Merge branch 'main' into 18842-arv-mount-disk-config
[arvados.git] / lib / diagnostics / cmd.go
index 7021bb0ee3103f0c5e2b21f59d526625fb76eef3..ed963e1ef75b42439ed1e23fef7d11e9a62a695c 100644 (file)
@@ -5,8 +5,10 @@
 package diagnostics
 
 import (
+       "archive/tar"
        "bytes"
        "context"
+       _ "embed"
        "flag"
        "fmt"
        "io"
@@ -14,33 +16,36 @@ import (
        "net"
        "net/http"
        "net/url"
+       "os"
        "strings"
        "time"
 
+       "git.arvados.org/arvados.git/lib/cmd"
+       "git.arvados.org/arvados.git/lib/config"
        "git.arvados.org/arvados.git/sdk/go/arvados"
        "git.arvados.org/arvados.git/sdk/go/ctxlog"
+       "git.arvados.org/arvados.git/sdk/go/health"
        "github.com/sirupsen/logrus"
 )
 
 type Command struct{}
 
-func (cmd Command) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
+func (Command) RunCommand(prog string, args []string, stdin io.Reader, stdout, stderr io.Writer) int {
        var diag diagnoser
        f := flag.NewFlagSet(prog, flag.ContinueOnError)
        f.StringVar(&diag.projectName, "project-name", "scratch area for diagnostics", "name of project to find/create in home project and use for temporary/test objects")
        f.StringVar(&diag.logLevel, "log-level", "info", "logging level (debug, info, warning, error)")
+       f.StringVar(&diag.dockerImage, "docker-image", "", "image to use when running a test container (default: use embedded hello-world image)")
        f.BoolVar(&diag.checkInternal, "internal-client", false, "check that this host is considered an \"internal\" client")
        f.BoolVar(&diag.checkExternal, "external-client", false, "check that this host is considered an \"external\" client")
+       f.BoolVar(&diag.verbose, "v", false, "verbose: include more information in report")
+       f.IntVar(&diag.priority, "priority", 500, "priority for test container (1..1000, or 0 to skip)")
        f.DurationVar(&diag.timeout, "timeout", 10*time.Second, "timeout for http requests")
-       err := f.Parse(args)
-       if err == flag.ErrHelp {
-               return 0
-       } else if err != nil {
-               fmt.Fprintln(stderr, err)
-               return 2
+       if ok, code := cmd.ParseFlags(f, prog, args, "", stderr); !ok {
+               return code
        }
        diag.logger = ctxlog.New(stdout, "text", diag.logLevel)
-       diag.logger.SetFormatter(&logrus.TextFormatter{DisableTimestamp: true, DisableLevelTruncation: true})
+       diag.logger.SetFormatter(&logrus.TextFormatter{DisableTimestamp: true, DisableLevelTruncation: true, PadLevelText: true})
        diag.runtests()
        if len(diag.errors) == 0 {
                diag.logger.Info("--- no errors ---")
@@ -56,13 +61,21 @@ func (cmd Command) RunCommand(prog string, args []string, stdin io.Reader, stdou
        }
 }
 
+// docker save hello-world > hello-world.tar
+//
+//go:embed hello-world.tar
+var HelloWorldDockerImage []byte
+
 type diagnoser struct {
        stdout        io.Writer
        stderr        io.Writer
        logLevel      string
+       priority      int
        projectName   string
+       dockerImage   string
        checkInternal bool
        checkExternal bool
+       verbose       bool
        timeout       time.Duration
        logger        *logrus.Logger
        errors        []string
@@ -70,15 +83,21 @@ type diagnoser struct {
 }
 
 func (diag *diagnoser) debugf(f string, args ...interface{}) {
-       diag.logger.Debugf(f, args...)
+       diag.logger.Debugf("  ... "+f, args...)
 }
 
 func (diag *diagnoser) infof(f string, args ...interface{}) {
-       diag.logger.Infof(f, args...)
+       diag.logger.Infof("  ... "+f, args...)
+}
+
+func (diag *diagnoser) verbosef(f string, args ...interface{}) {
+       if diag.verbose {
+               diag.logger.Infof("  ... "+f, args...)
+       }
 }
 
 func (diag *diagnoser) warnf(f string, args ...interface{}) {
-       diag.logger.Warnf(f, args...)
+       diag.logger.Warnf("  ... "+f, args...)
 }
 
 func (diag *diagnoser) errorf(f string, args ...interface{}) {
@@ -99,14 +118,15 @@ func (diag *diagnoser) dotest(id int, title string, fn func() error) {
        }
        diag.done[id] = true
 
