package main
 
 import (

 	"bufio"

 	"bytes"

 	"fmt"

 	"io/ioutil"

 	"net"

 	"os"

 	"os/exec"

 	"path"

 	"path/filepath"

 	"reflect"

 	"regexp"

 	"sort"

 	"strconv"

 	"strings"

 	"sync"

 	"time"

 	"github.com/docker/docker/pkg/integration/checker"

 	"github.com/docker/docker/pkg/mount"

 	"github.com/docker/docker/pkg/stringutils"

 	"github.com/docker/docker/runconfig"

 	"github.com/docker/go-connections/nat"

 	"github.com/docker/libnetwork/netutils"

 	"github.com/docker/libnetwork/resolvconf"

 	"github.com/go-check/check"

 )
 
 // "test123" should be printed by docker run

 func (s *DockerSuite) TestRunEchoStdout(c *check.C) {

 	out, _ := dockerCmd(c, "run", "busybox", "echo", "test123")

 	if out != "test123\n" {

 		c.Fatalf("container should've printed 'test123', got '%s'", out)

 	}
 }
 
 // "test" should be printed

 func (s *DockerSuite) TestRunEchoNamedContainer(c *check.C) {

 	out, _ := dockerCmd(c, "run", "--name", "testfoonamedcontainer", "busybox", "echo", "test")

 	if out != "test\n" {

 		c.Errorf("container should've printed 'test'")

 	}
 }
 

 // docker run should not leak file descriptors. This test relies on Unix
 // specific functionality and cannot run on Windows.

 func (s *DockerSuite) TestRunLeakyFileDescriptors(c *check.C) {

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "busybox", "ls", "-C", "/proc/self/fd")

 
 	// normally, we should only get 0, 1, and 2, but 3 gets created by "ls" when it does "opendir" on the "fd" directory
 	if out != "0  1  2  3\n" {

 		c.Errorf("container should've printed '0  1  2  3', not: %s", out)

 	}
 }
 

 // it should be possible to lookup Google DNS

 // this will fail when Internet access is unavailable

 func (s *DockerSuite) TestRunLookupGoogleDns(c *check.C) {

 	testRequires(c, Network, NotArm)

 	image := DefaultImage
 	if daemonPlatform == "windows" {
 		// nslookup isn't present in Windows busybox. Is built-in.
 		image = WindowsBaseImage
 	}
 	dockerCmd(c, "run", image, "nslookup", "google.com")

 }
 
 // the exit code should be 0

 func (s *DockerSuite) TestRunExitCodeZero(c *check.C) {

 	dockerCmd(c, "run", "busybox", "true")

 }
 
 // the exit code should be 1

 func (s *DockerSuite) TestRunExitCodeOne(c *check.C) {

 	_, exitCode, err := dockerCmdWithError("run", "busybox", "false")

 	if err != nil && !strings.Contains("exit status 1", fmt.Sprintf("%s", err)) {

 		c.Fatal(err)

 	}
 	if exitCode != 1 {

 		c.Errorf("container should've exited with exit code 1. Got %d", exitCode)

 	}
 }
 
 // it should be possible to pipe in data via stdin to a process running in a container

 func (s *DockerSuite) TestRunStdinPipe(c *check.C) {

 	// TODO Windows: This needs some work to make compatible.

 	testRequires(c, DaemonIsLinux)

 	runCmd := exec.Command(dockerBinary, "run", "-i", "-a", "stdin", "busybox", "cat")
 	runCmd.Stdin = strings.NewReader("blahblah")

 	out, _, _, err := runCommandWithStdoutStderr(runCmd)

 	if err != nil {

 		c.Fatalf("failed to run container: %v, output: %q", err, out)

 	}

 	out = strings.TrimSpace(out)

 	dockerCmd(c, "wait", out)

 	logsOut, _ := dockerCmd(c, "logs", out)

 	containerLogs := strings.TrimSpace(logsOut)

 	if containerLogs != "blahblah" {

 		c.Errorf("logs didn't print the container's logs %s", containerLogs)

 	}
 

 	dockerCmd(c, "rm", out)

 }
 
 // the container's ID should be printed when starting a container in detached mode

 func (s *DockerSuite) TestRunDetachedContainerIDPrinting(c *check.C) {

 	out, _ := dockerCmd(c, "run", "-d", "busybox", "true")

 	out = strings.TrimSpace(out)

 	dockerCmd(c, "wait", out)

 	rmOut, _ := dockerCmd(c, "rm", out)

 	rmOut = strings.TrimSpace(rmOut)

 	if rmOut != out {

 		c.Errorf("rm didn't print the container ID %s %s", out, rmOut)

 	}
 }
 
 // the working directory should be set correctly

 func (s *DockerSuite) TestRunWorkingDirectory(c *check.C) {

 	// TODO Windows: There's a Windows bug stopping this from working.

 	testRequires(c, DaemonIsLinux)

 	dir := "/root"
 	image := "busybox"
 	if daemonPlatform == "windows" {
 		dir = `/windows`
 		image = WindowsBaseImage
 	}

 	// First with -w
 	out, _ := dockerCmd(c, "run", "-w", dir, image, "pwd")

 	out = strings.TrimSpace(out)

 	if out != dir {

 		c.Errorf("-w failed to set working directory")

 	}
 

 	// Then with --workdir
 	out, _ = dockerCmd(c, "run", "--workdir", dir, image, "pwd")

 	out = strings.TrimSpace(out)

 	if out != dir {

 		c.Errorf("--workdir failed to set working directory")

 	}
 }
 
 // pinging Google's DNS resolver should fail when we disable the networking

 func (s *DockerSuite) TestRunWithoutNetworking(c *check.C) {

 	count := "-c"
 	image := "busybox"
 	if daemonPlatform == "windows" {
 		count = "-n"
 		image = WindowsBaseImage
 	}
 
 	// First using the long form --net
 	out, exitCode, err := dockerCmdWithError("run", "--net=none", image, "ping", count, "1", "8.8.8.8")

 	if err != nil && exitCode != 1 {

 		c.Fatal(out, err)

 	}
 	if exitCode != 1 {

 		c.Errorf("--net=none should've disabled the network; the container shouldn't have been able to ping 8.8.8.8")

 	}
 }

 //test --link use container name to link target

 func (s *DockerSuite) TestRunLinksContainerWithContainerName(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as the networking
 	// settings are not populated back yet on inspect.

 	testRequires(c, DaemonIsLinux)

 	dockerCmd(c, "run", "-i", "-t", "-d", "--name", "parent", "busybox")
 

 	ip := inspectField(c, "parent", "NetworkSettings.Networks.bridge.IPAddress")

 
 	out, _ := dockerCmd(c, "run", "--link", "parent:test", "busybox", "/bin/cat", "/etc/hosts")

 	if !strings.Contains(out, ip+"	test") {

 		c.Fatalf("use a container name to link target failed")

 	}
 }
 
 //test --link use container id to link target

 func (s *DockerSuite) TestRunLinksContainerWithContainerId(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as the networking
 	// settings are not populated back yet on inspect.

 	testRequires(c, DaemonIsLinux)

 	cID, _ := dockerCmd(c, "run", "-i", "-t", "-d", "busybox")
 

 	cID = strings.TrimSpace(cID)

 	ip := inspectField(c, cID, "NetworkSettings.Networks.bridge.IPAddress")

 
 	out, _ := dockerCmd(c, "run", "--link", cID+":test", "busybox", "/bin/cat", "/etc/hosts")

 	if !strings.Contains(out, ip+"	test") {

 		c.Fatalf("use a container id to link target failed")

 	}
 }
 

 func (s *DockerSuite) TestUserDefinedNetworkLinks(c *check.C) {

 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)

 	dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
 
 	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
 	c.Assert(waitRun("first"), check.IsNil)
 
 	// run a container in user-defined network udlinkNet with a link for an existing container

 	// and a link for a container that doesn't exist

 	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
 		"--link=third:bar", "busybox", "top")
 	c.Assert(waitRun("second"), check.IsNil)
 
 	// ping to first and its alias foo must succeed
 	_, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
 	c.Assert(err, check.IsNil)
 
 	// ping to third and its alias must fail
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
 	c.Assert(err, check.NotNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
 	c.Assert(err, check.NotNil)
 
 	// start third container now
 	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=third", "busybox", "top")
 	c.Assert(waitRun("third"), check.IsNil)
 
 	// ping to third and its alias must succeed now
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "third")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "bar")
 	c.Assert(err, check.IsNil)
 }
 
 func (s *DockerSuite) TestUserDefinedNetworkLinksWithRestart(c *check.C) {

 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)

 	dockerCmd(c, "network", "create", "-d", "bridge", "udlinkNet")
 
 	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=first", "busybox", "top")
 	c.Assert(waitRun("first"), check.IsNil)
 
 	dockerCmd(c, "run", "-d", "--net=udlinkNet", "--name=second", "--link=first:foo",
 		"busybox", "top")
 	c.Assert(waitRun("second"), check.IsNil)
 
 	// ping to first and its alias foo must succeed
 	_, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
 	c.Assert(err, check.IsNil)
 
 	// Restart first container
 	dockerCmd(c, "restart", "first")
 	c.Assert(waitRun("first"), check.IsNil)
 
 	// ping to first and its alias foo must still succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
 	c.Assert(err, check.IsNil)
 
 	// Restart second container
 	dockerCmd(c, "restart", "second")
 	c.Assert(waitRun("second"), check.IsNil)
 
 	// ping to first and its alias foo must still succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo")
 	c.Assert(err, check.IsNil)
 }
 

 func (s *DockerSuite) TestRunWithNetAliasOnDefaultNetworks(c *check.C) {
 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)
 
 	defaults := []string{"bridge", "host", "none"}
 	for _, net := range defaults {
 		out, _, err := dockerCmdWithError("run", "-d", "--net", net, "--net-alias", "alias_"+net, "busybox", "top")
 		c.Assert(err, checker.NotNil)
 		c.Assert(out, checker.Contains, runconfig.ErrUnsupportedNetworkAndAlias.Error())
 	}
 }
 

 func (s *DockerSuite) TestUserDefinedNetworkAlias(c *check.C) {

 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)

 	dockerCmd(c, "network", "create", "-d", "bridge", "net1")
 
 	dockerCmd(c, "run", "-d", "--net=net1", "--name=first", "--net-alias=foo1", "--net-alias=foo2", "busybox", "top")
 	c.Assert(waitRun("first"), check.IsNil)
 
 	dockerCmd(c, "run", "-d", "--net=net1", "--name=second", "busybox", "top")
 	c.Assert(waitRun("second"), check.IsNil)
 
 	// ping to first and its network-scoped aliases
 	_, _, err := dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
 	c.Assert(err, check.IsNil)
 
 	// Restart first container
 	dockerCmd(c, "restart", "first")
 	c.Assert(waitRun("first"), check.IsNil)
 
 	// ping to first and its network-scoped aliases must succeed
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo1")
 	c.Assert(err, check.IsNil)
 	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "foo2")
 	c.Assert(err, check.IsNil)
 }
 

 // Issue 9677.
 func (s *DockerSuite) TestRunWithDaemonFlags(c *check.C) {

 	out, _, err := dockerCmdWithError("--exec-opt", "foo=bar", "run", "-i", "busybox", "true")

 	if err != nil {

 		if !strings.Contains(out, "flag provided but not defined: --exec-opt") { // no daemon (client-only)

 			c.Fatal(err, out)
 		}
 	}
 }
 

 // Regression test for #4979

 func (s *DockerSuite) TestRunWithVolumesFromExited(c *check.C) {

 
 	var (
 		out      string
 		exitCode int
 	)
 
 	// Create a file in a volume
 	if daemonPlatform == "windows" {
 		out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", `c:\some\dir`, WindowsBaseImage, `cmd /c echo hello > c:\some\dir\file`)
 	} else {
 		out, exitCode = dockerCmd(c, "run", "--name", "test-data", "--volume", "/some/dir", "busybox", "touch", "/some/dir/file")
 	}

 	if exitCode != 0 {
 		c.Fatal("1", out, exitCode)

 	}
 

 	// Read the file from another container using --volumes-from to access the volume in the second container
 	if daemonPlatform == "windows" {
 		out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", WindowsBaseImage, `cmd /c type c:\some\dir\file`)
 	} else {
 		out, exitCode = dockerCmd(c, "run", "--volumes-from", "test-data", "busybox", "cat", "/some/dir/file")
 	}

 	if exitCode != 0 {
 		c.Fatal("2", out, exitCode)

