@@ -38,6 +38,26 @@ describe("buildSandboxCreateArgs", () => {
3838).toThrow(expectedMessage);
3939}
404041+function valuesForFlag(args: string[], flag: string): string[] {
42+const values: string[] = [];
43+for (let i = 0; i < args.length; i += 1) {
44+if (args[i] === flag) {
45+const value = args[i + 1];
46+if (value) {
47+values.push(value);
48+}
49+}
50+}
51+return values;
52+}
53+54+function expectFlagValues(args: string[], flag: string, expectedValues: string[]): void {
55+const values = valuesForFlag(args, flag);
56+for (const value of expectedValues) {
57+expect(values).toContain(value);
58+}
59+}
60+4161it("includes hardening and resource flags", () => {
4262const cfg: SandboxDockerConfig = {
4363image: "openclaw-sandbox:bookworm-slim",
@@ -72,69 +92,32 @@ describe("buildSandboxCreateArgs", () => {
7292labels: { "openclaw.sandboxBrowser": "1" },
7393});
749475-expect(args).toEqual(
76-expect.arrayContaining([
77-"create",
78-"--name",
79-"openclaw-sbx-test",
80-"--label",
81-"openclaw.sandbox=1",
82-"--label",
83-"openclaw.sessionKey=main",
84-"--label",
85-"openclaw.createdAtMs=1700000000000",
86-"--label",
87-"openclaw.sandboxBrowser=1",
88-"--read-only",
89-"--tmpfs",
90-"/tmp",
91-"--network",
92-"none",
93-"--user",
94-"1000:1000",
95-"--cap-drop",
96-"ALL",
97-"--security-opt",
98-"no-new-privileges",
99-"--security-opt",
100-"seccomp=/tmp/seccomp.json",
101-"--security-opt",
102-"apparmor=openclaw-sandbox",
103-"--dns",
104-"1.1.1.1",
105-"--add-host",
106-"internal.service:10.0.0.5",
107-"--pids-limit",
108-"256",
109-"--memory",
110-"512m",
111-"--memory-swap",
112-"1024",
113-"--cpus",
114-"1.5",
115-]),
116-);
117-expect(args).toEqual(
118-expect.arrayContaining([
119-"--env",
120-"LANG=C.UTF-8",
121-"--env",
122-`OPENCLAW_CLI=${OPENCLAW_CLI_ENV_VALUE}`,
123-]),
124-);
125-126-const ulimitValues: string[] = [];
127-for (let i = 0; i < args.length; i += 1) {
128-if (args[i] === "--ulimit") {
129-const value = args[i + 1];
130-if (value) {
131-ulimitValues.push(value);
132-}
133-}
134-}
135-expect(ulimitValues).toEqual(
136-expect.arrayContaining(["nofile=1024:2048", "nproc=128", "core=0"]),
137-);
95+expect(args[0]).toBe("create");
96+expectFlagValues(args, "--name", ["openclaw-sbx-test"]);
97+expectFlagValues(args, "--label", [
98+"openclaw.sandbox=1",
99+"openclaw.sessionKey=main",
100+"openclaw.createdAtMs=1700000000000",
101+"openclaw.sandboxBrowser=1",
102+]);
103+expect(args).toContain("--read-only");
104+expectFlagValues(args, "--tmpfs", ["/tmp"]);
105+expectFlagValues(args, "--network", ["none"]);
106+expectFlagValues(args, "--user", ["1000:1000"]);
107+expectFlagValues(args, "--cap-drop", ["ALL"]);
108+expectFlagValues(args, "--security-opt", [
109+"no-new-privileges",
110+"seccomp=/tmp/seccomp.json",
111+"apparmor=openclaw-sandbox",
112+]);
113+expectFlagValues(args, "--dns", ["1.1.1.1"]);
114+expectFlagValues(args, "--add-host", ["internal.service:10.0.0.5"]);
115+expectFlagValues(args, "--pids-limit", ["256"]);
116+expectFlagValues(args, "--memory", ["512m"]);
117+expectFlagValues(args, "--memory-swap", ["1024"]);
118+expectFlagValues(args, "--cpus", ["1.5"]);
119+expectFlagValues(args, "--env", ["LANG=C.UTF-8", `OPENCLAW_CLI=${OPENCLAW_CLI_ENV_VALUE}`]);
120+expectFlagValues(args, "--ulimit", ["nofile=1024:2048", "nproc=128", "core=0"]);
138121});
139122140123it("preserves the OpenClaw exec marker when strict env sanitization is enabled", () => {
@@ -154,14 +137,7 @@ describe("buildSandboxCreateArgs", () => {
154137},
155138});
156139157-expect(args).toEqual(
158-expect.arrayContaining([
159-"--env",
160-"NODE_ENV=test",
161-"--env",
162-`OPENCLAW_CLI=${OPENCLAW_CLI_ENV_VALUE}`,
163-]),
164-);
140+expectFlagValues(args, "--env", ["NODE_ENV=test", `OPENCLAW_CLI=${OPENCLAW_CLI_ENV_VALUE}`]);
165141});
166142167143it("emits Docker GPU passthrough as a separate argument", () => {
@@ -176,7 +152,7 @@ describe("buildSandboxCreateArgs", () => {
176152createdAtMs: 1700000000000,
177153});
178154179-expect(args).toEqual(expect.arrayContaining(["--gpus", "device=GPU-123"]));
155+expectFlagValues(args, "--gpus", ["device=GPU-123"]);
180156});
181157182158it("emits -v flags for safe custom binds", () => {
@@ -308,7 +284,7 @@ describe("buildSandboxCreateArgs", () => {
308284bindSourceRoots: ["/tmp/workspace", "/tmp/agent"],
309285allowSourcesOutsideAllowedRoots: true,
310286});
311-expect(args).toEqual(expect.arrayContaining(["-v", "/opt/external:/data:rw"]));
287+expectFlagValues(args, "-v", ["/opt/external:/data:rw"]);
312288});
313289314290it("blocks reserved /workspace target bind mounts by default", () => {
@@ -325,7 +301,7 @@ describe("buildSandboxCreateArgs", () => {
325301createdAtMs: 1700000000000,
326302allowReservedContainerTargets: true,
327303});
328-expect(args).toEqual(expect.arrayContaining(["-v", "/tmp/override:/workspace:rw"]));
304+expectFlagValues(args, "-v", ["/tmp/override:/workspace:rw"]);
329305});
330306331307it("allows container namespace join with explicit dangerous override", () => {
@@ -339,6 +315,6 @@ describe("buildSandboxCreateArgs", () => {
339315scopeKey: "main",
340316createdAtMs: 1700000000000,
341317});
342-expect(args).toEqual(expect.arrayContaining(["--network", "container:peer"]));
318+expectFlagValues(args, "--network", ["container:peer"]);
343319});
344320});
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。