test: add SKIP_DOCKER_HUB_TESTS env var to skip rate-limited tests

hiroTamada · hiroTamada · commit f09e53d98df8 · 2026-01-08T20:09:04.000-05:00
When SKIP_DOCKER_HUB_TESTS=1 is set, tests that require pulling images
from Docker Hub are skipped. This allows CI to run without being blocked
by Docker Hub rate limiting.

Affected tests:
- lib/images: TestCreateImage*, TestListImages, TestDeleteImage, TestLayerCaching
- lib/instances: TestBasicEndToEnd, TestStandbyAndRestore, TestExecConcurrent,
  TestCreateInstanceWithNetwork, TestQEMU*, TestVolume*, TestOverlayDisk*,
  TestAggregateLimits_EnforcedAtRuntime
- lib/system: TestEnsureSystemFiles
- cmd/api/api: TestCreateImage*, TestCreateInstance*, TestInstanceLifecycle,
  TestRegistry*, TestCp*, TestExec*
- integration: TestSystemdMode
diff --git a/cmd/api/api/cp_test.go b/cmd/api/api/cp_test.go
@@ -17,6 +17,7 @@ import (
 )
 
 func TestCpToAndFromInstance(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
@@ -156,6 +157,7 @@ func TestCpToAndFromInstance(t *testing.T) {
 }
 
 func TestCpDirectoryToInstance(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
diff --git a/cmd/api/api/exec_test.go b/cmd/api/api/exec_test.go
@@ -18,6 +18,7 @@ import (
 )
 
 func TestExecInstanceNonTTY(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
@@ -158,6 +159,7 @@ func TestExecInstanceNonTTY(t *testing.T) {
 // 2. guest-agent must keep running even after the main app exits
 // 3. The VM must not kernel panic when the entrypoint exits
 func TestExecWithDebianMinimal(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
diff --git a/cmd/api/api/images_test.go b/cmd/api/api/images_test.go
@@ -33,6 +33,7 @@ func TestGetImage_NotFound(t *testing.T) {
 }
 
 func TestCreateImage_Async(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc := newTestService(t)
 	ctx := ctx()
 
@@ -125,6 +126,7 @@ func TestCreateImage_Async(t *testing.T) {
 }
 
 func TestCreateImage_InvalidTag(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc := newTestService(t)
 	ctx := ctx()
 
@@ -171,6 +173,7 @@ func TestCreateImage_InvalidName(t *testing.T) {
 }
 
 func TestCreateImage_Idempotent(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc := newTestService(t)
 	ctx := ctx()
 
diff --git a/cmd/api/api/instances_test.go b/cmd/api/api/instances_test.go
@@ -33,6 +33,7 @@ func TestGetInstance_NotFound(t *testing.T) {
 }
 
 func TestCreateInstance_ParsesHumanReadableSizes(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
@@ -129,6 +130,7 @@ func TestCreateInstance_InvalidSizeFormat(t *testing.T) {
 }
 
 func TestInstanceLifecycle_StopStart(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access for VM creation
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Skip("/dev/kvm not available - skipping lifecycle test")
diff --git a/cmd/api/api/registry_test.go b/cmd/api/api/registry_test.go
@@ -25,6 +25,16 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// skipIfNoDockerHub skips the test if SKIP_DOCKER_HUB_TESTS is set.
+// This is used to skip tests that require pulling from Docker Hub in CI
+// environments where rate limiting may be an issue.
+func skipIfNoDockerHub(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SKIP_DOCKER_HUB_TESTS") != "" {
+		t.Skip("Skipping test that requires Docker Hub (SKIP_DOCKER_HUB_TESTS is set)")
+	}
+}
+
 // setupRegistryTest creates a test service with a mounted OCI registry server.
 // Returns the service (for API calls) and the server host (for building push URLs).
 func setupRegistryTest(t *testing.T) (*ApiService, string) {
@@ -47,6 +57,7 @@ func setupRegistryTest(t *testing.T) (*ApiService, string) {
 }
 
 func TestRegistryPushAndConvert(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc, serverHost := setupRegistryTest(t)
 