 	}
 }
 

 // Volume path is a symlink which also exists on the host, and the host side is a file not a dir
 // But the volume call is just a normal volume, not a bind mount

 func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir(c *check.C) {

 	var (
 		dockerFile    string
 		containerPath string
 		cmd           string
 	)

 	testRequires(c, SameHostDaemon)

 	name := "test-volume-symlink"
 
 	dir, err := ioutil.TempDir("", name)
 	if err != nil {

 		c.Fatal(err)

 	}

 	defer os.RemoveAll(dir)
 

 	// In the case of Windows to Windows CI, if the machine is setup so that
 	// the temp directory is not the C: drive, this test is invalid and will
 	// not work.
 	if daemonPlatform == "windows" && strings.ToLower(dir[:1]) != "c" {
 		c.Skip("Requires TEMP to point to C: drive")
 	}
 

 	f, err := os.OpenFile(filepath.Join(dir, "test"), os.O_CREATE, 0700)

 	if err != nil {

 		c.Fatal(err)

 	}
 	f.Close()
 

 	if daemonPlatform == "windows" {
 		dockerFile = fmt.Sprintf("FROM %s\nRUN mkdir %s\nRUN mklink /D c:\\test %s", WindowsBaseImage, dir, dir)
 		containerPath = `c:\test\test`
 		cmd = "tasklist"
 	} else {
 		dockerFile = fmt.Sprintf("FROM busybox\nRUN mkdir -p %s\nRUN ln -s %s /test", dir, dir)
 		containerPath = "/test/test"
 		cmd = "true"
 	}

 	if _, err := buildImage(name, dockerFile, false); err != nil {

 		c.Fatal(err)

 	}
 

 	dockerCmd(c, "run", "-v", containerPath, name, cmd)

 }
 

 // Volume path is a symlink in the container
 func (s *DockerSuite) TestRunCreateVolumesInSymlinkDir2(c *check.C) {
 	var (
 		dockerFile    string
 		containerPath string
 		cmd           string
 	)
 	testRequires(c, SameHostDaemon)
 	name := "test-volume-symlink2"
 
 	if daemonPlatform == "windows" {
 		dockerFile = fmt.Sprintf("FROM %s\nRUN mkdir c:\\%s\nRUN mklink /D c:\\test c:\\%s", WindowsBaseImage, name, name)
 		containerPath = `c:\test\test`
 		cmd = "tasklist"
 	} else {
 		dockerFile = fmt.Sprintf("FROM busybox\nRUN mkdir -p /%s\nRUN ln -s /%s /test", name, name)
 		containerPath = "/test/test"
 		cmd = "true"
 	}
 	if _, err := buildImage(name, dockerFile, false); err != nil {
 		c.Fatal(err)
 	}
 
 	dockerCmd(c, "run", "-v", containerPath, name, cmd)
 }
 

 func (s *DockerSuite) TestRunVolumesMountedAsReadonly(c *check.C) {

 	// TODO Windows (Post TP4): This test cannot run on a Windows daemon as
 	// Windows does not support read-only bind mounts.

 	testRequires(c, DaemonIsLinux)

 	if _, code, err := dockerCmdWithError("run", "-v", "/test:/test:ro", "busybox", "touch", "/test/somefile"); err == nil || code == 0 {

 		c.Fatalf("run should fail because volume is ro: exit code %d", code)

 	}
 }

 func (s *DockerSuite) TestRunVolumesFromInReadonlyModeFails(c *check.C) {
 	// TODO Windows (Post TP4): This test cannot run on a Windows daemon as
 	// Windows does not support read-only bind mounts. Modified for when ro is supported.

 	testRequires(c, DaemonIsLinux)

 	var (
 		volumeDir string
 		fileInVol string
 	)
 	if daemonPlatform == "windows" {
 		volumeDir = `c:/test` // Forward-slash as using busybox
 		fileInVol = `c:/test/file`
 	} else {
 		testRequires(c, DaemonIsLinux)
 		volumeDir = "/test"
 		fileInVol = `/test/file`
 	}
 	dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")

 	if _, code, err := dockerCmdWithError("run", "--volumes-from", "parent:ro", "busybox", "touch", fileInVol); err == nil || code == 0 {

 		c.Fatalf("run should fail because volume is ro: exit code %d", code)

 	}
 }
 
 // Regression test for #1201

 func (s *DockerSuite) TestRunVolumesFromInReadWriteMode(c *check.C) {

 	var (
 		volumeDir string
 		fileInVol string
 	)
 	if daemonPlatform == "windows" {
 		volumeDir = `c:/test` // Forward-slash as using busybox
 		fileInVol = `c:/test/file`
 	} else {
 		volumeDir = "/test"
 		fileInVol = "/test/file"
 	}
 
 	dockerCmd(c, "run", "--name", "parent", "-v", volumeDir, "busybox", "true")
 	dockerCmd(c, "run", "--volumes-from", "parent:rw", "busybox", "touch", fileInVol)

 	if out, _, err := dockerCmdWithError("run", "--volumes-from", "parent:bar", "busybox", "touch", fileInVol); err == nil || !strings.Contains(out, `invalid mode: bar`) {

 		c.Fatalf("running --volumes-from parent:bar should have failed with invalid mode: %q", out)

 	}
 

 	dockerCmd(c, "run", "--volumes-from", "parent", "busybox", "touch", fileInVol)

 }
 

 func (s *DockerSuite) TestVolumesFromGetsProperMode(c *check.C) {

 	// TODO Windows: This test cannot yet run on a Windows daemon as Windows does
 	// not support read-only bind mounts as at TP4

 	testRequires(c, DaemonIsLinux)

 	dockerCmd(c, "run", "--name", "parent", "-v", "/test:/test:ro", "busybox", "true")
 

 	// Expect this "rw" mode to be be ignored since the inherited volume is "ro"

 	if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent:rw", "busybox", "touch", "/test/file"); err == nil {

 		c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `rw`")

 	}
 

 	dockerCmd(c, "run", "--name", "parent2", "-v", "/test:/test:ro", "busybox", "true")
 

 	// Expect this to be read-only since both are "ro"

 	if _, _, err := dockerCmdWithError("run", "--volumes-from", "parent2:ro", "busybox", "touch", "/test/file"); err == nil {

 		c.Fatal("Expected volumes-from to inherit read-only volume even when passing in `ro`")

 	}
 }
 

 // Test for GH#10618

 func (s *DockerSuite) TestRunNoDupVolumes(c *check.C) {

 	path1 := randomTmpDirPath("test1", daemonPlatform)
 	path2 := randomTmpDirPath("test2", daemonPlatform)
 
 	someplace := ":/someplace"
 	if daemonPlatform == "windows" {
 		// Windows requires that the source directory exists before calling HCS

 		testRequires(c, SameHostDaemon)

 		someplace = `:c:\someplace`
 		if err := os.MkdirAll(path1, 0755); err != nil {
 			c.Fatalf("Failed to create %s: %q", path1, err)
 		}
 		defer os.RemoveAll(path1)
 		if err := os.MkdirAll(path2, 0755); err != nil {
 			c.Fatalf("Failed to create %s: %q", path1, err)
 		}
 		defer os.RemoveAll(path2)
 	}
 	mountstr1 := path1 + someplace
 	mountstr2 := path2 + someplace

 	if out, _, err := dockerCmdWithError("run", "-v", mountstr1, "-v", mountstr2, "busybox", "true"); err == nil {

 		c.Fatal("Expected error about duplicate mount definitions")

 	} else {

 		if !strings.Contains(out, "Duplicate mount point") {
 			c.Fatalf("Expected 'duplicate mount point' error, got %v", out)

 		}
 	}
 }
 

 // Test for #1351

 func (s *DockerSuite) TestRunApplyVolumesFromBeforeVolumes(c *check.C) {

 	prefix := ""
 	if daemonPlatform == "windows" {
 		prefix = `c:`
 	}
 	dockerCmd(c, "run", "--name", "parent", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
 	dockerCmd(c, "run", "--volumes-from", "parent", "-v", prefix+"/test", "busybox", "cat", prefix+"/test/foo")

 }
 

 func (s *DockerSuite) TestRunMultipleVolumesFrom(c *check.C) {

 	prefix := ""
 	if daemonPlatform == "windows" {
 		prefix = `c:`
 	}
 	dockerCmd(c, "run", "--name", "parent1", "-v", prefix+"/test", "busybox", "touch", prefix+"/test/foo")
 	dockerCmd(c, "run", "--name", "parent2", "-v", prefix+"/other", "busybox", "touch", prefix+"/other/bar")

 	dockerCmd(c, "run", "--volumes-from", "parent1", "--volumes-from", "parent2", "busybox", "sh", "-c", "cat /test/foo && cat /other/bar")

 }

 // this tests verifies the ID format for the container

 func (s *DockerSuite) TestRunVerifyContainerID(c *check.C) {

 	out, exit, err := dockerCmdWithError("run", "-d", "busybox", "true")

 	if err != nil {

 		c.Fatal(err)

 	}
 	if exit != 0 {

 		c.Fatalf("expected exit code 0 received %d", exit)

 	}

 	match, err := regexp.MatchString("^[0-9a-f]{64}$", strings.TrimSuffix(out, "\n"))
 	if err != nil {

 		c.Fatal(err)

 	}
 	if !match {

 		c.Fatalf("Invalid container ID: %s", out)

 	}
 }
 
 // Test that creating a container with a volume doesn't crash. Regression test for #995.

 func (s *DockerSuite) TestRunCreateVolume(c *check.C) {

 	prefix := ""
 	if daemonPlatform == "windows" {
 		prefix = `c:`
 	}
 	dockerCmd(c, "run", "-v", prefix+"/var/lib/data", "busybox", "true")

 }
 

 // Test that creating a volume with a symlink in its path works correctly. Test for #5152.
 // Note that this bug happens only with symlinks with a target that starts with '/'.

 func (s *DockerSuite) TestRunCreateVolumeWithSymlink(c *check.C) {

 	// Cannot run on Windows as relies on Linux-specific functionality (sh -c mount...)

 	testRequires(c, DaemonIsLinux)

 	image := "docker-test-createvolumewithsymlink"
 
 	buildCmd := exec.Command(dockerBinary, "build", "-t", image, "-")

 	buildCmd.Stdin = strings.NewReader(`FROM busybox

 		RUN ln -s home /bar`)

 	buildCmd.Dir = workingDirectory

 	err := buildCmd.Run()
 	if err != nil {

 		c.Fatalf("could not build '%s': %v", image, err)

 	}
 

 	_, exitCode, err := dockerCmdWithError("run", "-v", "/bar/foo", "--name", "test-createvolumewithsymlink", image, "sh", "-c", "mount | grep -q /home/foo")

 	if err != nil || exitCode != 0 {

 		c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)

 	}
 

 	volPath, err := inspectMountSourceField("test-createvolumewithsymlink", "/bar/foo")

 	c.Assert(err, checker.IsNil)

 	_, exitCode, err = dockerCmdWithError("rm", "-v", "test-createvolumewithsymlink")

 	if err != nil || exitCode != 0 {

 		c.Fatalf("[rm] err: %v, exitcode: %d", err, exitCode)

 	}
 

 	_, err = os.Stat(volPath)

 	if !os.IsNotExist(err) {

 		c.Fatalf("[open] (expecting 'file does not exist' error) err: %v, volPath: %s", err, volPath)

 	}
 }
 

 // Tests that a volume path that has a symlink exists in a container mounting it with `--volumes-from`.

 func (s *DockerSuite) TestRunVolumesFromSymlinkPath(c *check.C) {

 	name := "docker-test-volumesfromsymlinkpath"

 	prefix := ""
 	dfContents := `FROM busybox
 		RUN ln -s home /foo
 		VOLUME ["/foo/bar"]`
 
 	if daemonPlatform == "windows" {
 		prefix = `c:`
 		dfContents = `FROM ` + WindowsBaseImage + `
 	    RUN mkdir c:\home

 		RUN mklink /D c:\foo c:\home

 		VOLUME ["c:/foo/bar"]
 		ENTRYPOINT c:\windows\system32\cmd.exe`
 	}

 	buildCmd := exec.Command(dockerBinary, "build", "-t", name, "-")

 	buildCmd.Stdin = strings.NewReader(dfContents)

 	buildCmd.Dir = workingDirectory
 	err := buildCmd.Run()
 	if err != nil {

 		c.Fatalf("could not build 'docker-test-volumesfromsymlinkpath': %v", err)

 	}
 

 	out, exitCode, err := dockerCmdWithError("run", "--name", "test-volumesfromsymlinkpath", name)

 	if err != nil || exitCode != 0 {

 		c.Fatalf("[run] (volume) err: %v, exitcode: %d, out: %s", err, exitCode, out)

