From 37df529e7a058846eb989038b6d5198a32d7f107 Mon Sep 17 00:00:00 2001
From: Seth Hoenig <shoenig@duck.com>
Date: Mon, 26 Jun 2023 09:51:18 -0500
Subject: [PATCH] e2e: refactor pids isolation tests (#17717)

This PR refactors some old PID isolation tests to make use of the e2e/v3
packages. Should be quite a bit easier to read. Adds 'alloc exec' capability
to the jobs3 package.
---
 e2e/isolation/doc.go                          |   3 +
 e2e/isolation/input/alloc_exec.hcl            |  41 +++
 e2e/isolation/input/alloc_exec.nomad          |  28 --
 ...oc_exec_java.nomad => alloc_exec_java.hcl} |  40 ++-
 e2e/isolation/input/{exec.nomad => exec.hcl}  |  23 +-
 .../input/{exec_host.nomad => exec_host.hcl}  |  23 +-
 e2e/isolation/input/{java.nomad => java.hcl}  |  38 ++-
 .../input/{java_host.nomad => java_host.hcl}  |  38 ++-
 .../input/{raw_exec.nomad => raw_exec.hcl}    |  23 +-
 e2e/isolation/pids.go                         | 304 ------------------
 e2e/isolation/pids_test.go                    | 118 +++++++
 e2e/v3/jobs3/allocexec3.go                    |  70 ++++
 12 files changed, 379 insertions(+), 370 deletions(-)
 create mode 100644 e2e/isolation/doc.go
 create mode 100644 e2e/isolation/input/alloc_exec.hcl
 delete mode 100644 e2e/isolation/input/alloc_exec.nomad
 rename e2e/isolation/input/{alloc_exec_java.nomad => alloc_exec_java.hcl} (57%)
 rename e2e/isolation/input/{exec.nomad => exec.hcl} (66%)
 rename e2e/isolation/input/{exec_host.nomad => exec_host.hcl} (69%)
 rename e2e/isolation/input/{java.nomad => java.hcl} (62%)
 rename e2e/isolation/input/{java_host.nomad => java_host.hcl} (63%)
 rename e2e/isolation/input/{raw_exec.nomad => raw_exec.hcl} (68%)
 delete mode 100644 e2e/isolation/pids.go
 create mode 100644 e2e/isolation/pids_test.go
 create mode 100644 e2e/v3/jobs3/allocexec3.go

diff --git a/e2e/isolation/doc.go b/e2e/isolation/doc.go
new file mode 100644
index 000000000..d423392a9
--- /dev/null
+++ b/e2e/isolation/doc.go
@@ -0,0 +1,3 @@
+// Package isolation provides tests around various kinds of isolation, such as
+// artifact downloading, PID namespacing, and chroot task environments.
+package isolation
diff --git a/e2e/isolation/input/alloc_exec.hcl b/e2e/isolation/input/alloc_exec.hcl
new file mode 100644
index 000000000..c0986d290
--- /dev/null
+++ b/e2e/isolation/input/alloc_exec.hcl
@@ -0,0 +1,41 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+job "alloc_exec" {
+
+  constraint {
+    attribute = "${attr.kernel.name}"
+    value     = "linux"
+  }
+
+  group "group" {
+
+    update {
+      min_healthy_time = "2s"
+    }
+
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
+
+    task "sleep" {
+      driver = "exec"
+
+      config {
+        command = "sleep"
+        args    = ["infinity"]
+      }
+
+      resources {
+        cpu    = 10
+        memory = 16
+      }
+    }
+  }
+}
diff --git a/e2e/isolation/input/alloc_exec.nomad b/e2e/isolation/input/alloc_exec.nomad
deleted file mode 100644
index e6ea63b63..000000000
--- a/e2e/isolation/input/alloc_exec.nomad
+++ /dev/null
@@ -1,28 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
-job "alloc_exec" {
-  datacenters = ["dc1"]
-  type        = "service"
-
-  constraint {
-    attribute = "${attr.kernel.name}"
-    value     = "linux"
-  }
-
-  group "main" {
-    task "main" {
-      driver = "exec"
-
-      config {
-        command = "/bin/sleep"
-        args    = ["30s"]
-      }
-
-      resources {
-        cpu    = 100
-        memory = 64
-      }
-    }
-  }
-}
diff --git a/e2e/isolation/input/alloc_exec_java.nomad b/e2e/isolation/input/alloc_exec_java.hcl
similarity index 57%
rename from e2e/isolation/input/alloc_exec_java.nomad
rename to e2e/isolation/input/alloc_exec_java.hcl
index 12f89c79d..46092540a 100644
--- a/e2e/isolation/input/alloc_exec_java.nomad
+++ b/e2e/isolation/input/alloc_exec_java.hcl
@@ -1,11 +1,28 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
-job "java_sleep" {
-  datacenters = ["dc1"]
-  type        = "batch"
+job "java_exec" {
 
