test: expand Docker container test coverage

Add tests for areas of container behaviour not previously exercised:

- crond is running (not just that the crontab file is valid)
- Logrotate config is installed at /etc/pihole/logrotate
- Default DNS upstreams (8.8.8.8/8.8.4.4) applied when none configured
- Web interface accessible at /admin/ (default port and custom port)
- /pihole.docker.tag build metadata file is present
- macvendor.db is present and configured in FTL
- FTL is running as the pihole user (validates DNSMASQ_USER default)
- Capabilities are applied to pihole-FTL (validates fix_capabilities)
- WEBPASSWORD_FILE reads the web password from a Docker secret

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>

Author: PromoFaux

test/run.sh

@@ -43,6 +43,7 @@ export CIPLATFORM
 TEST_FILES=(
     test_default.bats
     test_env_vars.bats
+    test_secrets.bats
 )
 
 # Configure BATS output and parallelization

test/test_default.bats

@@ -47,6 +47,65 @@ teardown_file() {
     assert_output --partial "assigning random password:"
 }
 
+# ---- Container services -----------------------------------------------------
+
+@test "crond is running" {
+    run docker exec "$CONTAINER" pgrep crond
+    assert_success
+}
+
+@test "Logrotate config is installed" {
+    run docker exec "$CONTAINER" test -f /etc/pihole/logrotate
+    assert_success
+}
+
+# ---- Default configuration --------------------------------------------------
+
+@test "Default DNS upstreams are applied when none are configured" {
+    run docker exec "$CONTAINER" pihole-FTL --config -q dns.upstreams
+    assert_success
+    assert_output --partial "8.8.8.8"
+    assert_output --partial "8.8.4.4"
+}
+
+# ---- Web interface ----------------------------------------------------------
+
+@test "Web interface is accessible" {
+    run docker exec "$CONTAINER" curl -sf /dev/null http://localhost/admin/
+    assert_success
+}
+
+# ---- Docker image -----------------------------------------------------------
+
+@test "/pihole.docker.tag is present" {
+    run docker exec "$CONTAINER" test -f /pihole.docker.tag
+    assert_success
+}
+
+@test "macvendor.db is present" {
+    run docker exec "$CONTAINER" test -f /macvendor.db
+    assert_success
+}
+
+@test "macvendor.db path is configured in FTL" {
+    run docker exec "$CONTAINER" pihole-FTL --config -q files.macvendor
+    assert_success
+    assert_output "/macvendor.db"
+}
+
+# ---- Runtime ----------------------------------------------------------------
+
+@test "FTL is running as the pihole user" {
+    run docker exec "$CONTAINER" pgrep -u pihole pihole-FTL
+    assert_success
+}
+
+@test "Capabilities are applied to pihole-FTL" {
+    run docker exec "$CONTAINER" getcap /usr/bin/pihole-FTL
+    assert_success
+    assert_output --partial "cap_net_raw"
+}
+
 # ---- FTL shutdown (DO THIS LAST!)---------------------------------------------
 
 @test "FTL starts up and shuts down cleanly" {

test/test_env_vars.bats

@@ -59,6 +59,13 @@ teardown_file() {
     assert_success
 }
 
+# ---- Web interface ----------------------------------------------------------
+
+@test "Web interface is accessible on custom port" {
+    run docker exec "$CONTAINER" curl -sf http://localhost:8080/admin
+    assert_success
+}
+
 # ---- TAIL_FTL_LOG disabled --------------------------------------------------
 
 @test "TAIL_FTL_LOG=0 suppresses FTL log output in docker logs" {

test/test_secrets.bats

@@ -0,0 +1,32 @@
+#!/usr/bin/env bats
+
+load 'libs/bats-support/load'
+load 'libs/bats-assert/load'
+load 'helpers.sh'
+
+setup_file() {
+    # Create a temporary file to act as the Docker secret
+    local secret_file
+    secret_file=$(mktemp)
+    echo -n "mysecretpassword" > "$secret_file"
+    export SECRET_FILE="$secret_file"
+
+    CONTAINER=$(start_container \
+        -e WEBPASSWORD_FILE=pihole_password \
+        -v "${secret_file}:/run/secrets/pihole_password:ro")
+    wait_for_log "$CONTAINER" "########## FTL started"
+    export CONTAINER
+}
+
+teardown_file() {
+    docker rm -f "$CONTAINER" > /dev/null 2>&1 || true
+    rm -f "$SECRET_FILE"
+}
+
+# ---- Docker secrets ---------------------------------------------------------
+
+@test "WEBPASSWORD_FILE reads the web password from a Docker secret" {
+    run docker logs "$CONTAINER"
+    assert_success
+    assert_output --partial "Setting FTLCONF_webserver_api_password from file"
+}