-       diag.infof("%d %s", id, title)
+       diag.logger.Infof("%4d: %s", id, title)
        t0 := time.Now()
        err := fn()
-       elapsed := fmt.Sprintf("%.0dms", time.Now().Sub(t0)/time.Millisecond)
+       elapsed := fmt.Sprintf("%ms", time.Now().Sub(t0)/time.Millisecond)
        if err != nil {
-               diag.errorf("%s (%s): %s", title, elapsed, err)
+               diag.errorf("%4d: %s (%s): %s", id, title, elapsed, err)
+       } else {
+               diag.logger.Debugf("%4d: %s (%s): ok", id, title, elapsed)
        }
-       diag.debugf("%d %s (%s): ok", id, title, elapsed)
 }
 
 func (diag *diagnoser) runtests() {
@@ -117,38 +137,107 @@ func (diag *diagnoser) runtests() {
                return
        }
 
+       hostname, err := os.Hostname()
+       if err != nil {
+               diag.warnf("error getting hostname: %s")
+       } else {
+               diag.verbosef("hostname = %s", hostname)
+       }
+
+       diag.dotest(5, "running health check (same as `arvados-server check`)", func() error {
+               ldr := config.NewLoader(&bytes.Buffer{}, ctxlog.New(&bytes.Buffer{}, "text", "info"))
+               ldr.SetupFlags(flag.NewFlagSet("diagnostics", flag.ContinueOnError))
+               cfg, err := ldr.Load()
+               if err != nil {
+                       diag.infof("skipping because config could not be loaded: %s", err)
+                       return nil
+               }
+               cluster, err := cfg.GetCluster("")
+               if err != nil {
+                       return err
+               }
+               if cluster.SystemRootToken != os.Getenv("ARVADOS_API_TOKEN") {
+                       return fmt.Errorf("diagnostics usage error: %s is readable but SystemRootToken does not match $ARVADOS_API_TOKEN (to fix, either run 'arvados-client sudo diagnostics' to load everything from config file, or set ARVADOS_CONFIG=- to load nothing from config file)", ldr.Path)
+               }
+               agg := &health.Aggregator{Cluster: cluster}
+               resp := agg.ClusterHealth()
+               for _, e := range resp.Errors {
+                       diag.errorf("health check: %s", e)
+               }
+               if len(resp.Errors) > 0 {
+                       diag.infof("consider running `arvados-server check -yaml` for a comprehensive report")
+               }
+               diag.verbosef("reported clock skew = %v", resp.ClockSkew)
+               reported := map[string]bool{}
+               for _, result := range resp.Checks {
+                       version := strings.SplitN(result.Metrics.Version, " (go", 2)[0]
+                       if version != "" && !reported[version] {
+                               diag.verbosef("arvados version = %s", version)
+                               reported[version] = true
+                       }
+               }
+               reported = map[string]bool{}
+               for _, result := range resp.Checks {
+                       if result.Server != "" && !reported[result.Server] {
+                               diag.verbosef("http frontend version = %s", result.Server)
+                               reported[result.Server] = true
+                       }
+               }
+               reported = map[string]bool{}
+               for _, result := range resp.Checks {
+                       if sha := result.ConfigSourceSHA256; sha != "" && !reported[sha] {
+                               diag.verbosef("config file sha256 = %s", sha)
+                               reported[sha] = true
+                       }
+               }
+               return nil
+       })
+
        var dd arvados.DiscoveryDocument
        ddpath := "discovery/v1/apis/arvados/v1/rest"
        diag.dotest(10, fmt.Sprintf("getting discovery document from https://%s/%s", client.APIHost, ddpath), func() error {
-               err := client.RequestAndDecode(&dd, "GET", ddpath, nil, nil)
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &dd, "GET", ddpath, nil, nil)
                if err != nil {
                        return err
                }
-               diag.debugf("BlobSignatureTTL = %d", dd.BlobSignatureTTL)
+               diag.verbosef("BlobSignatureTTL = %d", dd.BlobSignatureTTL)
                return nil
        })
 