-  group "java" {
+  constraint {
+    attribute = "${attr.kernel.name}"
+    value     = "linux"
+  }
+
+  group "group" {
+
+    update {
+      min_healthy_time = "2s"
+    }
+
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
 
     task "build" {
       lifecycle {
@@ -24,19 +41,30 @@ job "java_sleep" {
         data        = <<EOH
 public class Sleep {
     public static void main(String... s) throws Exception {
-        Thread.sleep(30000);
+        Thread.sleep(999999999);
     }
 }
 EOH
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
 
     task "sleep" {
       driver = "java"
+
       config {
         class_path = "${NOMAD_ALLOC_DIR}"
         class      = "Sleep"
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/e2e/isolation/input/exec.nomad b/e2e/isolation/input/exec.hcl
similarity index 66%
rename from e2e/isolation/input/exec.nomad
rename to e2e/isolation/input/exec.hcl
index 9fa208447..50a0757c6 100644
--- a/e2e/isolation/input/exec.nomad
+++ b/e2e/isolation/input/exec.hcl
@@ -2,16 +2,25 @@
 # SPDX-License-Identifier: MPL-2.0
 
 job "exec" {
-  datacenters = ["dc1"]
-  type        = "batch"
+  type = "batch"
 
   constraint {
     attribute = "${attr.kernel.name}"
     value     = "linux"
   }
 
-  group "exec" {
-    task "exec" {
+  group "group" {
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
+
+    task "bash" {
       driver = "exec"
 
       config {
@@ -28,13 +37,13 @@ echo my pid is $BASHPID
 EOF
 
         destination = "local/pid.sh"
-        perms       = "777"
+        perms       = "755"
         change_mode = "noop"
       }
 
       resources {
-        cpu    = 100
-        memory = 64
+        cpu    = 10
+        memory = 16
       }
     }
   }
diff --git a/e2e/isolation/input/exec_host.nomad b/e2e/isolation/input/exec_host.hcl
similarity index 69%
rename from e2e/isolation/input/exec_host.nomad
rename to e2e/isolation/input/exec_host.hcl
index 702229a88..681669f37 100644
--- a/e2e/isolation/input/exec_host.nomad
+++ b/e2e/isolation/input/exec_host.hcl
@@ -1,17 +1,26 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
-job "exec" {
-  datacenters = ["dc1"]
-  type        = "batch"
+job "exec_host" {
+  type = "batch"
 
   constraint {
     attribute = "${attr.kernel.name}"
     value     = "linux"
   }
 
-  group "exec" {
-    task "exec" {
+  group "group" {
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
+
+    task "bash" {
       driver = "exec"
 
       config {
@@ -35,8 +44,8 @@ EOF
       }
 
       resources {
-        cpu    = 100
-        memory = 64
+        cpu    = 10
+        memory = 16
       }
     }
   }
diff --git a/e2e/isolation/input/java.nomad b/e2e/isolation/input/java.hcl
similarity index 62%
rename from e2e/isolation/input/java.nomad
rename to e2e/isolation/input/java.hcl
index bb2a77962..80002e35f 100644
--- a/e2e/isolation/input/java.nomad
+++ b/e2e/isolation/input/java.hcl
@@ -1,11 +1,26 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
-job "java_pid" {
-  datacenters = ["dc1"]
-  type        = "batch"
+job "java" {
+  type = "batch"
+
+  constraint {
+    attribute = "${attr.kernel.name}"
+    value     = "linux"
+  }
+
+
+  group "group" {
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
 
-  group "java" {
 
     task "build" {
       lifecycle {
@@ -29,14 +44,25 @@ public class Pid {
 }
 EOH
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
 
-    task "pid" {
+    task "java" {
       driver = "java"
+
       config {
         class_path = "${NOMAD_ALLOC_DIR}"
         class      = "Pid"
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/e2e/isolation/input/java_host.nomad b/e2e/isolation/input/java_host.hcl
similarity index 63%
rename from e2e/isolation/input/java_host.nomad
rename to e2e/isolation/input/java_host.hcl
index 6e2e8d5f2..143262ec3 100644
--- a/e2e/isolation/input/java_host.nomad
+++ b/e2e/isolation/input/java_host.hcl
@@ -1,11 +1,27 @@
 # Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
 