 	}
 

 	_, exitCode, err = dockerCmdWithError("run", "--volumes-from", "test-volumesfromsymlinkpath", "busybox", "sh", "-c", "ls "+prefix+"/foo | grep -q bar")

 	if err != nil || exitCode != 0 {

 		c.Fatalf("[run] err: %v, exitcode: %d", err, exitCode)

 	}
 }
 

 func (s *DockerSuite) TestRunExitCode(c *check.C) {

 	var (
 		exit int
 		err  error
 	)

 
 	_, exit, err = dockerCmdWithError("run", "busybox", "/bin/sh", "-c", "exit 72")
 

 	if err == nil {

 		c.Fatal("should not have a non nil error")

 	}
 	if exit != 72 {

 		c.Fatalf("expected exit code 72 received %d", exit)

 	}
 }
 

 func (s *DockerSuite) TestRunUserDefaults(c *check.C) {
 	expected := "uid=0(root) gid=0(root)"
 	if daemonPlatform == "windows" {

 		// TODO Windows: Remove this check once TP4 is no longer supported.
 		if windowsDaemonKV < 14250 {
 			expected = "uid=1000(SYSTEM) gid=1000(SYSTEM)"
 		} else {
 			expected = "uid=1000(ContainerAdministrator) gid=1000(ContainerAdministrator)"
 		}

 	}

 	out, _ := dockerCmd(c, "run", "busybox", "id")

 	if !strings.Contains(out, expected) {
 		c.Fatalf("expected '%s' got %s", expected, out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserByName(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-u", "root", "busybox", "id")

 	if !strings.Contains(out, "uid=0(root) gid=0(root)") {

 		c.Fatalf("expected root user got %s", out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserByID(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-u", "1", "busybox", "id")

 	if !strings.Contains(out, "uid=1(daemon) gid=1(daemon)") {

 		c.Fatalf("expected daemon user got %s", out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserByIDBig(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u

 	testRequires(c, DaemonIsLinux, NotArm)

 	out, _, err := dockerCmdWithError("run", "-u", "2147483648", "busybox", "id")

 	if err == nil {

 		c.Fatal("No error, but must be.", out)

 	}
 	if !strings.Contains(out, "Uids and gids must be in range") {

 		c.Fatalf("expected error about uids range, got %s", out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserByIDNegative(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "-u", "-1", "busybox", "id")

 	if err == nil {

 		c.Fatal("No error, but must be.", out)

 	}
 	if !strings.Contains(out, "Uids and gids must be in range") {

 		c.Fatalf("expected error about uids range, got %s", out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserByIDZero(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "-u", "0", "busybox", "id")

 	if err != nil {

 		c.Fatal(err, out)

 	}
 	if !strings.Contains(out, "uid=0(root) gid=0(root) groups=10(wheel)") {

 		c.Fatalf("expected daemon user got %s", out)

 	}
 }
 

 func (s *DockerSuite) TestRunUserNotFound(c *check.C) {

 	// TODO Windows: This test cannot run on a Windows daemon as Windows does
 	// not support the use of -u
 	testRequires(c, DaemonIsLinux)

 	_, _, err := dockerCmdWithError("run", "-u", "notme", "busybox", "id")

 	if err == nil {

 		c.Fatal("unknown user should cause container to fail")

 	}
 }
 

 func (s *DockerSuite) TestRunTwoConcurrentContainers(c *check.C) {

 	// TODO Windows. There are two bugs in TP4 which means this test cannot
 	// be reliably enabled. The first is a race condition where sometimes
 	// HCS CreateComputeSystem() will fail "Invalid class string". #4985252 and
 	// #4493430.
 	//
 	// The second, which is seen more readily by increasing the number of concurrent
 	// containers to 5 or more, is that CSRSS hangs. This may fixed in the TP4 ZDP.
 	// #4898773.
 	testRequires(c, DaemonIsLinux)

 	sleepTime := "2"
 	if daemonPlatform == "windows" {
 		sleepTime = "5" // Make more reliable on Windows
 	}

 	group := sync.WaitGroup{}
 	group.Add(2)
 

 	errChan := make(chan error, 2)

 	for i := 0; i < 2; i++ {
 		go func() {
 			defer group.Done()

 			_, _, err := dockerCmdWithError("run", "busybox", "sleep", sleepTime)

 			errChan <- err

 		}()
 	}
 
 	group.Wait()

 	close(errChan)
 
 	for err := range errChan {
 		c.Assert(err, check.IsNil)
 	}

 }
 

 func (s *DockerSuite) TestRunEnvironment(c *check.C) {

 	// TODO Windows: Environment handling is different between Linux and

 	// Windows and this test relies currently on unix functionality.

 	testRequires(c, DaemonIsLinux)

 	cmd := exec.Command(dockerBinary, "run", "-h", "testing", "-e=FALSE=true", "-e=TRUE", "-e=TRICKY", "-e=HOME=", "busybox", "env")

 	cmd.Env = append(os.Environ(),
 		"TRUE=false",
 		"TRICKY=tri\ncky\n",
 	)
 
 	out, _, err := runCommandWithOutput(cmd)
 	if err != nil {

 		c.Fatal(err, out)

 	}
 

 	actualEnv := strings.Split(strings.TrimSpace(out), "\n")

 	sort.Strings(actualEnv)
 
 	goodEnv := []string{
 		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		"HOSTNAME=testing",
 		"FALSE=true",
 		"TRUE=false",
 		"TRICKY=tri",
 		"cky",
 		"",

 		"HOME=/root",

 	}
 	sort.Strings(goodEnv)
 	if len(goodEnv) != len(actualEnv) {

 		c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))

 	}
 	for i := range goodEnv {
 		if actualEnv[i] != goodEnv[i] {

 			c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])

 		}
 	}
 }
 

 func (s *DockerSuite) TestRunEnvironmentErase(c *check.C) {

 	// TODO Windows: Environment handling is different between Linux and

 	// Windows and this test relies currently on unix functionality.

 	testRequires(c, DaemonIsLinux)

 	// Test to make sure that when we use -e on env vars that are
 	// not set in our local env that they're removed (if present) in
 	// the container

 	cmd := exec.Command(dockerBinary, "run", "-e", "FOO", "-e", "HOSTNAME", "busybox", "env")

 	cmd.Env = appendBaseEnv(true)

 	out, _, err := runCommandWithOutput(cmd)
 	if err != nil {

 		c.Fatal(err, out)

 	}
 

 	actualEnv := strings.Split(strings.TrimSpace(out), "\n")

 	sort.Strings(actualEnv)
 
 	goodEnv := []string{
 		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		"HOME=/root",
 	}
 	sort.Strings(goodEnv)
 	if len(goodEnv) != len(actualEnv) {

 		c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))

 	}
 	for i := range goodEnv {
 		if actualEnv[i] != goodEnv[i] {

 			c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])

 		}
 	}
 }
 

 func (s *DockerSuite) TestRunEnvironmentOverride(c *check.C) {

 	// TODO Windows: Environment handling is different between Linux and

 	// Windows and this test relies currently on unix functionality.

 	testRequires(c, DaemonIsLinux)

 	// Test to make sure that when we use -e on env vars that are
 	// already in the env that we're overriding them

 	cmd := exec.Command(dockerBinary, "run", "-e", "HOSTNAME", "-e", "HOME=/root2", "busybox", "env")

 	cmd.Env = appendBaseEnv(true, "HOSTNAME=bar")

 	out, _, err := runCommandWithOutput(cmd)
 	if err != nil {

 		c.Fatal(err, out)

 	}
 

 	actualEnv := strings.Split(strings.TrimSpace(out), "\n")

 	sort.Strings(actualEnv)
 
 	goodEnv := []string{
 		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		"HOME=/root2",
 		"HOSTNAME=bar",
 	}
 	sort.Strings(goodEnv)
 	if len(goodEnv) != len(actualEnv) {

 		c.Fatalf("Wrong environment: should be %d variables, not: %q\n", len(goodEnv), strings.Join(actualEnv, ", "))

 	}
 	for i := range goodEnv {
 		if actualEnv[i] != goodEnv[i] {

 			c.Fatalf("Wrong environment variable: should be %s, not %s", goodEnv[i], actualEnv[i])

 		}
 	}
 }
 

 func (s *DockerSuite) TestRunContainerNetwork(c *check.C) {

 	if daemonPlatform == "windows" {
 		// Windows busybox does not have ping. Use built in ping instead.
 		dockerCmd(c, "run", WindowsBaseImage, "ping", "-n", "1", "127.0.0.1")
 	} else {
 		dockerCmd(c, "run", "busybox", "ping", "-c", "1", "127.0.0.1")
 	}

 }
 

 func (s *DockerSuite) TestRunNetHostNotAllowedWithLinks(c *check.C) {

 	// TODO Windows: This is Linux specific as --link is not supported and

 	// this will be deprecated in favor of container networking model.

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	dockerCmd(c, "run", "--name", "linked", "busybox", "true")
 

 	_, _, err := dockerCmdWithError("run", "--net=host", "--link", "linked:linked", "busybox", "true")

 	if err == nil {

 		c.Fatal("Expected error")

 	}
 }
 

 // #7851 hostname outside container shows FQDN, inside only shortname
 // For testing purposes it is not required to set host's hostname directly
 // and use "--net=host" (as the original issue submitter did), as the same
 // codepath is executed with "docker run -h <hostname>".  Both were manually
 // tested, but this testcase takes the simpler path of using "run -h .."

 func (s *DockerSuite) TestRunFullHostnameSet(c *check.C) {

 	// TODO Windows: -h is not yet functional.

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-h", "foo.bar.baz", "busybox", "hostname")

 	if actual := strings.Trim(out, "\r\n"); actual != "foo.bar.baz" {

 		c.Fatalf("expected hostname 'foo.bar.baz', received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunPrivilegedCanMknod(c *check.C) {

 	// Not applicable for Windows as Windows daemon does not support
 	// the concept of --privileged, and mknod is a Unix concept.

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunUnprivilegedCanMknod(c *check.C) {

 	// Not applicable for Windows as Windows daemon does not support
 	// the concept of --privileged, and mknod is a Unix concept.

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapDropInvalid(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-drop

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-drop=CHPASS", "busybox", "ls")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 }
 

 func (s *DockerSuite) TestRunCapDropCannotMknod(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-drop or mknod

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-drop=MKNOD", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual == "ok" {

 		c.Fatalf("expected output not ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapDropCannotMknodLowerCase(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-drop or mknod

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-drop=mknod", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual == "ok" {

 		c.Fatalf("expected output not ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapDropALLCannotMknod(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-drop or mknod

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-drop=ALL", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual == "ok" {

 		c.Fatalf("expected output not ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapDropALLAddMknodCanMknod(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-drop or mknod

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "--cap-drop=ALL", "--cap-add=MKNOD", "--cap-add=SETGID", "busybox", "sh", "-c", "mknod /tmp/sda b 8 0 && echo ok")

 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapAddInvalid(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-add

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-add=CHPASS", "busybox", "ls")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 }
 

 func (s *DockerSuite) TestRunCapAddCanDownInterface(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-add

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "--cap-add=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")

 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapAddALLCanDownInterface(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-add

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "--cap-add=ALL", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")

 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunCapAddALLDropNetAdminCanDownInterface(c *check.C) {

 	// Not applicable for Windows as there is no concept of --cap-add

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "--cap-add=ALL", "--cap-drop=NET_ADMIN", "busybox", "sh", "-c", "ip link set eth0 down && echo ok")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual == "ok" {

 		c.Fatalf("expected output not ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunGroupAdd(c *check.C) {

 	// Not applicable for Windows as there is no concept of --group-add

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "--group-add=audio", "--group-add=staff", "--group-add=777", "busybox", "sh", "-c", "id")

 	groupsList := "uid=0(root) gid=0(root) groups=10(wheel),29(audio),50(staff),777"

 	if actual := strings.Trim(out, "\r\n"); actual != groupsList {
 		c.Fatalf("expected output %s received %s", groupsList, actual)
 	}
 }
 

 func (s *DockerSuite) TestRunPrivilegedCanMount(c *check.C) {

 	// Not applicable for Windows as there is no concept of --privileged

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")

 
 	if actual := strings.Trim(out, "\r\n"); actual != "ok" {

 		c.Fatalf("expected output ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunUnprivilegedCannotMount(c *check.C) {

 	// Not applicable for Windows as there is no concept of unprivileged

 	testRequires(c, DaemonIsLinux)

 	out, _, err := dockerCmdWithError("run", "busybox", "sh", "-c", "mount -t tmpfs none /tmp && echo ok")

 	if err == nil {

 		c.Fatal(err, out)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual == "ok" {

 		c.Fatalf("expected output not ok received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunSysNotWritableInNonPrivilegedContainers(c *check.C) {

