Skip to content

test: enforce strict replay sandboxing in e2e fixtures #79

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
sohankshirsagar wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

test: enforce strict replay sandboxing in e2e fixtures #79

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions drift/instrumentation/aiohttp/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/aiohttp/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/aiohttp/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/django/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/django/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/django/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
58 changes: 30 additions & 28 deletions drift/instrumentation/e2e_common/Dockerfile.base
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# This base image contains:
# - Python 3.9 (minimum supported version)
# - Tusk CLI (for running replay tests)
# - System utilities (curl, postgresql-client)
# - System utilities (curl, postgresql-client, socat, bubblewrap)
#
# Build this image before running e2e tests:
# docker build -t python-e2e-base:latest -f drift/instrumentation/e2e-common/Dockerfile.base .
Expand All @@ -12,38 +12,40 @@ FROM python:3.9-slim

# Install system dependencies
RUN apt-get update && apt-get install -y --no-install-recommends \
curl \
postgresql-client \
&& rm -rf /var/lib/apt/lists/*
curl \
postgresql-client \
socat \
bubblewrap \
&& rm -rf /var/lib/apt/lists/*

# Install Tusk CLI
# The CLI is downloaded from GitHub releases (tar.gz archives)
ARG TUSK_CLI_VERSION=latest
RUN set -ex && \
if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
# Get the latest version tag
VERSION=$(curl -s https://api.github.com/repos/Use-Tusk/tusk-drift-cli/releases/latest | grep '"tag_name"' | cut -d '"' -f 4); \
else \
VERSION="${TUSK_CLI_VERSION}"; \
fi && \
# Remove 'v' prefix if present for the filename
VERSION_NUM=$(echo "$VERSION" | sed 's/^v//') && \
# Detect architecture (x86_64 or arm64)
ARCH=$(uname -m) && \
case "$ARCH" in \
x86_64) ARCH_NAME="x86_64" ;; \
aarch64|arm64) ARCH_NAME="arm64" ;; \
*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
esac && \
# Construct download URL (archives are named like tusk-drift-cli_0.1.35_Linux_x86_64.tar.gz)
DOWNLOAD_URL="https://github.com/Use-Tusk/tusk-drift-cli/releases/download/${VERSION}/tusk-drift-cli_${VERSION_NUM}_Linux_${ARCH_NAME}.tar.gz" && \
echo "Downloading Tusk CLI from: $DOWNLOAD_URL" && \
curl -fsSL "$DOWNLOAD_URL" -o /tmp/tusk.tar.gz && \
tar -xzf /tmp/tusk.tar.gz -C /tmp && \
mv /tmp/tusk /usr/local/bin/tusk && \
chmod +x /usr/local/bin/tusk && \
rm -rf /tmp/tusk.tar.gz /tmp/LICENSE /tmp/README.md && \
tusk --version
if [ "$TUSK_CLI_VERSION" = "latest" ]; then \
# Get the latest version tag
VERSION=$(curl -s https://api.github.com/repos/Use-Tusk/tusk-drift-cli/releases/latest | grep '"tag_name"' | cut -d '"' -f 4); \
else \
VERSION="${TUSK_CLI_VERSION}"; \
fi && \
# Remove 'v' prefix if present for the filename
VERSION_NUM=$(echo "$VERSION" | sed 's/^v//') && \
# Detect architecture (x86_64 or arm64)
ARCH=$(uname -m) && \
case "$ARCH" in \
x86_64) ARCH_NAME="x86_64" ;; \
aarch64|arm64) ARCH_NAME="arm64" ;; \
*) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
esac && \
# Construct download URL (archives are named like tusk-drift-cli_0.1.35_Linux_x86_64.tar.gz)
DOWNLOAD_URL="https://github.com/Use-Tusk/tusk-drift-cli/releases/download/${VERSION}/tusk-drift-cli_${VERSION_NUM}_Linux_${ARCH_NAME}.tar.gz" && \
echo "Downloading Tusk CLI from: $DOWNLOAD_URL" && \
curl -fsSL "$DOWNLOAD_URL" -o /tmp/tusk.tar.gz && \
tar -xzf /tmp/tusk.tar.gz -C /tmp && \
mv /tmp/tusk /usr/local/bin/tusk && \
chmod +x /usr/local/bin/tusk && \
rm -rf /tmp/tusk.tar.gz /tmp/LICENSE /tmp/README.md && \
tusk --version