-job "java_pid" {
-  datacenters = ["dc1"]
-  type        = "batch"
+job "java_host" {
+  type = "batch"
+
+  constraint {
+    attribute = "${attr.kernel.name}"
+    value     = "linux"
+  }
+
+  group "group" {
+
+
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
 
-  group "java" {
 
     task "build" {
       lifecycle {
@@ -29,9 +45,14 @@ public class Pid {
 }
 EOH
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
 
-    task "pid" {
+    task "java" {
       driver = "java"
       config {
         class_path = "${NOMAD_ALLOC_DIR}"
@@ -39,6 +60,11 @@ EOH
         pid_mode   = "host"
         ipc_mode   = "host"
       }
+
+      resources {
+        cpu    = 50
+        memory = 64
+      }
     }
   }
-}
\ No newline at end of file
+}
diff --git a/e2e/isolation/input/raw_exec.nomad b/e2e/isolation/input/raw_exec.hcl
similarity index 68%
rename from e2e/isolation/input/raw_exec.nomad
rename to e2e/isolation/input/raw_exec.hcl
index 22b500464..2e963ea57 100644
--- a/e2e/isolation/input/raw_exec.nomad
+++ b/e2e/isolation/input/raw_exec.hcl
@@ -2,16 +2,27 @@
 # SPDX-License-Identifier: MPL-2.0
 
 job "raw_exec" {
-  datacenters = ["dc1"]
-  type        = "batch"
+  type = "batch"
 
   constraint {
     attribute = "${attr.kernel.name}"
     value     = "linux"
   }
 
-  group "raw_exec" {
-    task "raw_exec" {
+  group "group" {
+
+    reschedule {
+      attempts  = 0
+      unlimited = false
+    }
+
+    restart {
+      attempts = 0
+      mode     = "fail"
+    }
+
+
+    task "bash" {
       driver = "raw_exec"
 
       config {
@@ -28,12 +39,12 @@ echo my pid is $BASHPID
 EOF
 
         destination = "local/pid.sh"
-        perms       = "777"
+        perms       = "755"
         change_mode = "noop"
       }
 