        var cluster arvados.Cluster
        cfgpath := "arvados/v1/config"
+       cfgOK := false
        diag.dotest(20, fmt.Sprintf("getting exported config from https://%s/%s", client.APIHost, cfgpath), func() error {
-               err := client.RequestAndDecode(&cluster, "GET", cfgpath, nil, nil)
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &cluster, "GET", cfgpath, nil, nil)
                if err != nil {
                        return err
                }
-               diag.debugf("Collections.BlobSigning = %v", cluster.Collections.BlobSigning)
+               diag.verbosef("Collections.BlobSigning = %v", cluster.Collections.BlobSigning)
+               cfgOK = true
                return nil
        })
 
        var user arvados.User
        diag.dotest(30, "getting current user record", func() error {
-               err := client.RequestAndDecode(&user, "GET", "arvados/v1/users/current", nil, nil)
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &user, "GET", "arvados/v1/users/current", nil, nil)
                if err != nil {
                        return err
                }
-               diag.debugf("user uuid = %s", user.UUID)
+               diag.verbosef("user uuid = %s", user.UUID)
                return nil
        })
 
+       if !cfgOK {
+               diag.errorf("cannot proceed without cluster config -- aborting without running any further tests")
+               return
+       }
+
        // uncomment to create some spurious errors
        // cluster.Services.WebDAVDownload.ExternalURL.Host = "0.0.0.0:9"
 
@@ -163,6 +252,8 @@ func (diag *diagnoser) runtests() {
                &cluster.Services.Workbench2,
        } {
                diag.dotest(40+i, fmt.Sprintf("connecting to service endpoint %s", svc.ExternalURL), func() error {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
                        u := svc.ExternalURL
                        if strings.HasPrefix(u.Scheme, "ws") {
                                // We can do a real websocket test elsewhere,
@@ -173,7 +264,7 @@ func (diag *diagnoser) runtests() {
                        if svc == &cluster.Services.WebDAV && strings.HasPrefix(u.Host, "*") {
                                u.Host = "d41d8cd98f00b204e9800998ecf8427e-0" + u.Host[1:]
                        }
-                       req, err := http.NewRequest(http.MethodGet, u.String(), nil)
+                       req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
                        if err != nil {
                                return err
                        }
@@ -192,7 +283,9 @@ func (diag *diagnoser) runtests() {
                cluster.Services.WebDAVDownload.ExternalURL.String(),
        } {
                diag.dotest(50+i, fmt.Sprintf("checking CORS headers at %s", url), func() error {
-                       req, err := http.NewRequest("GET", url, nil)
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+                       req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
                        if err != nil {
                                return err
                        }
@@ -210,7 +303,9 @@ func (diag *diagnoser) runtests() {
 
