既然有了清單，我就可以對(duì)容器進(jìn)行測(cè)試了。首先，我選擇了一個(gè)我知道不會(huì)通過要求的公共形象，比如流行的 web 服務(wù)器 NGINX。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml nginx:latest Cannot find nginx:latest, pulling…
Validating nginx:latest against kubeflow Home directory is /home/jovyan [failed]  User is jovyan [failed] User ID is 1000 [failed]  Exposes an HTTP interface on port 8888 [failed]  Sets 'Access-Control-Allow-Origin: *' header [failed]  Correctly routes the NB_PREFIX [failed]
validation failed

毫不奇怪，這張圖片沒有通過驗(yàn)證。

接下來，我嘗試了一款設(shè)計(jì)用于 Kubeflow 筆記本電腦的官方 Kubeflow 圖片。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 Cannot find public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0, pulling…
Validating public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 against kubeflow Home directory is /home/jovyan [passed]  User is jovyan [passed]  User ID is 1000 [passed]  Sets 'Access-Control-Allow-Origin: *' header [passed]  Correctly routes the NB_PREFIX [passed]  Exposes an HTTP interface on port 8888 [passed]
validation passed

成功這張圖片通過了驗(yàn)證。

如果要在 Kubeflow 上創(chuàng)建圖像，可以用同樣的方法驗(yàn)證它們，并確信當(dāng)其他用戶來運(yùn)行它們時(shí)，所做的更改不會(huì)導(dǎo)致問題。

編寫自己的驗(yàn)證清單

您還可以編寫自己的清單來驗(yàn)證容器。 Container Canary 可以幫助您確保您的容器清單將在您自己的部署和第三方平臺(tái)中運(yùn)行。它還幫助您在容器構(gòu)建上運(yùn)行單元測(cè)試。

每個(gè)清單都是一個(gè)以一些元數(shù)據(jù)開頭的 YAML 文件。

# Manifest versioning
apiVersion: container-canary.nvidia.com/v1
kind: Validator # Metadata
name: foo # The name of the platform that this manifest validates for
description: Foo runs containers for you # Optional, A description of that platform
documentation: https://example.com # Optional, A link to the documentation that defines the container requirements in prose

接下來，您可以為容器配置一些運(yùn)行時(shí)選項(xiàng)。當(dāng) Container Canary 啟動(dòng)圖像進(jìn)行驗(yàn)證時(shí)，將使用這些選項(xiàng)，并應(yīng)模仿在目標(biāo)平臺(tái)上設(shè)置的選項(xiàng)。其中包括環(huán)境變量、要公開的端口和要連接的卷。

env: - name: NB_PREFIX value: /hub/jovyan/
ports: - port: 8888 protocol: TCP
volumes: - mountPath: /home/jovyan

然后，指定支票。檢查是針對(duì)容器運(yùn)行的測(cè)試，以確保其符合要求。每個(gè)檢查都包含一個(gè)與容器交互的探針。這些交互包括運(yùn)行命令、發(fā)出 HTTP 請(qǐng)求和 ping TCP 套接字。

Container Canary 中的探針是庫(kù)伯內(nèi)特斯的那些的超集，因此如果您以前使用過這些探針，應(yīng)該對(duì)它們很熟悉。

checks: - name: mycheck # Name of the check description: Ensuring a thing # Description of what is being checked (will be used in output) probe: ... # A probe to run

exec檢查會(huì)在正在運(yùn)行的容器中運(yùn)行命令。如果命令以 0 退出，則檢查通過。

checks: - name: uid description: User ID is 1234 probe: exec: command: - /bin/sh - -c - "id | grep uid=1234"

HTTP Get檢查對(duì)您的容器執(zhí)行HTTP GET請(qǐng)求。如果響應(yīng)代碼< 300 且可選響應(yīng)標(biāo)題匹配，則檢查通過。

checks: - name: http description: Exposes an HTTP interface on port 80 probe: httpGet: path: / port: 80 httpHeaders: # Optional, headers to set in the request - name: Foo-Header value: "myheader" responseHttpHeaders: # Optional, headers that you expect to see in the response - name: Access-Control-Allow-Origin value: "*"

有關(guān)更多信息，請(qǐng)參閱驗(yàn)證程序 API 參考。

編寫清單后，可以使用canary來測(cè)試帶有清單的容器。

$ canary validate --file examples/awesome.yaml your/container:latest
Validating your/container:latest against awesome Required packages are installed [passed]  Expected services are running [passed]  Your container is awesome [passed]
validation passed

from fastapi import FastAPI
import uvicorn app = FastAPI() @app.get("/")
def read_root(): return {"Hello": "World"} @app.get("/foo")
def foo(): return {"foo": "bar"} if __name__ == "__main__": uvicorn.run(app, host="0.0.0.0", port=5000, log_level="info")

FROM python COPY app.py /app.py RUN pip install fastapi uvicorn[standard] EXPOSE 5000 CMD python /app.py

apiVersion: container-canary.nvidia.com/v1
kind: Validator
name: example
description: Container Canary CI Example
env: []
ports: - port: 5000 protocol: TCP
volumes: []
checks: - name: http description: Exposes an HTTP interface on port 5000 probe: httpGet: path: /foo port: 5000 failureThreshold: 30 - name: python description: Has Python installed probe: exec: command: - /bin/sh - -c - "which python"

name: ci on: push: pull_request: jobs: canary: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 - name: Install Container Canary run: | curl -L https://github.com/NVIDIA/container-canary/releases/download/v0.2.0/canary_linux_amd64 > /usr/local/bin/canary chmod +x /usr/local/bin/canary - name: Build Container run: docker build -t foo/canary-ci-example:latest . - name: Validate container run: canary validate --file canary-validator.yaml foo/canary-ci-example:latest