       resources {
-        cpu    = 100
+        cpu    = 10
         memory = 64
       }
     }
diff --git a/e2e/isolation/pids.go b/e2e/isolation/pids.go
deleted file mode 100644
index 3e6c2fdf1..000000000
--- a/e2e/isolation/pids.go
+++ /dev/null
@@ -1,304 +0,0 @@
-// Copyright (c) HashiCorp, Inc.
-// SPDX-License-Identifier: MPL-2.0
-
-package isolation
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/hashicorp/nomad/api"
-	"github.com/hashicorp/nomad/e2e/e2eutil"
-	"github.com/hashicorp/nomad/e2e/framework"
-	"github.com/hashicorp/nomad/helper/uuid"
-	"github.com/stretchr/testify/require"
-)
-
-type PIDsNamespacing struct {
-	framework.TC
-
-	jobIDs []string
-}
-
-func init() {
-	framework.AddSuites(&framework.TestSuite{
-		Component:   "PIDS",
-		CanRunLocal: true,
-		Cases: []framework.TestCase{
-			new(PIDsNamespacing),
-		},
-	})
-}
-
-func (tc *PIDsNamespacing) BeforeAll(f *framework.F) {
-	t := f.T()
-	e2eutil.WaitForLeader(t, tc.Nomad())
-	e2eutil.WaitForNodesReady(t, tc.Nomad(), 1)
-}
-
-func (tc *PIDsNamespacing) TestIsolation_ExecDriver_PIDNamespacing(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/exec.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	tc.jobIDs = append(tc.jobIDs, jobID)
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocStopped(t, tc.Nomad(), allocID)
-
-	out, err := e2eutil.AllocLogs(allocID, "", e2eutil.LogsStdOut)
-	require.NoError(t, err, fmt.Sprintf("could not get logs for alloc %s", allocID))
-
-	require.Contains(t, out, "my pid is 1\n")
-}
-
-func (tc *PIDsNamespacing) TestIsolation_ExecDriver_PIDNamespacing_host(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/exec_host.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	tc.jobIDs = append(tc.jobIDs, jobID)
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocStopped(t, tc.Nomad(), allocID)
-
-	out, err := e2eutil.AllocLogs(allocID, "", e2eutil.LogsStdOut)
-	require.NoError(t, err, fmt.Sprintf("could not get logs for alloc %s", allocID))
-
-	require.NotContains(t, out, "my pid is 1\n")
-}
-
-func (tc *PIDsNamespacing) TestIsolation_ExecDriver_PIDNamespacing_AllocExec(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/alloc_exec.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocRunning(t, tc.Nomad(), allocID)
-
-	alloc, _, err := tc.Nomad().Allocations().Info(allocID, nil)
-	require.NoError(t, err)
-	require.NotNil(t, alloc)
-
-	resizeCh := make(chan api.TerminalSize)
-	var tty bool
-
-	ctx, cancelFn := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancelFn()
-
-	var stdout, stderr bytes.Buffer
-
-	exitCode, err := tc.Nomad().Allocations().Exec(
-		ctx,
-		alloc,
-		"main",
-		tty,
-		[]string{"ps", "ax"},
-		bytes.NewReader([]byte("")),
-		&stdout,
-		&stderr,
-		resizeCh,
-		nil,
-	)
-	require.NoError(t, err)
-	require.Equal(t, 0, exitCode)
-
-	lines := strings.Split(strings.TrimSpace(stdout.String()), "\n")
-	// header, sleep process, ps ax process are the only output lines expected
-	require.Len(t, lines, 3)
-}
-
-func (tc *PIDsNamespacing) TestIsolation_JavaDriver_PIDNamespacing(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/java.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	tc.jobIDs = append(tc.jobIDs, jobID)
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocStopped(t, tc.Nomad(), allocID)
-
-	out, err := e2eutil.AllocTaskLogs(allocID, "pid", e2eutil.LogsStdOut)
-	require.NoError(t, err, fmt.Sprintf("could not get logs for alloc %s", allocID))
-
-	require.Contains(t, out, "my pid is 1\n")
-}
-
-func (tc *PIDsNamespacing) TestIsolation_JavaDriver_PIDNamespacing_host(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/java_host.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	tc.jobIDs = append(tc.jobIDs, jobID)
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocStopped(t, tc.Nomad(), allocID)
-
-	out, err := e2eutil.AllocTaskLogs(allocID, "pid", e2eutil.LogsStdOut)
-	require.NoError(t, err, fmt.Sprintf("could not get logs for alloc %s", allocID))
-
-	require.NotContains(t, out, "my pid is 1\n")
-}
-
-func (tc *PIDsNamespacing) TestIsolation_JavaDriver_PIDNamespacing_AllocExec(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/alloc_exec_java.nomad"
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocTaskRunning(t, tc.Nomad(), allocID, "sleep")
-
-	alloc, _, err := tc.Nomad().Allocations().Info(allocID, nil)
-	require.NoError(t, err)