        var keeplist arvados.KeepServiceList
        diag.dotest(60, "checking internal/external client detection", func() error {
-               err := client.RequestAndDecode(&keeplist, "GET", "arvados/v1/keep_services/accessible", nil, arvados.ListOptions{Limit: 999999})
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &keeplist, "GET", "arvados/v1/keep_services/accessible", nil, arvados.ListOptions{Limit: 999999})
                if err != nil {
                        return fmt.Errorf("error getting keep services list: %s", err)
                } else if len(keeplist.Items) == 0 {
@@ -223,9 +318,9 @@ func (diag *diagnoser) runtests() {
                isInternal := found["proxy"] == 0 && len(keeplist.Items) > 0
                isExternal := found["proxy"] > 0 && found["proxy"] == len(keeplist.Items)
                if isExternal {
-                       diag.debugf("controller returned only proxy services, this host is treated as \"external\"")
+                       diag.infof("controller returned only proxy services, this host is treated as \"external\"")
                } else if isInternal {
-                       diag.debugf("controller returned only non-proxy services, this host is treated as \"internal\"")
+                       diag.infof("controller returned only non-proxy services, this host is treated as \"internal\"")
                }
                if (diag.checkInternal && !isInternal) || (diag.checkExternal && !isExternal) {
                        return fmt.Errorf("expecting internal=%v external=%v, but found internal=%v external=%v", diag.checkInternal, diag.checkExternal, isInternal, isExternal)
@@ -288,8 +383,10 @@ func (diag *diagnoser) runtests() {
 
        var project arvados.Group
        diag.dotest(80, fmt.Sprintf("finding/creating %q project", diag.projectName), func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
                var grplist arvados.GroupList
-               err := client.RequestAndDecode(&grplist, "GET", "arvados/v1/groups", nil, arvados.ListOptions{
+               err := client.RequestAndDecodeContext(ctx, &grplist, "GET", "arvados/v1/groups", nil, arvados.ListOptions{
                        Filters: []arvados.Filter{
                                {"name", "=", diag.projectName},
                                {"group_class", "=", "project"},
@@ -300,48 +397,83 @@ func (diag *diagnoser) runtests() {
                }
                if len(grplist.Items) > 0 {
                        project = grplist.Items[0]
-                       diag.debugf("using existing project, uuid = %s", project.UUID)
+                       diag.verbosef("using existing project, uuid = %s", project.UUID)
                        return nil
                }
                diag.debugf("list groups: ok, no results")
-               err = client.RequestAndDecode(&project, "POST", "arvados/v1/groups", nil, map[string]interface{}{"group": map[string]interface{}{
+               err = client.RequestAndDecodeContext(ctx, &project, "POST", "arvados/v1/groups", nil, map[string]interface{}{"group": map[string]interface{}{
                        "name":        diag.projectName,
                        "group_class": "project",
                }})
                if err != nil {
                        return fmt.Errorf("create project: %s", err)
                }
-               diag.debugf("created project, uuid = %s", project.UUID)
+               diag.verbosef("created project, uuid = %s", project.UUID)
                return nil
        })
 
        var collection arvados.Collection
        diag.dotest(90, "creating temporary collection", func() error {
-               err := client.RequestAndDecode(&collection, "POST", "arvados/v1/collections", nil, map[string]interface{}{
+               if project.UUID == "" {
+                       return fmt.Errorf("skipping, no project to work in")
+               }
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+               err := client.RequestAndDecodeContext(ctx, &collection, "POST", "arvados/v1/collections", nil, map[string]interface{}{
                        "ensure_unique_name": true,
                        "collection": map[string]interface{}{
-                               "name":     "test collection",
-                               "trash_at": time.Now().Add(time.Hour)}})
+                               "owner_uuid": project.UUID,
+                               "name":       "test collection",
+                               "trash_at":   time.Now().Add(time.Hour)}})
                if err != nil {
                        return err
                }
-               diag.debugf("ok, uuid = %s", collection.UUID)
+               diag.verbosef("ok, uuid = %s", collection.UUID)
                return nil
        })
 
        if collection.UUID != "" {
                defer func() {
                        diag.dotest(9990, "deleting temporary collection", func() error {
-                               return client.RequestAndDecode(nil, "DELETE", "arvados/v1/collections/"+collection.UUID, nil, nil)
+                               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                               defer cancel()
+                               return client.RequestAndDecodeContext(ctx, nil, "DELETE", "arvados/v1/collections/"+collection.UUID, nil, nil)
                        })
                }()
        }
 