 	// Not applicable for Windows as there is no concept of unprivileged

 	testRequires(c, DaemonIsLinux, NotArm)

 	if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/sys/kernel/profiling"); err == nil || code == 0 {

 		c.Fatal("sys should not be writable in a non privileged container")

 	}
 }
 

 func (s *DockerSuite) TestRunSysWritableInPrivilegedContainers(c *check.C) {

 	// Not applicable for Windows as there is no concept of unprivileged

 	testRequires(c, DaemonIsLinux, NotUserNamespace, NotArm)

 	if _, code, err := dockerCmdWithError("run", "--privileged", "busybox", "touch", "/sys/kernel/profiling"); err != nil || code != 0 {

 		c.Fatalf("sys should be writable in privileged container")

 	}

 }
 

 func (s *DockerSuite) TestRunProcNotWritableInNonPrivilegedContainers(c *check.C) {

 	// Not applicable for Windows as there is no concept of unprivileged

 	testRequires(c, DaemonIsLinux)

 	if _, code, err := dockerCmdWithError("run", "busybox", "touch", "/proc/sysrq-trigger"); err == nil || code == 0 {

 		c.Fatal("proc should not be writable in a non privileged container")

 	}
 }
 

 func (s *DockerSuite) TestRunProcWritableInPrivilegedContainers(c *check.C) {

 	// Not applicable for Windows as there is no concept of --privileged

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	if _, code := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "touch /proc/sysrq-trigger"); code != 0 {

 		c.Fatalf("proc should be writable in privileged container")

 	}

 }
 

 func (s *DockerSuite) TestRunDeviceNumbers(c *check.C) {

 	// Not applicable on Windows as /dev/ is a Unix specific concept

 	// TODO: NotUserNamespace could be removed here if "root" "root" is replaced w user
 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "ls -l /dev/null")

 	deviceLineFields := strings.Fields(out)
 	deviceLineFields[6] = ""
 	deviceLineFields[7] = ""
 	deviceLineFields[8] = ""
 	expected := []string{"crw-rw-rw-", "1", "root", "root", "1,", "3", "", "", "", "/dev/null"}
 
 	if !(reflect.DeepEqual(deviceLineFields, expected)) {

 		c.Fatalf("expected output\ncrw-rw-rw- 1 root root 1, 3 May 24 13:29 /dev/null\n received\n %s\n", out)

 	}
 }
 

 func (s *DockerSuite) TestRunThatCharacterDevicesActLikeCharacterDevices(c *check.C) {

 	// Not applicable on Windows as /dev/ is a Unix specific concept

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "busybox", "sh", "-c", "dd if=/dev/zero of=/zero bs=1k count=5 2> /dev/null ; du -h /zero")

 	if actual := strings.Trim(out, "\r\n"); actual[0] == '0' {

 		c.Fatalf("expected a new file called /zero to be create that is greater than 0 bytes long, but du says: %s", actual)

 	}
 }

 func (s *DockerSuite) TestRunUnprivilegedWithChroot(c *check.C) {

 	// Not applicable on Windows as it does not support chroot

 	testRequires(c, DaemonIsLinux)

 	dockerCmd(c, "run", "busybox", "chroot", "/", "true")

 }

 func (s *DockerSuite) TestRunAddingOptionalDevices(c *check.C) {

 	// Not applicable on Windows as Windows does not support --device

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "--device", "/dev/zero:/dev/nulo", "busybox", "sh", "-c", "ls /dev/nulo")

 	if actual := strings.Trim(out, "\r\n"); actual != "/dev/nulo" {

 		c.Fatalf("expected output /dev/nulo, received %s", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunAddingOptionalDevicesNoSrc(c *check.C) {

 	// Not applicable on Windows as Windows does not support --device

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "--device", "/dev/zero:rw", "busybox", "sh", "-c", "ls /dev/zero")
 	if actual := strings.Trim(out, "\r\n"); actual != "/dev/zero" {
 		c.Fatalf("expected output /dev/zero, received %s", actual)
 	}
 }
 

 func (s *DockerSuite) TestRunAddingOptionalDevicesInvalidMode(c *check.C) {

 	// Not applicable on Windows as Windows does not support --device

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	_, _, err := dockerCmdWithError("run", "--device", "/dev/zero:ro", "busybox", "sh", "-c", "ls /dev/zero")
 	if err == nil {
 		c.Fatalf("run container with device mode ro should fail")
 	}
 }
 

 func (s *DockerSuite) TestRunModeHostname(c *check.C) {

 	// Not applicable on Windows as Windows does not support -h

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "-h=testhostname", "busybox", "cat", "/etc/hostname")

 
 	if actual := strings.Trim(out, "\r\n"); actual != "testhostname" {

 		c.Fatalf("expected 'testhostname', but says: %q", actual)

 	}
 

 	out, _ = dockerCmd(c, "run", "--net=host", "busybox", "cat", "/etc/hostname")

 
 	hostname, err := os.Hostname()
 	if err != nil {

 		c.Fatal(err)

 	}
 	if actual := strings.Trim(out, "\r\n"); actual != hostname {

 		c.Fatalf("expected %q, but says: %q", hostname, actual)

 	}

 }
 

 func (s *DockerSuite) TestRunRootWorkdir(c *check.C) {

 	out, _ := dockerCmd(c, "run", "--workdir", "/", "busybox", "pwd")

 	expected := "/\n"
 	if daemonPlatform == "windows" {
 		expected = "C:" + expected
 	}
 	if out != expected {
 		c.Fatalf("pwd returned %q (expected %s)", s, expected)

 	}
 }

 func (s *DockerSuite) TestRunAllowBindMountingRoot(c *check.C) {

 	if daemonPlatform == "windows" {
 		// Windows busybox will fail with Permission Denied on items such as pagefile.sys
 		dockerCmd(c, "run", "-v", `c:\:c:\host`, WindowsBaseImage, "cmd", "-c", "dir", `c:\host`)
 	} else {
 		dockerCmd(c, "run", "-v", "/:/host", "busybox", "ls", "/host")
 	}

 }

 func (s *DockerSuite) TestRunDisallowBindMountingRootToRoot(c *check.C) {

 	mount := "/:/"
 	targetDir := "/host"
 	if daemonPlatform == "windows" {
 		mount = `c:\:c\`
 		targetDir = "c:/host" // Forward slash as using busybox
 	}
 	out, _, err := dockerCmdWithError("run", "-v", mount, "busybox", "ls", targetDir)

 	if err == nil {

 		c.Fatal(out, err)

 	}
 }

 // Verify that a container gets default DNS when only localhost resolvers exist

 func (s *DockerSuite) TestRunDnsDefaultOptions(c *check.C) {

 	// Not applicable on Windows as this is testing Unix specific functionality

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 
 	// preserve original resolv.conf for restoring after test

 	origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
 	if os.IsNotExist(err) {

 		c.Fatalf("/etc/resolv.conf does not exist")

 	}

 	// defer restored original conf

 	defer func() {
 		if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {

 			c.Fatal(err)

 		}
 	}()
 

 	// test 3 cases: standard IPv4 localhost, commented out localhost, and IPv6 localhost
 	// 2 are removed from the file at container start, and the 3rd (commented out) one is ignored by
 	// GetNameservers(), leading to a replacement of nameservers with the default set
 	tmpResolvConf := []byte("nameserver 127.0.0.1\n#nameserver 127.0.2.1\nnameserver ::1")
 	if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	actual, _ := dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")

 	// check that the actual defaults are appended to the commented out
 	// localhost resolver (which should be preserved)
 	// NOTE: if we ever change the defaults from google dns, this will break

 	expected := "#nameserver 127.0.2.1\n\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"

 	if actual != expected {

 		c.Fatalf("expected resolv.conf be: %q, but was: %q", expected, actual)

 	}
 }
 

 func (s *DockerSuite) TestRunDnsOptions(c *check.C) {

 	// Not applicable on Windows as Windows does not support --dns*, or
 	// the Unix-specific functionality of resolv.conf.

 	testRequires(c, DaemonIsLinux)

 	out, stderr, _ := dockerCmdWithStdoutStderr(c, "run", "--dns=127.0.0.1", "--dns-search=mydomain", "--dns-opt=ndots:9", "busybox", "cat", "/etc/resolv.conf")

 	// The client will get a warning on stderr when setting DNS to a localhost address; verify this:
 	if !strings.Contains(stderr, "Localhost DNS setting") {

 		c.Fatalf("Expected warning on stderr about localhost resolver, but got %q", stderr)

 	}
 

 	actual := strings.Replace(strings.Trim(out, "\r\n"), "\n", " ", -1)

 	if actual != "search mydomain nameserver 127.0.0.1 options ndots:9" {
 		c.Fatalf("expected 'search mydomain nameserver 127.0.0.1 options ndots:9', but says: %q", actual)

 	}
 

 	out, stderr, _ = dockerCmdWithStdoutStderr(c, "run", "--dns=127.0.0.1", "--dns-search=.", "--dns-opt=ndots:3", "busybox", "cat", "/etc/resolv.conf")

 
 	actual = strings.Replace(strings.Trim(strings.Trim(out, "\r\n"), " "), "\n", " ", -1)

 	if actual != "nameserver 127.0.0.1 options ndots:3" {
 		c.Fatalf("expected 'nameserver 127.0.0.1 options ndots:3', but says: %q", actual)
 	}
 }
 
 func (s *DockerSuite) TestRunDnsRepeatOptions(c *check.C) {
 	testRequires(c, DaemonIsLinux)
 	out, _, _ := dockerCmdWithStdoutStderr(c, "run", "--dns=1.1.1.1", "--dns=2.2.2.2", "--dns-search=mydomain", "--dns-search=mydomain2", "--dns-opt=ndots:9", "--dns-opt=timeout:3", "busybox", "cat", "/etc/resolv.conf")
 
 	actual := strings.Replace(strings.Trim(out, "\r\n"), "\n", " ", -1)
 	if actual != "search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3" {
 		c.Fatalf("expected 'search mydomain mydomain2 nameserver 1.1.1.1 nameserver 2.2.2.2 options ndots:9 timeout:3', but says: %q", actual)

 	}
 }
 

 func (s *DockerSuite) TestRunDnsOptionsBasedOnHostResolvConf(c *check.C) {

 	// Not applicable on Windows as testing Unix specific functionality

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 
 	origResolvConf, err := ioutil.ReadFile("/etc/resolv.conf")

 	if os.IsNotExist(err) {

 		c.Fatalf("/etc/resolv.conf does not exist")

 	}
 

 	hostNamservers := resolvconf.GetNameservers(origResolvConf, netutils.IP)

 	hostSearch := resolvconf.GetSearchDomains(origResolvConf)

 	var out string

 	out, _ = dockerCmd(c, "run", "--dns=127.0.0.1", "busybox", "cat", "/etc/resolv.conf")

 	if actualNameservers := resolvconf.GetNameservers([]byte(out), netutils.IP); string(actualNameservers[0]) != "127.0.0.1" {

 		c.Fatalf("expected '127.0.0.1', but says: %q", string(actualNameservers[0]))

 	}
 
 	actualSearch := resolvconf.GetSearchDomains([]byte(out))
 	if len(actualSearch) != len(hostSearch) {

 		c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))

 	}
 	for i := range actualSearch {
 		if actualSearch[i] != hostSearch[i] {

 			c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])

 		}
 	}
 

 	out, _ = dockerCmd(c, "run", "--dns-search=mydomain", "busybox", "cat", "/etc/resolv.conf")

 	actualNameservers := resolvconf.GetNameservers([]byte(out), netutils.IP)

 	if len(actualNameservers) != len(hostNamservers) {

 		c.Fatalf("expected %q nameserver(s), but it has: %q", len(hostNamservers), len(actualNameservers))

 	}
 	for i := range actualNameservers {
 		if actualNameservers[i] != hostNamservers[i] {

 			c.Fatalf("expected %q nameserver, but says: %q", actualNameservers[i], hostNamservers[i])

 		}
 	}
 
 	if actualSearch = resolvconf.GetSearchDomains([]byte(out)); string(actualSearch[0]) != "mydomain" {

 		c.Fatalf("expected 'mydomain', but says: %q", string(actualSearch[0]))

 	}
 
 	// test with file
 	tmpResolvConf := []byte("search example.com\nnameserver 12.34.56.78\nnameserver 127.0.0.1")
 	if err := ioutil.WriteFile("/etc/resolv.conf", tmpResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 	// put the old resolvconf back
 	defer func() {
 		if err := ioutil.WriteFile("/etc/resolv.conf", origResolvConf, 0644); err != nil {

 			c.Fatal(err)

