既然有了清單，我就可以對容器進行測試了。首先，我選擇了一個我知道不會通過要求的公共形象，比如流行的 web 服務器 NGINX。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml nginx:latest Cannot find nginx:latest, pulling…
Validating nginx:latest against kubeflow Home directory is /home/jovyan [failed]  User is jovyan [failed] User ID is 1000 [failed]  Exposes an HTTP interface on port 8888 [failed]  Sets 'Access-Control-Allow-Origin: *' header [failed]  Correctly routes the NB_PREFIX [failed]
validation failed

毫不奇怪，這張圖片沒有通過驗證。

接下來，我嘗試了一款設計用于 Kubeflow 筆記本電腦的官方 Kubeflow 圖片。

$ canary validate --file https://github.com/NVIDIA/container-canary/raw/main/examples/kubeflow.yaml public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 Cannot find public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0, pulling…
Validating public.ecr.aws/j1r0q0g6/notebooks/notebook-servers/jupyter-pytorch-cuda:v1.5.0 against kubeflow Home directory is /home/jovyan [passed]  User is jovyan [passed]  User ID is 1000 [passed]  Sets 'Access-Control-Allow-Origin: *' header [passed]  Correctly routes the NB_PREFIX [passed]  Exposes an HTTP interface on port 8888 [passed]
validation passed

成功這張圖片通過了驗證。

如果要在 Kubeflow 上創建圖像，可以用同樣的方法驗證它們，并確信當其他用戶來運行它們時，所做的更改不會導致問題。

編寫自己的驗證清單

您還可以編寫自己的清單來驗證容器。 Container Canary 可以幫助您確保您的容器清單將在您自己的部署和第三方平臺中運行。它還幫助您在容器構建上運行單元測試。

每個清單都是一個以一些元數據開頭的 YAML 文件。

# Manifest versioning
apiVersion: container-canary.nvidia.com/v1
kind: Validator # Metadata
name: foo # The name of the platform that this manifest validates for
description: Foo runs containers for you # Optional, A description of that platform
documentation: https://example.com # Optional, A link to the documentation that defines the container requirements in prose

接下來，您可以為容器配置一些運行時選項。當 Container Canary 啟動圖像進行驗證時，將使用這些選項，并應模仿在目標平臺上設置的選項。其中包括環境變量、要公開的端口和要連接的卷。

env: - name: NB_PREFIX value: /hub/jovyan/
ports: - port: 8888 protocol: TCP
volumes: - mountPath: /home/jovyan

然后，指定支票。檢查是針對容器運行的測試，以確保其符合要求。每個檢查都包含一個與容器交互的探針。這些交互包括運行命令、發出 HTTP 請求和 ping TCP 套接字。

Container Canary 中的探針是庫伯內特斯的那些的超集，因此如果您以前使用過這些探針，應該對它們很熟悉。

checks: - name: mycheck # Name of the check description: Ensuring a thing # Description of what is being checked (will be used in output) probe: ... # A probe to run

exec檢查會在正在運行的容器中運行命令。如果命令以 0 退出，則檢查通過。

checks: - name: uid description: User ID is 1234 probe: exec: command: - /bin/sh - -c - "id | grep uid=1234"

HTTP Get檢查對您的容器執行HTTP GET請求。如果響應代碼< 300 且可選響應標題匹配，則檢查通過。

checks: - name: http description: Exposes an HTTP interface on port 80 probe: httpGet: path: / port: 80 httpHeaders: # Optional, headers to set in the request - name: Foo-Header value: "myheader" responseHttpHeaders: # Optional, headers that you expect to see in the response - name: Access-Control-Allow-Origin value: "*"

有關更多信息，請參閱驗證程序 API 參考。

編寫清單后，可以使用canary來測試帶有清單的容器。

$ canary validate --file examples/awesome.yaml your/container:latest
Validating your/container:latest against awesome Required packages are installed [passed]  Expected services are running [passed]  Your container is awesome [passed]
validation passed

from fastapi import FastAPI
import uvicorn app = FastAPI() @app.get("/")
def read_root(): return {"Hello": "World"} @app.get("/foo")
def foo(): return {"foo": "bar"} if __name__ == "__main__": uvicorn.run(app, host="0.0.0.0", port=5000, log_level="info")

FROM python COPY app.py /app.py RUN pip install fastapi uvicorn[standard] EXPOSE 5000 CMD python /app.py

apiVersion: container-canary.nvidia.com/v1
kind: Validator
name: example
description: Container Canary CI Example
env: []
ports: - port: 5000 protocol: TCP
volumes: []
checks: - name: http description: Exposes an HTTP interface on port 5000 probe: httpGet: path: /foo port: 5000 failureThreshold: 30 - name: python description: Has Python installed probe: exec: command: - /bin/sh - -c - "which python"

name: ci on: push: pull_request: jobs: canary: runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v2 - name: Install Container Canary run: | curl -L https://github.com/NVIDIA/container-canary/releases/download/v0.2.0/canary_linux_amd64 > /usr/local/bin/canary chmod +x /usr/local/bin/canary - name: Build Container run: docker build -t foo/canary-ci-example:latest . - name: Validate container run: canary validate --file canary-validator.yaml foo/canary-ci-example:latest