+       // Read hello-world.tar to find image ID, so we can upload it
+       // as "sha256:{...}.tar"
+       var imageSHA2 string
+       {
+               tr := tar.NewReader(bytes.NewReader(HelloWorldDockerImage))
+               for {
+                       hdr, err := tr.Next()
+                       if err == io.EOF {
+                               break
+                       }
+                       if err != nil {
+                               diag.errorf("internal error/bug: cannot read embedded docker image tar file: %s", err)
+                               return
+                       }
+                       if s := strings.TrimSuffix(hdr.Name, ".json"); len(s) == 64 && s != hdr.Name {
+                               imageSHA2 = s
+                       }
+               }
+               if imageSHA2 == "" {
+                       diag.errorf("internal error/bug: cannot find {sha256}.json file in embedded docker image tar file")
+                       return
+               }
+       }
+       tarfilename := "sha256:" + imageSHA2 + ".tar"
+
        diag.dotest(100, "uploading file via webdav", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
                if collection.UUID == "" {
                        return fmt.Errorf("skipping, no test collection")
                }
-               req, err := http.NewRequest("PUT", cluster.Services.WebDAVDownload.ExternalURL.String()+"c="+collection.UUID+"/testfile", bytes.NewBufferString("testfiledata"))
+               req, err := http.NewRequestWithContext(ctx, "PUT", cluster.Services.WebDAVDownload.ExternalURL.String()+"c="+collection.UUID+"/"+tarfilename, bytes.NewReader(HelloWorldDockerImage))
                if err != nil {
                        return fmt.Errorf("BUG? http.NewRequest: %s", err)
                }
@@ -355,7 +487,7 @@ func (diag *diagnoser) runtests() {
                        return fmt.Errorf("status %s", resp.Status)
                }
                diag.debugf("ok, status %s", resp.Status)
-               err = client.RequestAndDecode(&collection, "GET", "arvados/v1/collections/"+collection.UUID, nil, nil)
+               err = client.RequestAndDecodeContext(ctx, &collection, "GET", "arvados/v1/collections/"+collection.UUID, nil, nil)
                if err != nil {
                        return fmt.Errorf("get updated collection: %s", err)
                }
@@ -364,33 +496,41 @@ func (diag *diagnoser) runtests() {
        })
 
        davurl := cluster.Services.WebDAV.ExternalURL
+       davWildcard := strings.HasPrefix(davurl.Host, "*--") || strings.HasPrefix(davurl.Host, "*.")
        diag.dotest(110, fmt.Sprintf("checking WebDAV ExternalURL wildcard (%s)", davurl), func() error {
                if davurl.Host == "" {
                        return fmt.Errorf("host missing - content previews will not work")
                }
-               if !strings.HasPrefix(davurl.Host, "*--") && !strings.HasPrefix(davurl.Host, "*.") && !cluster.Collections.TrustAllContent {
+               if !davWildcard && !cluster.Collections.TrustAllContent {
                        diag.warnf("WebDAV ExternalURL has no leading wildcard and TrustAllContent==false - content previews will not work")
                }
                return nil
        })
 
