Merge pull request #69 from aws/test/proxy-regression

test: add dockerized regression test for the proxy-bypass fix

Author: benrkia

.github/workflows/dockerized-test.yml

@@ -39,3 +39,13 @@ jobs:
         suiteFileArray: '["./test/dockerized/suites/*.json"]'
         dockerImageName: 'local/test'
         taskFolder: './test/dockerized/tasks'
+
+    - name: Build the proxy image
+      run: docker build . -t local/test-proxy -f Dockerfile.test.proxy
+
+    - name: Run proxy tests
+      uses: aws/containerized-test-runner-for-aws-lambda@511d270614f2c6b1613848db6dcf920a591c3c89 # main
+      with:
+        suiteFileArray: '["./test/dockerized/suites/proxy/*.json"]'
+        dockerImageName: 'local/test-proxy'
+        taskFolder: './test/dockerized/tasks'

Dockerfile.test

@@ -5,4 +5,4 @@ ADD test/dockerized/tasks /var/task
 RUN gem uninstall aws_lambda_ric --executables
 ADD pkg /tmp/pkg
 RUN gem install /tmp/pkg/aws_lambda_ric-*.gem
-RUN rm -rf /tmp/pkg
+RUN rm -rf /tmp/pkg

Dockerfile.test.proxy

@@ -0,0 +1,15 @@
+# Variant of Dockerfile.test used only for the proxy-regression suite.
+# Extends the standard test image with an unreachable HTTP_PROXY and an
+# entrypoint that binds RIE's Runtime API to the container's own
+# non-loopback hostname. Kept separate from Dockerfile.test so the other
+# suites keep running against a plain RIE-on-loopback setup.
+#
+# Requires local/test to be built first (see .github/workflows/dockerized-test.yml).
+FROM local/test
+
+ENV HTTP_PROXY=http://127.0.0.1:1
+ENV http_proxy=http://127.0.0.1:1
+
+COPY test/dockerized/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]

test/dockerized/entrypoint.sh

@@ -0,0 +1,23 @@
+#!/bin/sh
+# Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+
+set -eu
+
+if [ "$#" -ne 1 ]; then
+  echo "entrypoint requires the handler name as first argument" 1>&2
+  exit 142
+fi
+export _HANDLER="$1"
+
+# Resolve the container's own hostname to its non-loopback IPv4 (docker
+# writes this to /etc/hosts for us on eth0).
+RIC_HOST="$(getent hosts "$HOSTNAME" | awk '{print $1; exit}')"
+if [ -z "$RIC_HOST" ]; then
+  echo "entrypoint could not resolve \$HOSTNAME ($HOSTNAME)" 1>&2
+  exit 143
+fi
+
+exec /usr/local/bin/aws-lambda-rie \
+    --runtime-api-address "$RIC_HOST:9001" \
+    /var/runtime/bootstrap

test/dockerized/suites/proxy/proxy.json

@@ -0,0 +1,14 @@
+{
+    "tests": [
+        {
+            "name": "test_ric_bypasses_http_proxy",
+            "handler": "proxy.check_proxy_bypass",
+            "request": {},
+            "assertions": [
+                {
+                    "response": "success"
+                }
+            ]
+        }
+    ]
+}

test/dockerized/tasks/proxy.rb

@@ -0,0 +1,12 @@
+# Copyright 2026 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+# The image (see Dockerfile.test) runs with HTTP_PROXY pointed at an
+# unreachable address and RIE's Runtime API bound to a non-loopback
+# hostname. If the proxy-bypass fix (PR #68) is in place the RIC bypasses
+# HTTP_PROXY for Runtime API calls and this handler runs to completion,
+# returning "success". Without the fix the RIC would try to reach the
+# unreachable proxy for next_invocation and this handler would never run.
+
+def check_proxy_bypass(event:, context:)
+  'success'
+end