test: scope proxy setup to a dedicated image and suite

Reviewer flagged that setting HTTP_PROXY globally in Dockerfile.test made every suite exercise the fix, so proxy.json no longer proved anything the other suites did not, and a regression would break the whole matrix instead of the one intended test. Move the proxy setup into a second image (Dockerfile.test.proxy) that extends local/test with HTTP_PROXY and the custom entrypoint, and move the proxy suite under test/dockerized/suites/proxy/ so the default suites/*.json glob no longer picks it up. Workflow now builds both images and runs each glob against its own image.
benrkia · Sep 22, 2026 · Sep 22, 2026 · Sep 22, 2026 · Sep 22, 2026 · Sep 22, 2026
commit eb2551c0e73187789ac8da941666ca70884711b5
diff --git a/.github/workflows/dockerized-test.yml b/.github/workflows/dockerized-test.yml
@@ -39,3 +39,13 @@ jobs:
         suiteFileArray: '["./test/dockerized/suites/*.json"]'
         dockerImageName: 'local/test'
         taskFolder: './test/dockerized/tasks'
+
+    - name: Build the proxy image
+      run: docker build . -t local/test-proxy -f Dockerfile.test.proxy
+
+    - name: Run proxy tests
+      uses: aws/containerized-test-runner-for-aws-lambda@511d270614f2c6b1613848db6dcf920a591c3c89 # main
+      with:
+        suiteFileArray: '["./test/dockerized/suites/proxy/*.json"]'
+        dockerImageName: 'local/test-proxy'
+        taskFolder: './test/dockerized/tasks'
diff --git a/Dockerfile.test b/Dockerfile.test
@@ -6,17 +6,3 @@ RUN gem uninstall aws_lambda_ric --executables
 ADD pkg /tmp/pkg
 RUN gem install /tmp/pkg/aws_lambda_ric-*.gem
 RUN rm -rf /tmp/pkg
-
-# Route every HTTP call in the container through an unreachable proxy. The
-# whole suite runs with this: after the fix the RIC bypasses it for Runtime
-# API traffic and every test still passes; before the fix the RIC would
-# try to reach 127.0.0.1:1, connect refused, and every test would fail.
-ENV HTTP_PROXY=http://127.0.0.1:1
-ENV http_proxy=http://127.0.0.1:1
-
-# Custom entrypoint binds RIE's Runtime API to the container's own hostname
-# (a non-loopback address), so Ruby's URI.find_proxy loopback bypass does
-# not silently hide the bug.
-COPY test/dockerized/entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
diff --git a/Dockerfile.test.proxy b/Dockerfile.test.proxy
@@ -0,0 +1,15 @@
+# Variant of Dockerfile.test used only for the proxy-regression suite.
+# Extends the standard test image with an unreachable HTTP_PROXY and an
+# entrypoint that binds RIE's Runtime API to the container's own
+# non-loopback hostname. Kept separate from Dockerfile.test so the other
+# suites keep running against a plain RIE-on-loopback setup.
+#
+# Requires local/test to be built first (see .github/workflows/dockerized-test.yml).
+FROM local/test
+
+ENV HTTP_PROXY=http://127.0.0.1:1
+ENV http_proxy=http://127.0.0.1:1
+
+COPY test/dockerized/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/test/dockerized/suites/proxy.json → test/dockerized/suites/proxy/proxy.json b/test/dockerized/suites/proxy.json → test/dockerized/suites/proxy/proxy.json