        for i, trial := range []struct {
-               needcoll bool
-               status   int
-               fileurl  string
+               needcoll     bool
+               needWildcard bool
+               status       int
+               fileurl      string
        }{
-               {false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + "foo"},
-               {false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + "testfile"},
-               {false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/foo"},
-               {false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/testfile"},
-               {true, http.StatusOK, strings.Replace(davurl.String(), "*", strings.Replace(collection.PortableDataHash, "+", "-", -1), 1) + "testfile"},
-               {true, http.StatusOK, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=" + collection.UUID + "/_/testfile"},
+               {false, false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + "foo"},
+               {false, false, http.StatusNotFound, strings.Replace(davurl.String(), "*", "d41d8cd98f00b204e9800998ecf8427e-0", 1) + tarfilename},
+               {false, false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/foo"},
+               {false, false, http.StatusNotFound, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=d41d8cd98f00b204e9800998ecf8427e+0/_/" + tarfilename},
+               {true, true, http.StatusOK, strings.Replace(davurl.String(), "*", strings.Replace(collection.PortableDataHash, "+", "-", -1), 1) + tarfilename},
+               {true, false, http.StatusOK, cluster.Services.WebDAVDownload.ExternalURL.String() + "c=" + collection.UUID + "/_/" + tarfilename},
        } {
                diag.dotest(120+i, fmt.Sprintf("downloading from webdav (%s)", trial.fileurl), func() error {
+                       if trial.needWildcard && !davWildcard {
+                               diag.warnf("skipping collection-id-in-vhost test because WebDAV ExternalURL has no leading wildcard")
+                               return nil
+                       }
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
                        if trial.needcoll && collection.UUID == "" {
                                return fmt.Errorf("skipping, no test collection")
                        }
-                       req, err := http.NewRequest("GET", trial.fileurl, nil)
+                       req, err := http.NewRequestWithContext(ctx, "GET", trial.fileurl, nil)
                        if err != nil {
                                return err
                        }
@@ -407,8 +547,13 @@ func (diag *diagnoser) runtests() {
                        if resp.StatusCode != trial.status {
                                return fmt.Errorf("unexpected response status: %s", resp.Status)
                        }
-                       if trial.status == http.StatusOK && string(body) != "testfiledata" {
-                               return fmt.Errorf("unexpected response content: %q", body)
+                       if trial.status == http.StatusOK && !bytes.Equal(body, HelloWorldDockerImage) {
+                               excerpt := body
+                               if len(excerpt) > 128 {
+                                       excerpt = append([]byte(nil), body[:128]...)
+                                       excerpt = append(excerpt, []byte("[...]")...)
+                               }
+                               return fmt.Errorf("unexpected response content: len %d, %q", len(body), excerpt)
                        }
                        return nil
                })
@@ -416,25 +561,31 @@ func (diag *diagnoser) runtests() {
 
        var vm arvados.VirtualMachine
        diag.dotest(130, "getting list of virtual machines", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
                var vmlist arvados.VirtualMachineList
-               err := client.RequestAndDecode(&vmlist, "GET", "arvados/v1/virtual_machines", nil, arvados.ListOptions{Limit: 999999})
+               err := client.RequestAndDecodeContext(ctx, &vmlist, "GET", "arvados/v1/virtual_machines", nil, arvados.ListOptions{Limit: 999999})
                if err != nil {
                        return err
                }
                if len(vmlist.Items) < 1 {
-                       return fmt.Errorf("no VMs found")
+                       diag.warnf("no VMs found")
+               } else {
+                       vm = vmlist.Items[0]
                }
-               vm = vmlist.Items[0]
                return nil
        })
 
