fix(test): use available Docker privileges in OIDC live gate

scripts/test/oidc_keycloak_live.sh

@@ -8,6 +8,7 @@ KEYCLOAK_IMAGE="${KEYCLOAK_IMAGE:-quay.io/keycloak/keycloak@sha256:6a7217a100bd3
 WORK_DIR="${RUNNER_TEMP:-/tmp}/rustfs-keycloak-live-${$}"
 KEYCLOAK_CONTAINER="rustfs-keycloak-live-${$}"
 RUSTFS_PID=""
+DOCKER=(docker)
 mkdir -p "${WORK_DIR}"
 
 cleanup() {
@@ -17,10 +18,10 @@ cleanup() {
     wait "${RUSTFS_PID}" 2>/dev/null || true
   fi
   if [[ "${status}" -ne 0 ]]; then
-    docker logs "${KEYCLOAK_CONTAINER}" >"${WORK_DIR}/keycloak.log" 2>&1 || true
+    "${DOCKER[@]}" logs "${KEYCLOAK_CONTAINER}" >"${WORK_DIR}/keycloak.log" 2>&1 || true
     echo "live-gate logs retained in ${WORK_DIR}" >&2
   fi
-  docker rm -f "${KEYCLOAK_CONTAINER}" >/dev/null 2>&1 || true
+  "${DOCKER[@]}" rm -f "${KEYCLOAK_CONTAINER}" >/dev/null 2>&1 || true
   if [[ "${status}" -eq 0 ]]; then
     rm -rf "${WORK_DIR}"
   fi
@@ -33,6 +34,10 @@ for command in curl docker python3 aws; do
     exit 1
   }
 done
+if ! docker info >/dev/null 2>&1; then
+  DOCKER=(sudo -n docker)
+  "${DOCKER[@]}" info >/dev/null
+fi
 [[ -x "${RUSTFS_BINARY}" ]] || {
   echo "RustFS binary is not executable: ${RUSTFS_BINARY}" >&2
   exit 1
@@ -59,7 +64,7 @@ ISSUER="${KEYCLOAK_ORIGIN}/realms/rustfs-ci"
 DISCOVERY_URL="${ISSUER}/.well-known/openid-configuration"
 RUSTFS_ORIGIN="http://127.0.0.1:${RUSTFS_PORT}"
 
-docker run --detach --rm \
+"${DOCKER[@]}" run --detach --rm \
   --name "${KEYCLOAK_CONTAINER}" \
   --memory 1g \
   --publish "127.0.0.1:${KEYCLOAK_PORT}:8080" \
@@ -74,8 +79,8 @@ for _ in $(seq 1 120); do
   if curl --noproxy '*' -fsS "${DISCOVERY_URL}" >"${WORK_DIR}/discovery.json" 2>/dev/null; then
     break
   fi
-  if [[ "$(docker inspect -f '{{.State.Running}}' "${KEYCLOAK_CONTAINER}" 2>/dev/null || true)" != "true" ]]; then
-    docker logs "${KEYCLOAK_CONTAINER}" >&2 || true
+  if [[ "$("${DOCKER[@]}" inspect -f '{{.State.Running}}' "${KEYCLOAK_CONTAINER}" 2>/dev/null || true)" != "true" ]]; then
+    "${DOCKER[@]}" logs "${KEYCLOAK_CONTAINER}" >&2 || true
     echo "Keycloak exited before discovery became ready" >&2
     exit 1
   fi

scripts/test_security_workflow.py

@@ -261,6 +261,47 @@ class SecurityWorkflowTests(WorkflowSteps, unittest.TestCase):
                 if missing:
                     self.assertIn(f"missing required STS field: {missing}", result.stderr)
 
+    def test_oidc_docker_access_and_cleanup_use_the_same_privileges(self):
+        tools = self.directory / "docker-tools"
+        tools.mkdir()
+        (tools / "docker").write_text(
+            '#!/bin/bash\n'
+            'printf "%s %s\\n" "${DOCKER_PRIVILEGED:-no}" "$*" >> "$DOCKER_CALLS"\n'
+            'case "$1" in\n'
+            '  info) [ "$DOCKER_MODE" = direct ] || '
+            '{ [ "$DOCKER_MODE" = sudo ] && [ "${DOCKER_PRIVILEGED:-no}" = yes ]; } ;;\n'
+            '  run) exit 43 ;;\n'
+            '  *) exit 0 ;;\n'
+            'esac\n'
+        )
+        (tools / "sudo").write_text(
+            '#!/bin/bash\n[ "$1" = -n ] || exit 92\nshift\n'
+            'export DOCKER_PRIVILEGED=yes\nexec "$@"\n'
+        )
+        for name in ("docker", "sudo"):
+            (tools / name).chmod(0o755)
+        (tools / "python3").symlink_to(sys.executable)
+        for name in ("aws", "curl"):
+            (tools / name).symlink_to("/usr/bin/true")
+        for mode in ("direct", "sudo", "unavailable"):
+            with self.subTest(mode=mode):
+                calls = self.directory / f"docker-{mode}.log"
+                result = subprocess.run(
+                    ["bash", str(ROOT / "scripts/test/oidc_keycloak_live.sh"), "/usr/bin/true"],
+                    env={**os.environ, "PATH": f"{tools}:/usr/bin:/bin", "RUNNER_TEMP": str(self.directory),
+                         "DOCKER_MODE": mode, "DOCKER_CALLS": str(calls)},
+                    capture_output=True, text=True, timeout=10,
+                )
+                log = calls.read_text()
+                if mode == "unavailable":
+                    self.assertNotEqual(result.returncode, 0)
+                    self.assertNotIn(" run ", log)
+                else:
+                    self.assertEqual(result.returncode, 43, result.stderr)
+                    privilege = "yes" if mode == "sudo" else "no"
+                    for command in ("run", "logs", "rm -f"):
+                        self.assertIn(f"{privilege} {command} ", log)
+
     def test_existing_evidence_directory_is_rejected(self) -> None:
         for suffix in ("", "-scratch"):
             self.setUp()