# Upgrade pip
RUN pip install --upgrade pip
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/fastapi/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/fastapi/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/fastapi/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
3 changes: 2 additions & 1 deletion drift/instrumentation/fastapi/e2e-tests/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,5 +2,6 @@
fastapi>=0.115.0
uvicorn>=0.30.0
requests>=2.32.5
httpx>=0.27.0
# Strict replay sandbox routes outbound HTTP through a SOCKS proxy.
httpx[socks]>=0.27.0

2 changes: 2 additions & 0 deletions drift/instrumentation/flask/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/flask/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/flask/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/grpc/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/grpc/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,11 @@ services:
dockerfile: drift/instrumentation/grpc/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
2 changes: 1 addition & 1 deletion drift/instrumentation/grpc/e2e-tests/src/greeter_pb2_grpc.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@

import greeter_pb2 as greeter__pb2

GRPC_GENERATED_VERSION = '1.76.0'
GRPC_GENERATED_VERSION = '1.78.0'
Copy link

@cursor cursor bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generated gRPC stub version bump without requirements update

Medium Severity

The regenerated greeter_pb2_grpc.py bumps GRPC_GENERATED_VERSION from '1.76.0' to '1.78.0', but requirements.txt still allows grpcio>=1.60.0. The generated runtime check (first_version_is_lower) raises a RuntimeError at import if the installed grpcio is below 1.78.0. This change is unrelated to the PR's strict-sandbox goal and looks accidentally committed alongside the config changes.

Fix in Cursor Fix in Web

GRPC_VERSION = grpc.__version__
_version_not_supported = False

Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/httpx/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/httpx/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/httpx/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
3 changes: 2 additions & 1 deletion drift/instrumentation/httpx/e2e-tests/requirements.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
-e /sdk
Flask>=3.1.2
httpx>=0.28.1
# Strict replay sandbox routes outbound HTTP through a SOCKS proxy.
httpx[socks]>=0.28.1
requests>=2.32.5
2 changes: 2 additions & 0 deletions drift/instrumentation/psycopg/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/psycopg/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ services:
dockerfile: drift/instrumentation/psycopg/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
postgres:
condition: service_healthy
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/psycopg2/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/psycopg2/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ services:
dockerfile: drift/instrumentation/psycopg2/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
postgres:
condition: service_healthy
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/redis/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/redis/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,11 @@ services:
dockerfile: drift/instrumentation/redis/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
redis:
condition: service_healthy
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/requests/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/requests/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/requests/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/sqlalchemy/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/sqlalchemy/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ services:
dockerfile: drift/instrumentation/sqlalchemy/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
postgres:
condition: service_healthy
Expand Down
Empty file modified drift/instrumentation/sqlalchemy/e2e-tests/run.sh
100644 → 100755
View file
Open in desktop
Empty file.
2 changes: 2 additions & 0 deletions drift/instrumentation/urllib/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,3 +25,5 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/instrumentation/urllib/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/urllib/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
2 changes: 2 additions & 0 deletions drift/instrumentation/urllib3/e2e-tests/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,4 +25,6 @@ recording:

replay:
enable_telemetry: false
sandbox:
mode: strict

5 changes: 5 additions & 0 deletions drift/instrumentation/urllib3/e2e-tests/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,11 @@ services:
dockerfile: drift/instrumentation/urllib3/e2e-tests/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
environment:
- PORT=8000
- TUSK_ANALYTICS_DISABLED=1
Expand Down
4 changes: 4 additions & 0 deletions drift/stack-tests/django-postgres/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,7 @@ recording:
sampling_rate: 1.0
export_spans: false
exclude_paths: []

replay:
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/stack-tests/django-postgres/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ services:
dockerfile: drift/stack-tests/django-postgres/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
postgres:
condition: service_healthy
Expand Down
4 changes: 4 additions & 0 deletions drift/stack-tests/django-redis/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,3 +22,7 @@ recording:
sampling_rate: 1.0
export_spans: false
exclude_paths: []

replay:
sandbox:
mode: strict
5 changes: 5 additions & 0 deletions drift/stack-tests/django-redis/docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,11 @@ services:
dockerfile: drift/stack-tests/django-redis/Dockerfile
args:
- TUSK_CLI_VERSION=${TUSK_CLI_VERSION:-latest}
cap_add:
- SYS_ADMIN
security_opt:
- seccomp=unconfined
- apparmor=unconfined
depends_on:
redis:
condition: service_healthy
Expand Down
4 changes: 4 additions & 0 deletions drift/stack-tests/fastapi-postgres/.tusk/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,3 +19,7 @@ recording:
sampling_rate: 1.0
export_spans: false
exclude_paths: []

replay:
sandbox:
mode: strict
Loading
Loading