 		}
 	}()
 
 	resolvConf, err := ioutil.ReadFile("/etc/resolv.conf")
 	if os.IsNotExist(err) {

 		c.Fatalf("/etc/resolv.conf does not exist")

 	}
 

 	hostNamservers = resolvconf.GetNameservers(resolvConf, netutils.IP)

 	hostSearch = resolvconf.GetSearchDomains(resolvConf)
 

 	out, _ = dockerCmd(c, "run", "busybox", "cat", "/etc/resolv.conf")

 	if actualNameservers = resolvconf.GetNameservers([]byte(out), netutils.IP); string(actualNameservers[0]) != "12.34.56.78" || len(actualNameservers) != 1 {

 		c.Fatalf("expected '12.34.56.78', but has: %v", actualNameservers)

 	}
 
 	actualSearch = resolvconf.GetSearchDomains([]byte(out))
 	if len(actualSearch) != len(hostSearch) {

 		c.Fatalf("expected %q search domain(s), but it has: %q", len(hostSearch), len(actualSearch))

 	}
 	for i := range actualSearch {
 		if actualSearch[i] != hostSearch[i] {

 			c.Fatalf("expected %q domain, but says: %q", actualSearch[i], hostSearch[i])

 		}

 	}
 }

 // Test to see if a non-root user can resolve a DNS name. Also

 // check if the container resolv.conf file has at least 0644 perm.

 func (s *DockerSuite) TestRunNonRootUserResolvName(c *check.C) {

 	// Not applicable on Windows as Windows does not support --user

 	testRequires(c, SameHostDaemon, Network, DaemonIsLinux, NotArm)

 	dockerCmd(c, "run", "--name=testperm", "--user=nobody", "busybox", "nslookup", "apt.dockerproject.org")

 
 	cID, err := getIDByName("testperm")
 	if err != nil {
 		c.Fatal(err)
 	}
 
 	fmode := (os.FileMode)(0644)
 	finfo, err := os.Stat(containerStorageFile(cID, "resolv.conf"))
 	if err != nil {
 		c.Fatal(err)
 	}
 
 	if (finfo.Mode() & fmode) != fmode {

 		c.Fatalf("Expected container resolv.conf mode to be at least %s, instead got %s", fmode.String(), finfo.Mode().String())

 	}
 }
 

 // Test if container resolv.conf gets updated the next time it restarts
 // if host /etc/resolv.conf has changed. This only applies if the container
 // uses the host's /etc/resolv.conf and does not have any dns options provided.
 func (s *DockerSuite) TestRunResolvconfUpdate(c *check.C) {

 	// Not applicable on Windows as testing unix specific functionality

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 	tmpResolvConf := []byte("search pommesfrites.fr\nnameserver 12.34.56.78\n")

 	tmpLocalhostResolvConf := []byte("nameserver 127.0.0.1")
 
 	//take a copy of resolv.conf for restoring after test completes
 	resolvConfSystem, err := ioutil.ReadFile("/etc/resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	// This test case is meant to test monitoring resolv.conf when it is

 	// a regular file not a bind mounc. So we unmount resolv.conf and replace

 	// it with a file containing the original settings.
 	cmd := exec.Command("umount", "/etc/resolv.conf")
 	if _, err = runCommand(cmd); err != nil {

 		c.Fatal(err)

 	}
 

 	//cleanup
 	defer func() {
 		if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {

 			c.Fatal(err)

 		}
 	}()
 

 	//1. test that a restarting container gets an updated resolv.conf

 	dockerCmd(c, "run", "--name='first'", "busybox", "true")

 	containerID1, err := getIDByName("first")
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	// replace resolv.conf with our temporary copy
 	bytesResolvConf := []byte(tmpResolvConf)
 	if err := ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	// start the container again to pickup changes

 	dockerCmd(c, "start", "first")

 	// check for update in container
 	containerResolv, err := readContainerFile(containerID1, "resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Restarted container does not have updated resolv.conf; expected %q, got %q", tmpResolvConf, string(containerResolv))

 	}
 

 	/*	//make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
 		if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {

 						c.Fatal(err)
 								} */

 	//2. test that a restarting container does not receive resolv.conf updates

 	//   if it modified the container copy of the starting point resolv.conf

 	dockerCmd(c, "run", "--name='second'", "busybox", "sh", "-c", "echo 'search mylittlepony.com' >>/etc/resolv.conf")

 	containerID2, err := getIDByName("second")
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	//make a change to resolv.conf (in this case replacing our tmp copy with orig copy)
 	if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	// start the container again

 	dockerCmd(c, "start", "second")

 
 	// check for update in container
 	containerResolv, err = readContainerFile(containerID2, "resolv.conf")

 	if err != nil {

 		c.Fatal(err)

 	}
 

 	if bytes.Equal(containerResolv, resolvConfSystem) {

 		c.Fatalf("Container's resolv.conf should not have been updated with host resolv.conf: %q", string(containerResolv))

 	}
 
 	//3. test that a running container's resolv.conf is not modified while running

 	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")

 	runningContainerID := strings.TrimSpace(out)
 
 	// replace resolv.conf
 	if err := ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	// check for update in container
 	containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")

 	if err != nil {

 		c.Fatal(err)

 	}
 

 	if bytes.Equal(containerResolv, bytesResolvConf) {
 		c.Fatalf("Running container should not have updated resolv.conf; expected %q, got %q", string(resolvConfSystem), string(containerResolv))

 	}
 
 	//4. test that a running container's resolv.conf is updated upon restart
 	//   (the above container is still running..)

 	dockerCmd(c, "restart", runningContainerID)

 
 	// check for update in container
 	containerResolv, err = readContainerFile(runningContainerID, "resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Restarted container should have updated resolv.conf; expected %q, got %q", string(bytesResolvConf), string(containerResolv))

 	}
 
 	//5. test that additions of a localhost resolver are cleaned from
 	//   host resolv.conf before updating container's resolv.conf copies
 
 	// replace resolv.conf with a localhost-only nameserver copy
 	bytesResolvConf = []byte(tmpLocalhostResolvConf)
 	if err = ioutil.WriteFile("/etc/resolv.conf", bytesResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	// start the container again to pickup changes

 	dockerCmd(c, "start", "first")

 	// our first exited container ID should have been updated, but with default DNS
 	// after the cleanup of resolv.conf found only a localhost nameserver:
 	containerResolv, err = readContainerFile(containerID1, "resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	expected := "\nnameserver 8.8.8.8\nnameserver 8.8.4.4\n"

 	if !bytes.Equal(containerResolv, []byte(expected)) {

 		c.Fatalf("Container does not have cleaned/replaced DNS in resolv.conf; expected %q, got %q", expected, string(containerResolv))

 	}
 

 	//6. Test that replacing (as opposed to modifying) resolv.conf triggers an update
 	//   of containers' resolv.conf.
 
 	// Restore the original resolv.conf
 	if err := ioutil.WriteFile("/etc/resolv.conf", resolvConfSystem, 0644); err != nil {

 		c.Fatal(err)

 	}
 
 	// Run the container so it picks up the old settings

 	dockerCmd(c, "run", "--name='third'", "busybox", "true")

 	containerID3, err := getIDByName("third")
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	// Create a modified resolv.conf.aside and override resolv.conf with it
 	bytesResolvConf = []byte(tmpResolvConf)
 	if err := ioutil.WriteFile("/etc/resolv.conf.aside", bytesResolvConf, 0644); err != nil {

 		c.Fatal(err)

 	}
 
 	err = os.Rename("/etc/resolv.conf.aside", "/etc/resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	// start the container again to pickup changes

 	dockerCmd(c, "start", "third")

 	// check for update in container
 	containerResolv, err = readContainerFile(containerID3, "resolv.conf")
 	if err != nil {

 		c.Fatal(err)

 	}
 	if !bytes.Equal(containerResolv, bytesResolvConf) {

 		c.Fatalf("Stopped container does not have updated resolv.conf; expected\n%q\n got\n%q", tmpResolvConf, string(containerResolv))

 	}
 

 	//cleanup, restore original resolv.conf happens in defer func()
 }
 

 func (s *DockerSuite) TestRunAddHost(c *check.C) {

 	// Not applicable on Windows as it does not support --add-host

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "--add-host=extra:86.75.30.9", "busybox", "grep", "extra", "/etc/hosts")

 
 	actual := strings.Trim(out, "\r\n")
 	if actual != "86.75.30.9\textra" {

 		c.Fatalf("expected '86.75.30.9\textra', but says: %q", actual)

 	}
 }
 

 // Regression test for #6983

 func (s *DockerSuite) TestRunAttachStdErrOnlyTTYMode(c *check.C) {

 	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stderr", "busybox", "true")
 	if exitCode != 0 {

 		c.Fatalf("Container should have exited with error code 0")

 	}
 }
 
 // Regression test for #6983

 func (s *DockerSuite) TestRunAttachStdOutOnlyTTYMode(c *check.C) {

 	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "busybox", "true")
 	if exitCode != 0 {

 		c.Fatalf("Container should have exited with error code 0")

 	}
 }
 
 // Regression test for #6983

 func (s *DockerSuite) TestRunAttachStdOutAndErrTTYMode(c *check.C) {

 	_, exitCode := dockerCmd(c, "run", "-t", "-a", "stdout", "-a", "stderr", "busybox", "true")
 	if exitCode != 0 {

 		c.Fatalf("Container should have exited with error code 0")

 	}
 }

 // Test for #10388 - this will run the same test as TestRunAttachStdOutAndErrTTYMode
 // but using --attach instead of -a to make sure we read the flag correctly

 func (s *DockerSuite) TestRunAttachWithDetach(c *check.C) {

 	cmd := exec.Command(dockerBinary, "run", "-d", "--attach", "stdout", "busybox", "true")
 	_, stderr, _, err := runCommandWithStdoutStderr(cmd)
 	if err == nil {

 		c.Fatal("Container should have exited with error code different than 0")

 	} else if !strings.Contains(stderr, "Conflicting options: -a and -d") {

 		c.Fatal("Should have been returned an error with conflicting options -a and -d")

 	}
 }
 

 func (s *DockerSuite) TestRunState(c *check.C) {

 	// TODO Windows: This needs some rework as Windows busybox does not support top

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")

 
 	id := strings.TrimSpace(out)

 	state := inspectField(c, id, "State.Running")

 	if state != "true" {

 		c.Fatal("Container state is 'not running'")

 	}

 	pid1 := inspectField(c, id, "State.Pid")

 	if pid1 == "0" {

 		c.Fatal("Container state Pid 0")

 	}
 

 	dockerCmd(c, "stop", id)

 	state = inspectField(c, id, "State.Running")

 	if state != "false" {

 		c.Fatal("Container state is 'running'")

 	}

 	pid2 := inspectField(c, id, "State.Pid")

 	if pid2 == pid1 {

 		c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)

 	}
 

 	dockerCmd(c, "start", id)

 	state = inspectField(c, id, "State.Running")

 	if state != "true" {

 		c.Fatal("Container state is 'not running'")

 	}

 	pid3 := inspectField(c, id, "State.Pid")

 	if pid3 == pid1 {

 		c.Fatalf("Container state Pid %s, but expected %s", pid2, pid1)

 	}
 }

 
 // Test for #1737

 func (s *DockerSuite) TestRunCopyVolumeUidGid(c *check.C) {

 	// Not applicable on Windows as it does not support uid or gid in this way

 	testRequires(c, DaemonIsLinux)

 	name := "testrunvolumesuidgid"
 	_, err := buildImage(name,
 		`FROM busybox
 		RUN echo 'dockerio:x:1001:1001::/bin:/bin/false' >> /etc/passwd
 		RUN echo 'dockerio:x:1001:' >> /etc/group
 		RUN mkdir -p /hello && touch /hello/test && chown dockerio.dockerio /hello`,
 		true)
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	// Test that the uid and gid is copied from the image to the volume

 	out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "sh", "-c", "ls -l / | grep hello | awk '{print $3\":\"$4}'")

 	out = strings.TrimSpace(out)
 	if out != "dockerio:dockerio" {

 		c.Fatalf("Wrong /hello ownership: %s, expected dockerio:dockerio", out)

 	}
 }

 
 // Test for #1582

 func (s *DockerSuite) TestRunCopyVolumeContent(c *check.C) {

 	// TODO Windows, post TP4. Windows does not yet support volume functionality
 	// that copies from the image to the volume.