 	// Pull a small image from Docker Hub to push to our registry
@@ -92,6 +103,7 @@ func TestRegistryVersionCheck(t *testing.T) {
 }
 
 func TestRegistryPushAndCreateInstance(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// This is a full e2e test that requires KVM access
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Skip("/dev/kvm not available - skipping VM creation test")
@@ -174,6 +186,7 @@ func TestRegistryPushAndCreateInstance(t *testing.T) {
 // TestRegistryLayerCaching verifies that pushing the same image twice
 // reuses cached layers and doesn't re-upload them.
 func TestRegistryLayerCaching(t *testing.T) {
+	skipIfNoDockerHub(t)
 	_, serverHost := setupRegistryTest(t)
 
 	// Pull alpine image from Docker Hub
@@ -257,6 +270,7 @@ func TestRegistryLayerCaching(t *testing.T) {
 // TestRegistrySharedLayerCaching verifies that pushing different images
 // that share layers reuses the cached shared layers.
 func TestRegistrySharedLayerCaching(t *testing.T) {
+	skipIfNoDockerHub(t)
 	_, serverHost := setupRegistryTest(t)
 
 	// Pull alpine image (this will be our base)
@@ -338,6 +352,7 @@ func TestRegistrySharedLayerCaching(t *testing.T) {
 // TestRegistryTagPush verifies that pushing with a tag reference (not digest)
 // correctly triggers conversion. The server computes the digest from the manifest.
 func TestRegistryTagPush(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc, serverHost := setupRegistryTest(t)
 
 	// Pull alpine image from Docker Hub
@@ -391,6 +406,7 @@ func TestRegistryTagPush(t *testing.T) {
 // Docker v2 manifest (as returned by local Docker daemon) is correctly converted
 // to OCI format and the image conversion succeeds.
 func TestRegistryDockerV2ManifestConversion(t *testing.T) {
+	skipIfNoDockerHub(t)
 	svc, serverHost := setupRegistryTest(t)
 
 	// Pull alpine image from Docker Hub (OCI format)
diff --git a/integration/systemd_test.go b/integration/systemd_test.go
@@ -22,6 +22,14 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// skipIfNoDockerHub skips the test if SKIP_DOCKER_HUB_TESTS is set.
+func skipIfNoDockerHub(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SKIP_DOCKER_HUB_TESTS") != "" {
+		t.Skip("Skipping test that requires Docker Hub (SKIP_DOCKER_HUB_TESTS is set)")
+	}
+}
+
 // TestSystemdMode verifies that hypeman correctly detects and runs
 // systemd-based images with systemd as PID 1.
 //
@@ -31,6 +39,7 @@ import (
 // - Starts systemd as PID 1
 // - Injects and starts the hypeman-agent.service
 func TestSystemdMode(t *testing.T) {
+	skipIfNoDockerHub(t)
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
 	}
diff --git a/lib/images/manager_test.go b/lib/images/manager_test.go
@@ -12,7 +12,16 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// skipIfNoDockerHub skips the test if SKIP_DOCKER_HUB_TESTS is set.
+func skipIfNoDockerHub(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SKIP_DOCKER_HUB_TESTS") != "" {
+		t.Skip("Skipping test that requires Docker Hub (SKIP_DOCKER_HUB_TESTS is set)")
+	}
+}
+
 func TestCreateImage(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -83,6 +92,7 @@ func TestCreateImage(t *testing.T) {
 }
 
 func TestCreateImageDifferentTag(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -105,6 +115,7 @@ func TestCreateImageDifferentTag(t *testing.T) {
 }
 
 func TestCreateImageDuplicate(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -134,6 +145,7 @@ func TestCreateImageDuplicate(t *testing.T) {
 }
 
 func TestListImages(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -163,6 +175,7 @@ func TestListImages(t *testing.T) {
 }
 
 func TestGetImage(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -198,6 +211,7 @@ func TestGetImageNotFound(t *testing.T) {
 }
 
 func TestDeleteImage(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
@@ -270,6 +284,7 @@ func TestNormalizedRefParsing(t *testing.T) {
 }
 
