80 wireguard
|
||||||
sleep 3
|
$cmd run --rm -d --name nginx --net=container:wireguard nginx
|
||||||
curl --retry 3 --retry-delay 5 localhost:8080
|
sleep 3
|
||||||
docker stop wireguard nginx
|
curl --retry 3 --retry-delay 5 localhost:8080
|
||||||
|
$cmd stop wireguard nginx
|
||||||
|
done
|
||||||
|
|
||||||
- name: Log into Docker Hub
|
- name: Log into Docker Hub
|
||||||
uses: docker/login-action@v3
|
uses: docker/login-action@v3
|
||||||
|
|
@ -93,6 +104,12 @@ jobs:
|
||||||
username: ${{ github.actor }}
|
username: ${{ github.actor }}
|
||||||
password: ${{ secrets.GITHUB_TOKEN }}
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
|
||||||
|
- name: Get date
|
||||||
|
id: date
|
||||||
|
uses: josStorer/get-current-time@v2
|
||||||
|
with:
|
||||||
|
format: YYYY-MM-DD
|
||||||
|
|
||||||
- name: Get metadata for image
|
- name: Get metadata for image
|
||||||
id: metadata
|
id: metadata
|
||||||
uses: docker/metadata-action@v5
|
uses: docker/metadata-action@v5
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue