[Bug]: missleding error when user has no permissions on docker.sock

[jtnord]

Module

Core

Testcontainers version

1.19.8

Using the latest Testcontainers version?

No

Host OS

Linux

Host Arch

amd64

Docker version

Client:
 Version:           27.1.1
 API version:       1.46
 Go version:        go1.21.12
 Git commit:        6312585
 Built:             Tue Jul 23 19:55:52 2024
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Desktop  ()
 Engine:
  Version:          27.1.1
  API version:      1.46 (minimum version 1.24)
  Go version:       go1.21.12
  Git commit:       cc13f95
  Built:            Tue Jul 23 19:57:19 2024
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.19
  GitCommit:        2bf793ef6dc9a18e00cb12efb64355c2c9d5eb41
 runc:
  Version:          1.7.19
  GitCommit:        v1.1.13-0-g58aa920
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

What happened?

Test containers failed to start reporting "Could not find a valid Docker environment. Please see logs and check configuration"
with the following in the logs WARNING: DOCKER_HOST unix:///var/run/docker.sock is not listening

This is incorrect and missleading as verified by running the docker command.

After much confusion it was realized that the docker.sock did exist but was not available (rw) to the current user (the docker binary was suid)

Relevant log output

WARNING: DOCKER_HOST unix:///var/run/docker.sock is not listening

Additional Information

this problem would still happen in the latest version.

testcontainers-java/core/src/main/java/org/testcontainers/dockerclient/DockerClientProviderStrategy.java

Lines 187 to 190 in 0217e78

	if (!new File(dockerHost.getPath()).exists()) {
	log.debug("DOCKER_HOST socket file '{}' does not exist", dockerHost.getPath());
	return false;
	}

checks that the file exists, but does not check that it is read and writable before continuing.

If the file is not read/write for the current user, but exists, you fall through to

testcontainers-java/core/src/main/java/org/testcontainers/dockerclient/DockerClientProviderStrategy.java

Lines 209 to 222 in 0217e78

	try (Socket socket = socketProvider.call()) {
	Duration timeout = Duration.ofMillis(200);
	Awaitility
	.await()
	.atMost(TestcontainersConfiguration.getInstance().getClientPingTimeout(), TimeUnit.SECONDS)
	.pollInterval(timeout)
	.pollDelay(Duration.ofSeconds(0)) // start checking immediately
	.ignoreExceptionsInstanceOf(SocketTimeoutException.class)
	.untilAsserted(() -> socket.connect(socketAddress, (int) timeout.toMillis()));
	return true;
	} catch (Exception e) {
	log.warn("DOCKER_HOST {} is not listening", dockerHost);
	return false;
	}

which emits the incorrect message. (the server is listening, just the current user is not allowed to talk to it!)

Can most likely be easily reproduced by attempting to run test-containers as a user that is not a member of the docker group