 func TestLayerCaching(t *testing.T) {
+	skipIfNoDockerHub(t)
 	dataDir := t.TempDir()
 	mgr, err := NewManager(paths.New(dataDir), 1, nil)
 	require.NoError(t, err)
diff --git a/lib/instances/exec_test.go b/lib/instances/exec_test.go
@@ -35,6 +35,7 @@ func waitForExecAgent(ctx context.Context, mgr *manager, instanceID string, time
 // TestExecConcurrent tests concurrent exec commands from multiple goroutines.
 // This validates that the exec infrastructure handles concurrent access correctly.
 func TestExecConcurrent(t *testing.T) {
+	skipIfNoDockerHub(t)
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available")
 	}
diff --git a/lib/instances/manager_test.go b/lib/instances/manager_test.go
@@ -31,6 +31,14 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+// skipIfNoDockerHub skips the test if SKIP_DOCKER_HUB_TESTS is set.
+func skipIfNoDockerHub(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SKIP_DOCKER_HUB_TESTS") != "" {
+		t.Skip("Skipping test that requires Docker Hub (SKIP_DOCKER_HUB_TESTS is set)")
+	}
+}
+
 // setupTestManager creates a manager and registers cleanup for any orphaned processes
 func setupTestManager(t *testing.T) (*manager, string) {
 	tmpDir := t.TempDir()
@@ -174,6 +182,7 @@ func cleanupOrphanedProcesses(t *testing.T, mgr *manager) {
 }
 
 func TestBasicEndToEnd(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access (don't skip, fail informatively)
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
@@ -825,6 +834,7 @@ func TestStorageOperations(t *testing.T) {
 }
 
 func TestStandbyAndRestore(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access (don't skip, fail informatively)
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
diff --git a/lib/instances/network_test.go b/lib/instances/network_test.go
@@ -19,6 +19,7 @@ import (
 // TestCreateInstanceWithNetwork tests instance creation with network allocation
 // and verifies network connectivity persists after standby/restore
 func TestCreateInstanceWithNetwork(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access
 	requireKVMAccess(t)
 
diff --git a/lib/instances/qemu_test.go b/lib/instances/qemu_test.go
@@ -161,6 +161,7 @@ func (r *qemuInstanceResolver) ResolveInstance(ctx context.Context, nameOrID str
 // It tests: create, get, list, logs, network, ingress, volumes, exec, and delete.
 // It does NOT test: snapshot/standby, hot memory resize (not supported by QEMU in first pass).
 func TestQEMUBasicEndToEnd(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
@@ -540,6 +541,7 @@ func TestQEMUBasicEndToEnd(t *testing.T) {
 // TestQEMUStandbyAndRestore tests the standby/restore cycle with QEMU.
 // This tests QEMU's migrate-to-file snapshot mechanism.
 func TestQEMUStandbyAndRestore(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM access
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")
diff --git a/lib/instances/resource_limits_test.go b/lib/instances/resource_limits_test.go
@@ -227,6 +227,7 @@ func TestAggregateUsage_StructValues(t *testing.T) {
 // aggregate resource limits are enforced when creating VMs.
 // It creates one VM, then tries to create another that would exceed the total limit.
 func TestAggregateLimits_EnforcedAtRuntime(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Skip in short mode - this is an integration test
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
diff --git a/lib/instances/volumes_test.go b/lib/instances/volumes_test.go
@@ -40,6 +40,7 @@ func execWithRetry(ctx context.Context, inst *Instance, command []string) (strin
 // 3. Attached read-only to multiple instances simultaneously
 // 4. Data persists and is readable from all instances
 func TestVolumeMultiAttachReadOnly(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group")
@@ -222,6 +223,7 @@ func TestVolumeMultiAttachReadOnly(t *testing.T) {
 // TestOverlayDiskCleanupOnDelete verifies that vol-overlays/ directory is removed
 // when an instance with overlay volumes is deleted.
 func TestOverlayDiskCleanupOnDelete(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Skip in short mode - this is an integration test
 	if testing.Short() {
 		t.Skip("skipping integration test in short mode")
@@ -332,6 +334,7 @@ func createTestTarGz(t *testing.T, files map[string][]byte) *bytes.Buffer {
 // TestVolumeFromArchive tests that a volume can be created from a tar.gz archive
 // and the files are accessible when mounted to an instance
 func TestVolumeFromArchive(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// Require KVM
 	if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {
 		t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group")
diff --git a/lib/system/manager_test.go b/lib/system/manager_test.go
@@ -2,13 +2,22 @@ package system
 
 import (
 	"context"
+	"os"
 	"testing"
 