 	testRequires(c, DaemonIsLinux)

 	name := "testruncopyvolumecontent"
 	_, err := buildImage(name,
 		`FROM busybox
 		RUN mkdir -p /hello/local && echo hello > /hello/local/world`,
 		true)
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	// Test that the content is copied from the image to the volume

 	out, _ := dockerCmd(c, "run", "--rm", "-v", "/hello", name, "find", "/hello")

 	if !(strings.Contains(out, "/hello/local/world") && strings.Contains(out, "/hello/local")) {

 		c.Fatal("Container failed to transfer content to volume")

 	}
 }

 func (s *DockerSuite) TestRunCleanupCmdOnEntrypoint(c *check.C) {

 	name := "testrunmdcleanuponentrypoint"
 	if _, err := buildImage(name,
 		`FROM busybox
 		ENTRYPOINT ["echo"]

 		CMD ["testingpoint"]`,

 		true); err != nil {

 		c.Fatal(err)

 	}

 
 	out, exit := dockerCmd(c, "run", "--entrypoint", "whoami", name)

 	if exit != 0 {

 		c.Fatalf("expected exit code 0 received %d, out: %q", exit, out)

 	}
 	out = strings.TrimSpace(out)

 	expected := "root"
 	if daemonPlatform == "windows" {

 		// TODO Windows: Remove this check once TP4 is no longer supported.
 		if windowsDaemonKV < 14250 {
 			expected = `nt authority\system`
 		} else {
 			expected = `user manager\containeradministrator`
 		}

 	}
 	if out != expected {
 		c.Fatalf("Expected output %s, got %q", expected, out)

 	}
 }

 
 // TestRunWorkdirExistsAndIsFile checks that if 'docker run -w' with existing file can be detected

 func (s *DockerSuite) TestRunWorkdirExistsAndIsFile(c *check.C) {

 	existingFile := "/bin/cat"

 	expected := "not a directory"

 	if daemonPlatform == "windows" {
 		existingFile = `\windows\system32\ntdll.dll`

 		expected = `Cannot mkdir: \windows\system32\ntdll.dll is not a directory.`

 	}
 

 	out, exitCode, err := dockerCmdWithError("run", "-w", existingFile, "busybox")
 	if !(err != nil && exitCode == 125 && strings.Contains(out, expected)) {

 		c.Fatalf("Existing binary as a directory should error out with exitCode 125; we got: %s, exitCode: %d", out, exitCode)

 	}
 }

 func (s *DockerSuite) TestRunExitOnStdinClose(c *check.C) {

 	name := "testrunexitonstdinclose"

 
 	meow := "/bin/cat"
 	delay := 1
 	if daemonPlatform == "windows" {
 		meow = "cat"

 		delay = 60

 	}
 	runCmd := exec.Command(dockerBinary, "run", "--name", name, "-i", "busybox", meow)

 
 	stdin, err := runCmd.StdinPipe()
 	if err != nil {

 		c.Fatal(err)

 	}
 	stdout, err := runCmd.StdoutPipe()
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	if err := runCmd.Start(); err != nil {

 		c.Fatal(err)

 	}
 	if _, err := stdin.Write([]byte("hello\n")); err != nil {

 		c.Fatal(err)

 	}
 
 	r := bufio.NewReader(stdout)
 	line, err := r.ReadString('\n')
 	if err != nil {

 		c.Fatal(err)

 	}
 	line = strings.TrimSpace(line)
 	if line != "hello" {

 		c.Fatalf("Output should be 'hello', got '%q'", line)

 	}
 	if err := stdin.Close(); err != nil {

 		c.Fatal(err)

 	}

 	finish := make(chan error)

 	go func() {

 		finish <- runCmd.Wait()

 		close(finish)
 	}()
 	select {

 	case err := <-finish:
 		c.Assert(err, check.IsNil)

 	case <-time.After(time.Duration(delay) * time.Second):

 		c.Fatal("docker run failed to exit on stdin close")

 	}

 	state := inspectField(c, name, "State.Running")

 	if state != "false" {

 		c.Fatal("Container must be stopped after stdin closing")

 	}
 }

 
 // Test for #2267

 func (s *DockerSuite) TestRunWriteHostsFileAndNotCommit(c *check.C) {

 	// Cannot run on Windows as Windows does not support diff.

 	testRequires(c, DaemonIsLinux)

 	name := "writehosts"

 	out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/hosts && cat /etc/hosts")

 	if !strings.Contains(out, "test2267") {

 		c.Fatal("/etc/hosts should contain 'test2267'")

 	}
 

 	out, _ = dockerCmd(c, "diff", name)

 	if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
 		c.Fatal("diff should be empty")

 	}
 }
 

 func eqToBaseDiff(out string, c *check.C) bool {

 	name := "eqToBaseDiff" + stringutils.GenerateRandomAlphaOnlyString(32)
 	dockerCmd(c, "run", "--name", name, "busybox", "echo", "hello")
 	cID, err := getIDByName(name)
 	c.Assert(err, check.IsNil)

 
 	baseDiff, _ := dockerCmd(c, "diff", cID)

 	baseArr := strings.Split(baseDiff, "\n")
 	sort.Strings(baseArr)
 	outArr := strings.Split(out, "\n")
 	sort.Strings(outArr)
 	return sliceEq(baseArr, outArr)

 }
 
 func sliceEq(a, b []string) bool {
 	if len(a) != len(b) {
 		return false
 	}
 
 	for i := range a {
 		if a[i] != b[i] {
 			return false
 		}
 	}
 
 	return true
 }
 

 // Test for #2267

 func (s *DockerSuite) TestRunWriteHostnameFileAndNotCommit(c *check.C) {

 	// Cannot run on Windows as Windows does not support diff.

 	testRequires(c, DaemonIsLinux)

 	name := "writehostname"

 	out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/hostname && cat /etc/hostname")

 	if !strings.Contains(out, "test2267") {

 		c.Fatal("/etc/hostname should contain 'test2267'")

 	}
 

 	out, _ = dockerCmd(c, "diff", name)

 	if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
 		c.Fatal("diff should be empty")

 	}
 }
 
 // Test for #2267

 func (s *DockerSuite) TestRunWriteResolvFileAndNotCommit(c *check.C) {

 	// Cannot run on Windows as Windows does not support diff.

 	testRequires(c, DaemonIsLinux)

 	name := "writeresolv"

 	out, _ := dockerCmd(c, "run", "--name", name, "busybox", "sh", "-c", "echo test2267 >> /etc/resolv.conf && cat /etc/resolv.conf")

 	if !strings.Contains(out, "test2267") {

 		c.Fatal("/etc/resolv.conf should contain 'test2267'")

 	}
 

 	out, _ = dockerCmd(c, "diff", name)

 	if len(strings.Trim(out, "\r\n")) != 0 && !eqToBaseDiff(out, c) {
 		c.Fatal("diff should be empty")

 	}
 }

 func (s *DockerSuite) TestRunWithBadDevice(c *check.C) {

 	// Cannot run on Windows as Windows does not support --device

 	testRequires(c, DaemonIsLinux)

 	name := "baddevice"

 	out, _, err := dockerCmdWithError("run", "--name", name, "--device", "/etc", "busybox", "true")

 	if err == nil {

 		c.Fatal("Run should fail with bad device")

 	}

 	expected := `"/etc": not a device node`

 	if !strings.Contains(out, expected) {

 		c.Fatalf("Output should contain %q, actual out: %q", expected, out)

 	}
 }

 func (s *DockerSuite) TestRunEntrypoint(c *check.C) {

 	name := "entrypoint"

 	// Note Windows does not have an echo.exe built in.
 	var out, expected string
 	if daemonPlatform == "windows" {
 		out, _ = dockerCmd(c, "run", "--name", name, "--entrypoint", "cmd /s /c echo", "busybox", "foobar")
 		expected = "foobar\r\n"
 	} else {
 		out, _ = dockerCmd(c, "run", "--name", name, "--entrypoint", "/bin/echo", "busybox", "-n", "foobar")
 		expected = "foobar"
 	}
 

 	if out != expected {

 		c.Fatalf("Output should be %q, actual out: %q", expected, out)

 	}
 }
 

 func (s *DockerSuite) TestRunBindMounts(c *check.C) {

 	testRequires(c, SameHostDaemon)

 	if daemonPlatform == "linux" {

 		testRequires(c, DaemonIsLinux, NotUserNamespace)
 	}

 	tmpDir, err := ioutil.TempDir("", "docker-test-container")
 	if err != nil {

 		c.Fatal(err)

 	}
 
 	defer os.RemoveAll(tmpDir)

 	writeFile(path.Join(tmpDir, "touch-me"), "", c)

 	// TODO Windows Post TP4. Windows does not yet support :ro binds
 	if daemonPlatform != "windows" {
 		// Test reading from a read-only bind mount
 		out, _ := dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:ro", tmpDir), "busybox", "ls", "/tmp")
 		if !strings.Contains(out, "touch-me") {
 			c.Fatal("Container failed to read from bind mount")
 		}

 	}
 
 	// test writing to bind mount

 	if daemonPlatform == "windows" {
 		dockerCmd(c, "run", "-v", fmt.Sprintf(`%s:c:\tmp:rw`, tmpDir), "busybox", "touch", "c:/tmp/holla")
 	} else {
 		dockerCmd(c, "run", "-v", fmt.Sprintf("%s:/tmp:rw", tmpDir), "busybox", "touch", "/tmp/holla")
 	}

 	readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist

 
 	// test mounting to an illegal destination directory

 	_, _, err = dockerCmdWithError("run", "-v", fmt.Sprintf("%s:.", tmpDir), "busybox", "ls", ".")

 	if err == nil {

 		c.Fatal("Container bind mounted illegal directory")

 	}
 

 	// Windows does not (and likely never will) support mounting a single file
 	if daemonPlatform != "windows" {
 		// test mount a file
 		dockerCmd(c, "run", "-v", fmt.Sprintf("%s/holla:/tmp/holla:rw", tmpDir), "busybox", "sh", "-c", "echo -n 'yotta' > /tmp/holla")
 		content := readFile(path.Join(tmpDir, "holla"), c) // Will fail if the file doesn't exist
 		expected := "yotta"
 		if content != expected {
 			c.Fatalf("Output should be %q, actual out: %q", expected, content)
 		}

 	}
 }

 // Ensure that CIDFile gets deleted if it's empty
 // Perform this test by making `docker run` fail

 func (s *DockerSuite) TestRunCidFileCleanupIfEmpty(c *check.C) {

 	tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
 	if err != nil {

 		c.Fatal(err)

 	}
 	defer os.RemoveAll(tmpDir)
 	tmpCidFile := path.Join(tmpDir, "cid")

 	image := "emptyfs"
 	if daemonPlatform == "windows" {
 		// Windows can't support an emptyfs image. Just use the regular Windows image
 		image = WindowsBaseImage
 	}
 	out, _, err := dockerCmdWithError("run", "--cidfile", tmpCidFile, image)

 	if err == nil {

 		c.Fatalf("Run without command must fail. out=%s", out)

 	} else if !strings.Contains(out, "No command specified") {

 		c.Fatalf("Run without command failed with wrong output. out=%s\nerr=%v", out, err)

 	}
 
 	if _, err := os.Stat(tmpCidFile); err == nil {

 		c.Fatalf("empty CIDFile %q should've been deleted", tmpCidFile)

 	}
 }

 
 // #2098 - Docker cidFiles only contain short version of the containerId

 //sudo docker run --cidfile /tmp/docker_tesc.cid ubuntu echo "test"

 // TestRunCidFile tests that run --cidfile returns the longid

 func (s *DockerSuite) TestRunCidFileCheckIDLength(c *check.C) {

 	tmpDir, err := ioutil.TempDir("", "TestRunCidFile")
 	if err != nil {

 		c.Fatal(err)

 	}
 	tmpCidFile := path.Join(tmpDir, "cid")
 	defer os.RemoveAll(tmpDir)

 
 	out, _ := dockerCmd(c, "run", "-d", "--cidfile", tmpCidFile, "busybox", "true")
 

 	id := strings.TrimSpace(out)
 	buffer, err := ioutil.ReadFile(tmpCidFile)
 	if err != nil {

 		c.Fatal(err)

 	}
 	cid := string(buffer)
 	if len(cid) != 64 {

 		c.Fatalf("--cidfile should be a long id, not %q", id)

 	}
 	if cid != id {

 		c.Fatalf("cid must be equal to %s, got %s", id, cid)

 	}
 }

 func (s *DockerSuite) TestRunSetMacAddress(c *check.C) {

 	mac := "12:34:56:78:9a:bc"

 	var out string
 	if daemonPlatform == "windows" {
 		out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "sh", "-c", "ipconfig /all | grep 'Physical Address' | awk '{print $12}'")

 		mac = strings.Replace(strings.ToUpper(mac), ":", "-", -1) // To Windows-style MACs