        diag.dotest(140, "getting workbench1 webshell page", func() error {
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
                if vm.UUID == "" {
-                       return fmt.Errorf("skipping, no vm available")
+                       diag.warnf("skipping, no vm available")
+                       return nil
                }
                webshelltermurl := cluster.Services.Workbench1.ExternalURL.String() + "virtual_machines/" + vm.UUID + "/webshell/testusername"
                diag.debugf("url %s", webshelltermurl)
-               req, err := http.NewRequest("GET", webshelltermurl, nil)
+               req, err := http.NewRequestWithContext(ctx, "GET", webshelltermurl, nil)
                if err != nil {
                        return err
                }
@@ -458,7 +609,8 @@ func (diag *diagnoser) runtests() {
                ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
                defer cancel()
                if vm.UUID == "" {
-                       return fmt.Errorf("skipping, no vm available")
+                       diag.warnf("skipping, no vm available")
+                       return nil
                }
                u := cluster.Services.WebShell.ExternalURL
                webshellurl := u.String() + vm.Hostname + "?"
@@ -497,4 +649,106 @@ func (diag *diagnoser) runtests() {
                }
                return nil
        })
+
+       diag.dotest(160, "running a container", func() error {
+               if diag.priority < 1 {
+                       diag.infof("skipping (use priority > 0 if you want to run a container)")
+                       return nil
+               }
+               if project.UUID == "" {
+                       return fmt.Errorf("skipping, no project to work in")
+               }
+
+               timestamp := time.Now().Format(time.RFC3339)
+               ctrCommand := []string{"echo", timestamp}
+               if diag.dockerImage == "" {
+                       if collection.UUID == "" {
+                               return fmt.Errorf("skipping, no test collection to use as docker image")
+                       }
+                       diag.dockerImage = collection.PortableDataHash
+                       ctrCommand = []string{"/hello"}
+               }
+
+               var cr arvados.ContainerRequest
+               ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+               defer cancel()
+
+               err := client.RequestAndDecodeContext(ctx, &cr, "POST", "arvados/v1/container_requests", nil, map[string]interface{}{"container_request": map[string]interface{}{
+                       "owner_uuid":      project.UUID,
+                       "name":            fmt.Sprintf("diagnostics container request %s", timestamp),
+                       "container_image": diag.dockerImage,
+                       "command":         ctrCommand,
+                       "use_existing":    false,
+                       "output_path":     "/mnt/output",
+                       "output_name":     fmt.Sprintf("diagnostics output %s", timestamp),
+                       "priority":        diag.priority,
+                       "state":           arvados.ContainerRequestStateCommitted,
+                       "mounts": map[string]map[string]interface{}{
+                               "/mnt/output": {
+                                       "kind":     "collection",
+                                       "writable": true,
+                               },
+                       },
+                       "runtime_constraints": arvados.RuntimeConstraints{
+                               VCPUs:        1,
+                               RAM:          1 << 26,
+                               KeepCacheRAM: 1 << 26,
+                       },
+               }})
+               if err != nil {
+                       return err
+               }
+               diag.verbosef("container request uuid = %s", cr.UUID)
+               diag.verbosef("container uuid = %s", cr.ContainerUUID)
+
+               timeout := 10 * time.Minute
+               diag.infof("container request submitted, waiting up to %v for container to run", arvados.Duration(timeout))
+               deadline := time.Now().Add(timeout)
+
+               var c arvados.Container
+               for ; cr.State != arvados.ContainerRequestStateFinal && time.Now().Before(deadline); time.Sleep(2 * time.Second) {
+                       ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(diag.timeout))
+                       defer cancel()
+
+                       crStateWas := cr.State
+                       err := client.RequestAndDecodeContext(ctx, &cr, "GET", "arvados/v1/container_requests/"+cr.UUID, nil, nil)
+                       if err != nil {
+                               return err
+                       }
+                       if cr.State != crStateWas {
+                               diag.debugf("container request state = %s", cr.State)
+                       }
+
+                       cStateWas := c.State
+                       err = client.RequestAndDecodeContext(ctx, &c, "GET", "arvados/v1/containers/"+cr.ContainerUUID, nil, nil)
+                       if err != nil {
+                               return err
+                       }
+                       if c.State != cStateWas {
+                               diag.debugf("container state = %s", c.State)
+                       }
+
+                       cancel()
+               }
+
+               if cr.State != arvados.ContainerRequestStateFinal {
+                       err := client.RequestAndDecodeContext(context.Background(), &cr, "PATCH", "arvados/v1/container_requests/"+cr.UUID, nil, map[string]interface{}{
+                               "container_request": map[string]interface{}{
+                                       "priority": 0,
+                               }})
+                       if err != nil {
+                               diag.infof("error canceling container request %s: %s", cr.UUID, err)
+                       } else {
+                               diag.debugf("canceled container request %s", cr.UUID)
+                       }
+                       return fmt.Errorf("timed out waiting for container to finish; container request %s state was %q, container %s state was %q", cr.UUID, cr.State, c.UUID, c.State)
+               }
+               if c.State != arvados.ContainerStateComplete {
+                       return fmt.Errorf("container request %s is final but container %s did not complete: container state = %q", cr.UUID, cr.ContainerUUID, c.State)
+               }
+               if c.ExitCode != 0 {
+                       return fmt.Errorf("container exited %d", c.ExitCode)
+               }
+               return nil
+       })
 }