 	"github.com/onkernel/hypeman/lib/paths"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+// skipIfNoDockerHub skips the test if SKIP_DOCKER_HUB_TESTS is set.
+func skipIfNoDockerHub(t *testing.T) {
+	t.Helper()
+	if os.Getenv("SKIP_DOCKER_HUB_TESTS") != "" {
+		t.Skip("Skipping test that requires Docker Hub (SKIP_DOCKER_HUB_TESTS is set)")
+	}
+}
+
 func TestGetDefaultKernelVersion(t *testing.T) {
 	tmpDir := t.TempDir()
 	mgr := NewManager(paths.New(tmpDir))
@@ -29,6 +38,7 @@ func TestGetKernelPath(t *testing.T) {
 }
 
 func TestEnsureSystemFiles(t *testing.T) {
+	skipIfNoDockerHub(t)
 	// This test requires network access and takes a while
 	// Skip by default, run explicitly with: go test -run TestEnsureSystemFiles
 	if testing.Short() {

Original file line number	Diff line number	Diff line change
`@@ -17,6 +17,7 @@ import (`
`17`	`17`	`)`
`18`	`18`
`19`	`19`	`func TestCpToAndFromInstance(t *testing.T) {`
	`20`	`+ skipIfNoDockerHub(t)`
`20`	`21`	`// Require KVM access for VM creation`
`21`	`22`	`if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {`
`22`	`23`	`t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")`
`@@ -156,6 +157,7 @@ func TestCpToAndFromInstance(t *testing.T) {`
`156`	`157`	`}`
`157`	`158`
`158`	`159`	`func TestCpDirectoryToInstance(t *testing.T) {`
	`160`	`+ skipIfNoDockerHub(t)`
`159`	`161`	`// Require KVM access for VM creation`
`160`	`162`	`if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {`
`161`	`163`	`t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")`
Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ func TestGetImage_NotFound(t *testing.T) {`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`func TestCreateImage_Async(t *testing.T) {`
	`36`	`+ skipIfNoDockerHub(t)`
`36`	`37`	`svc := newTestService(t)`
`37`	`38`	`ctx := ctx()`
`38`	`39`
`@@ -125,6 +126,7 @@ func TestCreateImage_Async(t *testing.T) {`
`125`	`126`	`}`
`126`	`127`
`127`	`128`	`func TestCreateImage_InvalidTag(t *testing.T) {`
	`129`	`+ skipIfNoDockerHub(t)`
`128`	`130`	`svc := newTestService(t)`
`129`	`131`	`ctx := ctx()`
`130`	`132`
`@@ -171,6 +173,7 @@ func TestCreateImage_InvalidName(t *testing.T) {`
`171`	`173`	`}`
`172`	`174`
`173`	`175`	`func TestCreateImage_Idempotent(t *testing.T) {`
	`176`	`+ skipIfNoDockerHub(t)`
`174`	`177`	`svc := newTestService(t)`
`175`	`178`	`ctx := ctx()`
`176`	`179`
Original file line number	Diff line number	Diff line change
`@@ -33,6 +33,7 @@ func TestGetInstance_NotFound(t *testing.T) {`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`func TestCreateInstance_ParsesHumanReadableSizes(t *testing.T) {`
	`36`	`+ skipIfNoDockerHub(t)`
`36`	`37`	`// Require KVM access for VM creation`
`37`	`38`	`if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {`
`38`	`39`	`t.Fatal("/dev/kvm not available - ensure KVM is enabled and user is in 'kvm' group (sudo usermod -aG kvm $USER)")`
`@@ -129,6 +130,7 @@ func TestCreateInstance_InvalidSizeFormat(t *testing.T) {`
`129`	`130`	`}`
`130`	`131`
`131`	`132`	`func TestInstanceLifecycle_StopStart(t *testing.T) {`
	`133`	`+ skipIfNoDockerHub(t)`
`132`	`134`	`// Require KVM access for VM creation`
`133`	`135`	`if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {`
`134`	`136`	`t.Skip("/dev/kvm not available - skipping lifecycle test")`
Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@ func waitForExecAgent(ctx context.Context, mgr *manager, instanceID string, time`
`35`	`35`	`// TestExecConcurrent tests concurrent exec commands from multiple goroutines.`
`36`	`36`	`// This validates that the exec infrastructure handles concurrent access correctly.`
`37`	`37`	`func TestExecConcurrent(t *testing.T) {`
	`38`	`+ skipIfNoDockerHub(t)`
`38`	`39`	`if _, err := os.Stat("/dev/kvm"); os.IsNotExist(err) {`
`39`	`40`	`t.Fatal("/dev/kvm not available")`
`40`	`41`	`}`