 	} else {
 		out, _ = dockerCmd(c, "run", "-i", "--rm", fmt.Sprintf("--mac-address=%s", mac), "busybox", "/bin/sh", "-c", "ip link show eth0 | tail -1 | awk '{print $2}'")
 	}

 	actualMac := strings.TrimSpace(out)
 	if actualMac != mac {

 		c.Fatalf("Set MAC address with --mac-address failed. The container has an incorrect MAC address: %q, expected: %q", actualMac, mac)

 	}
 }
 

 func (s *DockerSuite) TestRunInspectMacAddress(c *check.C) {

 	// TODO Windows. Network settings are not propagated back to inspect.

 	testRequires(c, DaemonIsLinux)

 	mac := "12:34:56:78:9a:bc"

 	out, _ := dockerCmd(c, "run", "-d", "--mac-address="+mac, "busybox", "top")
 

 	id := strings.TrimSpace(out)

 	inspectedMac := inspectField(c, id, "NetworkSettings.Networks.bridge.MacAddress")

 	if inspectedMac != mac {

 		c.Fatalf("docker inspect outputs wrong MAC address: %q, should be: %q", inspectedMac, mac)

 	}
 }
 

 // test docker run use an invalid mac address

 func (s *DockerSuite) TestRunWithInvalidMacAddress(c *check.C) {

 	out, _, err := dockerCmdWithError("run", "--mac-address", "92:d0:c6:0a:29", "busybox")

 	//use an invalid mac address should with an error out

 	if err == nil || !strings.Contains(out, "is not a valid mac address") {

 		c.Fatalf("run with an invalid --mac-address should with error out")

 	}
 }
 

 func (s *DockerSuite) TestRunDeallocatePortOnMissingIptablesRule(c *check.C) {

 	// TODO Windows. Network settings are not propagated back to inspect.

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top")
 

 	id := strings.TrimSpace(out)

 	ip := inspectField(c, id, "NetworkSettings.Networks.bridge.IPAddress")

 	iptCmd := exec.Command("iptables", "-D", "DOCKER", "-d", fmt.Sprintf("%s/32", ip),

 		"!", "-i", "docker0", "-o", "docker0", "-p", "tcp", "-m", "tcp", "--dport", "23", "-j", "ACCEPT")

 	out, _, err := runCommandWithOutput(iptCmd)

 	if err != nil {

 		c.Fatal(err, out)

 	}
 	if err := deleteContainer(id); err != nil {

 		c.Fatal(err)

 	}

 
 	dockerCmd(c, "run", "-d", "-p", "23:23", "busybox", "top")

 }

 func (s *DockerSuite) TestRunPortInUse(c *check.C) {

 	// TODO Windows. The duplicate NAT message returned by Windows will be
 	// changing as is currently completely undecipherable. Does need modifying
 	// to run sh rather than top though as top isn't in Windows busybox.

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 	port := "1234"

 	dockerCmd(c, "run", "-d", "-p", port+":80", "busybox", "top")

 	out, _, err := dockerCmdWithError("run", "-d", "-p", port+":80", "busybox", "top")

 	if err == nil {
 		c.Fatalf("Binding on used port must fail")

 	}

 	if !strings.Contains(out, "port is already allocated") {
 		c.Fatalf("Out must be about \"port is already allocated\", got %s", out)

 	}
 }
 

 // https://github.com/docker/docker/issues/12148
 func (s *DockerSuite) TestRunAllocatePortInReservedRange(c *check.C) {

 	// TODO Windows. -P is not yet supported

 	testRequires(c, DaemonIsLinux)

 	// allocate a dynamic port to get the most recent

 	out, _ := dockerCmd(c, "run", "-d", "-P", "-p", "80", "busybox", "top")
 

 	id := strings.TrimSpace(out)

 	out, _ = dockerCmd(c, "port", id, "80")

 
 	strPort := strings.Split(strings.TrimSpace(out), ":")[1]
 	port, err := strconv.ParseInt(strPort, 10, 64)
 	if err != nil {
 		c.Fatalf("invalid port, got: %s, error: %s", strPort, err)
 	}
 
 	// allocate a static port and a dynamic port together, with static port
 	// takes the next recent port in dynamic port range.

 	dockerCmd(c, "run", "-d", "-P", "-p", "80", "-p", fmt.Sprintf("%d:8080", port+1), "busybox", "top")

 }
 

 // Regression test for #7792

 func (s *DockerSuite) TestRunMountOrdering(c *check.C) {

 	// TODO Windows: Post TP4. Updated, but Windows does not support nested mounts currently.
 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()

 	tmpDir, err := ioutil.TempDir("", "docker_nested_mount_test")
 	if err != nil {

 		c.Fatal(err)

 	}
 	defer os.RemoveAll(tmpDir)
 
 	tmpDir2, err := ioutil.TempDir("", "docker_nested_mount_test2")
 	if err != nil {

 		c.Fatal(err)

 	}
 	defer os.RemoveAll(tmpDir2)
 

 	// Create a temporary tmpfs mounc.

 	fooDir := filepath.Join(tmpDir, "foo")
 	if err := os.MkdirAll(filepath.Join(tmpDir, "foo"), 0755); err != nil {

 		c.Fatalf("failed to mkdir at %s - %s", fooDir, err)

 	}
 
 	if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", fooDir), []byte{}, 0644); err != nil {

 		c.Fatal(err)

 	}
 
 	if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir), []byte{}, 0644); err != nil {

 		c.Fatal(err)

 	}
 
 	if err := ioutil.WriteFile(fmt.Sprintf("%s/touch-me", tmpDir2), []byte{}, 0644); err != nil {

 		c.Fatal(err)

 	}
 

 	dockerCmd(c, "run",

 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp", tmpDir),
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp/foo", fooDir),
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2", tmpDir2),
 		"-v", fmt.Sprintf("%s:"+prefix+"/tmp/tmp2/foo", fooDir),

 		"busybox:latest", "sh", "-c",

 		"ls "+prefix+"/tmp/touch-me && ls "+prefix+"/tmp/foo/touch-me && ls "+prefix+"/tmp/tmp2/touch-me && ls "+prefix+"/tmp/tmp2/foo/touch-me")

 }

 // Regression test for https://github.com/docker/docker/issues/8259

 func (s *DockerSuite) TestRunReuseBindVolumeThatIsSymlink(c *check.C) {

 	// Not applicable on Windows as Windows does not support volumes

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	prefix, _ := getPrefixAndSlashFromDaemonPlatform()

 	tmpDir, err := ioutil.TempDir(os.TempDir(), "testlink")
 	if err != nil {

 		c.Fatal(err)

 	}
 	defer os.RemoveAll(tmpDir)
 
 	linkPath := os.TempDir() + "/testlink2"
 	if err := os.Symlink(tmpDir, linkPath); err != nil {

 		c.Fatal(err)

 	}
 	defer os.RemoveAll(linkPath)
 
 	// Create first container

 	dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")

 
 	// Create second container with same symlinked path
 	// This will fail if the referenced issue is hit with a "Volume exists" error

 	dockerCmd(c, "run", "-v", fmt.Sprintf("%s:"+prefix+"/tmp/test", linkPath), "busybox", "ls", prefix+"/tmp/test")

 }

 //GH#10604: Test an "/etc" volume doesn't overlay special bind mounts in container

 func (s *DockerSuite) TestRunCreateVolumeEtc(c *check.C) {

 	// While Windows supports volumes, it does not support --add-host hence
 	// this test is not applicable on Windows.

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "--dns=127.0.0.1", "-v", "/etc", "busybox", "cat", "/etc/resolv.conf")

 	if !strings.Contains(out, "nameserver 127.0.0.1") {

 		c.Fatal("/etc volume mount hides /etc/resolv.conf")

 	}
 

 	out, _ = dockerCmd(c, "run", "-h=test123", "-v", "/etc", "busybox", "cat", "/etc/hostname")

 	if !strings.Contains(out, "test123") {

 		c.Fatal("/etc volume mount hides /etc/hostname")

 	}
 

 	out, _ = dockerCmd(c, "run", "--add-host=test:192.168.0.1", "-v", "/etc", "busybox", "cat", "/etc/hosts")

 	out = strings.Replace(out, "\n", " ", -1)

 	if !strings.Contains(out, "192.168.0.1\ttest") || !strings.Contains(out, "127.0.0.1\tlocalhost") {

 		c.Fatal("/etc volume mount hides /etc/hosts")

 	}
 }
 

 func (s *DockerSuite) TestVolumesNoCopyData(c *check.C) {

 	// TODO Windows (Post TP4). Windows does not support volumes which
 	// are pre-populated such as is built in the dockerfile used in this test.

 	testRequires(c, DaemonIsLinux)

 	if _, err := buildImage("dataimage",
 		`FROM busybox

 		RUN mkdir -p /foo
 		RUN touch /foo/bar`,

 		true); err != nil {

 		c.Fatal(err)

 	}
 

 	dockerCmd(c, "run", "--name", "test", "-v", "/foo", "busybox")

 	if out, _, err := dockerCmdWithError("run", "--volumes-from", "test", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {

 		c.Fatalf("Data was copied on volumes-from but shouldn't be:\n%q", out)

 	}
 

 	tmpDir := randomTmpDirPath("docker_test_bind_mount_copy_data", daemonPlatform)

 	if out, _, err := dockerCmdWithError("run", "-v", tmpDir+":/foo", "dataimage", "ls", "-lh", "/foo/bar"); err == nil || !strings.Contains(out, "No such file or directory") {

 		c.Fatalf("Data was copied on bind-mount but shouldn't be:\n%q", out)

 	}
 }

 func (s *DockerSuite) TestRunNoOutputFromPullInStdout(c *check.C) {

 	// just run with unknown image
 	cmd := exec.Command(dockerBinary, "run", "asdfsg")
 	stdout := bytes.NewBuffer(nil)
 	cmd.Stdout = stdout
 	if err := cmd.Run(); err == nil {

 		c.Fatal("Run with unknown image should fail")

 	}
 	if stdout.Len() != 0 {

 		c.Fatalf("Stdout contains output from pull: %s", stdout)

 	}
 }

 func (s *DockerSuite) TestRunVolumesCleanPaths(c *check.C) {

 	testRequires(c, SameHostDaemon)

 	prefix, slash := getPrefixAndSlashFromDaemonPlatform()

 	if _, err := buildImage("run_volumes_clean_paths",
 		`FROM busybox

 		VOLUME `+prefix+`/foo/`,

 		true); err != nil {

 		c.Fatal(err)

 	}
 

 	dockerCmd(c, "run", "-v", prefix+"/foo", "-v", prefix+"/bar/", "--name", "dark_helmet", "run_volumes_clean_paths")

 	out, err := inspectMountSourceField("dark_helmet", prefix+slash+"foo"+slash)

 	if err != errMountNotFound {

 		c.Fatalf("Found unexpected volume entry for '%s/foo/' in volumes\n%q", prefix, out)

 	}
 

 	out, err = inspectMountSourceField("dark_helmet", prefix+slash+`foo`)

 	c.Assert(err, check.IsNil)

 	if !strings.Contains(strings.ToLower(out), strings.ToLower(volumesConfigPath)) {
 		c.Fatalf("Volume was not defined for %s/foo\n%q", prefix, out)

 	}
 

 	out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar"+slash)

 	if err != errMountNotFound {

 		c.Fatalf("Found unexpected volume entry for '%s/bar/' in volumes\n%q", prefix, out)

 	}

 	out, err = inspectMountSourceField("dark_helmet", prefix+slash+"bar")

 	c.Assert(err, check.IsNil)

 	if !strings.Contains(strings.ToLower(out), strings.ToLower(volumesConfigPath)) {
 		c.Fatalf("Volume was not defined for %s/bar\n%q", prefix, out)

 	}
 }

 
 // Regression test for #3631

 func (s *DockerSuite) TestRunSlowStdoutConsumer(c *check.C) {

 	// TODO Windows: This should be able to run on Windows if can find an
 	// alternate to /dev/zero and /dev/stdout.

 	testRequires(c, DaemonIsLinux)

 	cont := exec.Command(dockerBinary, "run", "--rm", "busybox", "/bin/sh", "-c", "dd if=/dev/zero of=/dev/stdout bs=1024 count=2000 | catv")

 	stdout, err := cont.StdoutPipe()

 	if err != nil {

 		c.Fatal(err)

 	}
 

 	if err := cont.Start(); err != nil {
 		c.Fatal(err)

 	}

 	n, err := consumeWithSpeed(stdout, 10000, 5*time.Millisecond, nil)

 	if err != nil {

 		c.Fatal(err)

 	}
 
 	expected := 2 * 1024 * 2000
 	if n != expected {

 		c.Fatalf("Expected %d, got %d", expected, n)

 	}
 }

 func (s *DockerSuite) TestRunAllowPortRangeThroughExpose(c *check.C) {

 	// TODO Windows: -P is not currently supported. Also network
 	// settings are not propagated back.

 	testRequires(c, DaemonIsLinux)

 	out, _ := dockerCmd(c, "run", "-d", "--expose", "3000-3003", "-P", "busybox", "top")
 

 	id := strings.TrimSpace(out)

 	portstr := inspectFieldJSON(c, id, "NetworkSettings.Ports")

 	var ports nat.PortMap

 	if err := unmarshalJSON([]byte(portstr), &ports); err != nil {

 		c.Fatal(err)

 	}

 	for port, binding := range ports {
 		portnum, _ := strconv.Atoi(strings.Split(string(port), "/")[0])
 		if portnum < 3000 || portnum > 3003 {

 			c.Fatalf("Port %d is out of range ", portnum)

 		}
 		if binding == nil || len(binding) != 1 || len(binding[0].HostPort) == 0 {

 			c.Fatalf("Port is not mapped for the port %s", port)

 		}
 	}
 }

 func (s *DockerSuite) TestRunExposePort(c *check.C) {

 	out, _, err := dockerCmdWithError("run", "--expose", "80000", "busybox")

 	c.Assert(err, checker.NotNil, check.Commentf("--expose with an invalid port should error out"))
 	c.Assert(out, checker.Contains, "invalid range format for --expose")

 }
 

 func (s *DockerSuite) TestRunUnknownCommand(c *check.C) {

 	out, _, _ := dockerCmdWithStdoutStderr(c, "create", "busybox", "/bin/nada")

 	cID := strings.TrimSpace(out)

 	_, _, err := dockerCmdWithError("start", cID)

 
 	// Windows and Linux are different here by architectural design. Linux will
 	// fail to start the container, so an error is expected. Windows will
 	// successfully start the container, and once started attempt to execute
 	// the command which will fail.
 	if daemonPlatform == "windows" {
 		// Wait for it to exit.

 		waitExited(cID, 30*time.Second)

 		c.Assert(err, check.IsNil)
 	} else {
 		c.Assert(err, check.NotNil)
 	}

 	rc := inspectField(c, cID, "State.ExitCode")

 	if rc == "0" {

 		c.Fatalf("ExitCode(%v) cannot be 0", rc)

 	}
 }

 func (s *DockerSuite) TestRunModeIpcHost(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	hostIpc, err := os.Readlink("/proc/1/ns/ipc")
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	out, _ := dockerCmd(c, "run", "--ipc=host", "busybox", "readlink", "/proc/self/ns/ipc")
 	out = strings.Trim(out, "\n")
 	if hostIpc != out {
 		c.Fatalf("IPC different with --ipc=host %s != %s\n", hostIpc, out)

 	}
 

 	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/ipc")
 	out = strings.Trim(out, "\n")
 	if hostIpc == out {
 		c.Fatalf("IPC should be different without --ipc=host %s == %s\n", hostIpc, out)

 	}
 }
 

 func (s *DockerSuite) TestRunModeIpcContainer(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "-d", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")

 	id := strings.TrimSpace(out)

 	state := inspectField(c, id, "State.Running")

 	if state != "true" {

 		c.Fatal("Container state is 'not running'")

 	}

 	pid1 := inspectField(c, id, "State.Pid")

 
 	parentContainerIpc, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/ipc", pid1))
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	out, _ = dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "readlink", "/proc/self/ns/ipc")
 	out = strings.Trim(out, "\n")
 	if parentContainerIpc != out {
 		c.Fatalf("IPC different with --ipc=container:%s %s != %s\n", id, parentContainerIpc, out)

 	}

 
 	catOutput, _ := dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "cat", "/dev/shm/test")
 	if catOutput != "test" {
 		c.Fatalf("Output of /dev/shm/test expected test but found: %s", catOutput)
 	}

 
 	// check that /dev/mqueue is actually of mqueue type
 	grepOutput, _ := dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "grep", "/dev/mqueue", "/proc/mounts")
 	if !strings.HasPrefix(grepOutput, "mqueue /dev/mqueue mqueue rw") {
 		c.Fatalf("Output of 'grep /proc/mounts' expected 'mqueue /dev/mqueue mqueue rw' but found: %s", grepOutput)
 	}
 
 	lsOutput, _ := dockerCmd(c, "run", fmt.Sprintf("--ipc=container:%s", id), "busybox", "ls", "/dev/mqueue")
 	lsOutput = strings.Trim(lsOutput, "\n")
 	if lsOutput != "toto" {
 		c.Fatalf("Output of 'ls /dev/mqueue' expected 'toto' but found: %s", lsOutput)
 	}

 }

 func (s *DockerSuite) TestRunModeIpcContainerNotExists(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, DaemonIsLinux, NotUserNamespace)

 	out, _, err := dockerCmdWithError("run", "-d", "--ipc", "container:abcd1234", "busybox", "top")

 	if !strings.Contains(out, "abcd1234") || err == nil {

 		c.Fatalf("run IPC from a non exists container should with correct error out")

 	}
 }
 

 func (s *DockerSuite) TestRunModeIpcContainerNotRunning(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "create", "busybox")

 	id := strings.TrimSpace(out)

 	out, _, err := dockerCmdWithError("run", fmt.Sprintf("--ipc=container:%s", id), "busybox")

 	if err == nil {
 		c.Fatalf("Run container with ipc mode container should fail with non running container: %s\n%s", out, err)
 	}
 }
 

 func (s *DockerSuite) TestRunMountShmMqueueFromHost(c *check.C) {
 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	dockerCmd(c, "run", "-d", "--name", "shmfromhost", "-v", "/dev/shm:/dev/shm", "-v", "/dev/mqueue:/dev/mqueue", "busybox", "sh", "-c", "echo -n test > /dev/shm/test && touch /dev/mqueue/toto && top")
 	defer os.Remove("/dev/mqueue/toto")
 	defer os.Remove("/dev/shm/test")

 	volPath, err := inspectMountSourceField("shmfromhost", "/dev/shm")

 	c.Assert(err, checker.IsNil)

 	if volPath != "/dev/shm" {
 		c.Fatalf("volumePath should have been /dev/shm, was %s", volPath)
 	}
 
 	out, _ := dockerCmd(c, "run", "--name", "ipchost", "--ipc", "host", "busybox", "cat", "/dev/shm/test")
 	if out != "test" {
 		c.Fatalf("Output of /dev/shm/test expected test but found: %s", out)
 	}

 
 	// Check that the mq was created
 	if _, err := os.Stat("/dev/mqueue/toto"); err != nil {
 		c.Fatalf("Failed to confirm '/dev/mqueue/toto' presence on host: %s", err.Error())
 	}

 }
 

 func (s *DockerSuite) TestContainerNetworkMode(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	out, _ := dockerCmd(c, "run", "-d", "busybox", "top")

 	id := strings.TrimSpace(out)

 	c.Assert(waitRun(id), check.IsNil)

 	pid1 := inspectField(c, id, "State.Pid")

 
 	parentContainerNet, err := os.Readlink(fmt.Sprintf("/proc/%s/ns/net", pid1))
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	out, _ = dockerCmd(c, "run", fmt.Sprintf("--net=container:%s", id), "busybox", "readlink", "/proc/self/ns/net")
 	out = strings.Trim(out, "\n")
 	if parentContainerNet != out {
 		c.Fatalf("NET different with --net=container:%s %s != %s\n", id, parentContainerNet, out)

 	}
 }

 func (s *DockerSuite) TestRunModePidHost(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux, NotUserNamespace)

 	hostPid, err := os.Readlink("/proc/1/ns/pid")
 	if err != nil {

 		c.Fatal(err)

 	}
 

 	out, _ := dockerCmd(c, "run", "--pid=host", "busybox", "readlink", "/proc/self/ns/pid")
 	out = strings.Trim(out, "\n")
 	if hostPid != out {
 		c.Fatalf("PID different with --pid=host %s != %s\n", hostPid, out)

 	}
 

 	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/pid")
 	out = strings.Trim(out, "\n")
 	if hostPid == out {
 		c.Fatalf("PID should be different without --pid=host %s == %s\n", hostPid, out)

 	}
 }
 

 func (s *DockerSuite) TestRunModeUTSHost(c *check.C) {

 	// Not applicable on Windows as uses Unix-specific capabilities

 	testRequires(c, SameHostDaemon, DaemonIsLinux)

 
 	hostUTS, err := os.Readlink("/proc/1/ns/uts")
 	if err != nil {
 		c.Fatal(err)
 	}
 

 	out, _ := dockerCmd(c, "run", "--uts=host", "busybox", "readlink", "/proc/self/ns/uts")
 	out = strings.Trim(out, "\n")
 	if hostUTS != out {
 		c.Fatalf("UTS different with --uts=host %s != %s\n", hostUTS, out)

 	}
 

 	out, _ = dockerCmd(c, "run", "busybox", "readlink", "/proc/self/ns/uts")
 	out = strings.Trim(out, "\n")
 	if hostUTS == out {
 		c.Fatalf("UTS should be different without --uts=host %s == %s\n", hostUTS, out)

 	}

 
 	out, _ = dockerCmdWithFail(c, "run", "-h=name", "--uts=host", "busybox", "ps")
 	c.Assert(out, checker.Contains, runconfig.ErrConflictUTSHostname.Error())

 }
 

 func (s *DockerSuite) TestRunTLSverify(c *check.C) {

 	// Remote daemons use TLS and this test is not applicable when TLS is required.
 	testRequires(c, SameHostDaemon)

 	if out, code, err := dockerCmdWithError("ps"); err != nil || code != 0 {

 		c.Fatalf("Should have worked: %v:\n%v", err, out)

 	}
 
 	// Regardless of whether we specify true or false we need to
 	// test to make sure tls is turned on if --tlsverify is specified at all

 	out, code, err := dockerCmdWithError("--tlsverify=false", "ps")

 	if err == nil || code == 0 || !strings.Contains(out, "trying to connect") {
 		c.Fatalf("Should have failed: \net:%v\nout:%v\nerr:%v", code, out, err)

 	}
 

 	out, code, err = dockerCmdWithError("--tlsverify=true", "ps")

 	if err == nil || code == 0 || !strings.Contains(out, "cert") {
 		c.Fatalf("Should have failed: \net:%v\nout:%v\nerr:%v", code, out, err)

 	}
 }

 func (s *DockerSuite) TestRunPortFromDockerRangeInUse(c *check.C) {

 	// TODO Windows. Once moved to libnetwork/CNM, this may be able to be
 	// re-instated.

 	testRequires(c, DaemonIsLinux)

 	// first find allocator current position

 	out, _ := dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
 

 	id := strings.TrimSpace(out)

 	out, _ = dockerCmd(c, "port", id)

 	out = strings.TrimSpace(out)

 	if out == "" {

 		c.Fatal("docker port command output is empty")

 	}

 	out = strings.Split(out, ":")[1]
 	lastPort, err := strconv.Atoi(out)
 	if err != nil {

 		c.Fatal(err)

 	}
 	port := lastPort + 1
 	l, err := net.Listen("tcp", ":"+strconv.Itoa(port))
 	if err != nil {

 		c.Fatal(err)

 	}
 	defer l.Close()

 
 	out, _ = dockerCmd(c, "run", "-d", "-p", ":80", "busybox", "top")
 

 	id = strings.TrimSpace(out)

 	dockerCmd(c, "port", id)

 }

 func (s *DockerSuite) TestRunTTYWithPipe(c *check.C) {

 	errChan := make(chan error)

 	go func() {

 		defer close(errChan)

 
 		cmd := exec.Command(dockerBinary, "run", "-ti", "busybox", "true")
 		if _, err := cmd.StdinPipe(); err != nil {

 			errChan <- err
 			return

 		}
 
 		expected := "cannot enable tty mode"
 		if out, _, err := runCommandWithOutput(cmd); err == nil {

 			errChan <- fmt.Errorf("run should have failed")
 			return

 		} else if !strings.Contains(out, expected) {

 			errChan <- fmt.Errorf("run failed with error %q: expected %q", out, expected)
 			return

 		}
 	}()
 
 	select {

 	case err := <-errChan:
 		c.Assert(err, check.IsNil)

 	case <-time.After(6 * time.Second):

 		c.Fatal("container is running but should have failed")