-	require.NotNil(t, alloc)
-
-	resizeCh := make(chan api.TerminalSize)
-	var tty bool
-
-	ctx, cancelFn := context.WithTimeout(context.Background(), 15*time.Second)
-	defer cancelFn()
-
-	var stdout, stderr bytes.Buffer
-
-	exitCode, err := tc.Nomad().Allocations().Exec(
-		ctx,
-		alloc,
-		"sleep",
-		tty,
-		[]string{"ps", "ax"},
-		bytes.NewReader([]byte("")),
-		&stdout,
-		&stderr,
-		resizeCh,
-		nil,
-	)
-	require.NoError(t, err)
-	require.Equal(t, 0, exitCode)
-
-	lines := strings.Split(strings.TrimSpace(stdout.String()), "\n")
-	// header, sleep process, ps ax process are the only output lines expected
-	require.Len(t, lines, 3)
-}
-
-func (tc *PIDsNamespacing) TestIsolation_RawExecDriver_NoPIDNamespacing(f *framework.F) {
-	t := f.T()
-
-	clientNodes, err := e2eutil.ListLinuxClientNodes(tc.Nomad())
-	require.Nil(t, err)
-
-	if len(clientNodes) == 0 {
-		t.Skip("no Linux clients")
-	}
-
-	jobID := "isolation-pid-namespace-" + uuid.Short()
-	file := "isolation/input/raw_exec.nomad"
-
-	allocs := e2eutil.RegisterAndWaitForAllocs(t, tc.Nomad(), file, jobID, "")
-	require.Equal(t, len(allocs), 1, fmt.Sprintf("failed to register %s", jobID))
-
-	defer func() {
-		_, _, err = tc.Nomad().Jobs().Deregister(jobID, true, nil)
-		require.NoError(t, err)
-	}()
-
-	allocID := allocs[0].ID
-	e2eutil.WaitForAllocStopped(t, tc.Nomad(), allocID)
-
-	out, err := e2eutil.AllocLogs(allocID, "", e2eutil.LogsStdOut)
-	require.NoError(t, err, fmt.Sprintf("could not get logs for alloc %s", allocID))
-
-	var pid uint64
-	_, err = fmt.Sscanf(out, "my pid is %d", &pid)
-	require.NoError(t, err)
-
-	require.Greater(t, pid, uint64(1))
-}
diff --git a/e2e/isolation/pids_test.go b/e2e/isolation/pids_test.go
new file mode 100644
index 000000000..cddd1f5c9
--- /dev/null
+++ b/e2e/isolation/pids_test.go
@@ -0,0 +1,118 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package isolation
+
+import (
+	"regexp"
+	"strings"
+	"testing"
+
+	"github.com/hashicorp/nomad/e2e/v3/cluster3"
+	"github.com/hashicorp/nomad/e2e/v3/jobs3"
+	"github.com/shoenig/test/must"
+)
+
+func TestPIDs(t *testing.T) {
+	cluster3.Establish(t,
+		cluster3.Leader(),
+		cluster3.LinuxClients(1),
+	)
+
+	// exec driver
+	t.Run("testExecNamespacePID", testExecNamespacePID)
+	t.Run("testExecHostPID", testExecHostPID)
+	t.Run("testExecNamespaceAllocExec", testExecNamespaceAllocExec)
+
+	// java driver
+	t.Run("testJavaNamespacePID", testJavaNamespacePID)
+	t.Run("testJavaHostPID", testJavaHostPID)
+	t.Run("testJavaNamespaceAllocExec", testJavaNamespaceAllocExec)
+
+	// raw_exec driver
+	t.Run("testRawExecNoNamespacePID", testRawExecNoNamespacePID)
+}
+
+var (
+	pidRe = regexp.MustCompile(`my pid is (\d+)`)
+)
+
+func testExecNamespacePID(t *testing.T) {
+	job, cleanup := jobs3.Submit(t,
+		"./input/exec.hcl",
+		jobs3.WaitComplete("group"),
+	)
+	t.Cleanup(cleanup)
+
+	logs := job.TaskLogs("group", "bash")
+	must.StrContains(t, logs.Stdout, "my pid is 1")
+}
+
+func testExecHostPID(t *testing.T) {
+	job, cleanup := jobs3.Submit(t,
+		"./input/exec_host.hcl",
+		jobs3.WaitComplete("group"),
+	)
+	t.Cleanup(cleanup)
+
+	logs := job.TaskLogs("group", "bash")
+	subs := pidRe.FindStringSubmatch(logs.Stdout)
+	must.SliceLen(t, 2, subs)
+	must.NotEq(t, "1", subs[1], must.Sprint("expected any pid other than 1"))
+}
+
+func testExecNamespaceAllocExec(t *testing.T) {
+	job, cleanup := jobs3.Submit(t, "./input/alloc_exec.hcl")
+	t.Cleanup(cleanup)
+
+	logs := job.Exec("group", "sleep", []string{"ps", "ax"})
+	lines := strings.Split(strings.TrimSpace(logs.Stdout), "\n")
+
+	// header, sleep, ps (and nothing else)
+	must.SliceLen(t, 3, lines, must.Sprintf("expected 3 lines of output, got %s", lines))
+}
+
+func testJavaNamespacePID(t *testing.T) {
+	job, cleanup := jobs3.Submit(t,
+		"./input/java.hcl",
+		jobs3.WaitComplete("group"),
+	)
+	t.Cleanup(cleanup)
+
+	logs := job.TaskLogs("group", "java")
+	must.StrContains(t, logs.Stdout, "my pid is 1")
+}
+
+func testJavaHostPID(t *testing.T) {
+	job, cleanup := jobs3.Submit(t,
+		"./input/java_host.hcl",
+		jobs3.WaitComplete("group"),
+	)
+	t.Cleanup(cleanup)
+
+	logs := job.TaskLogs("group", "java")
+	subs := pidRe.FindStringSubmatch(logs.Stdout)
+	must.SliceLen(t, 2, subs)
+	must.NotEq(t, "1", subs[1], must.Sprint("expected any pid other than 1"))
+}
+
+func testJavaNamespaceAllocExec(t *testing.T) {
+	job, cleanup := jobs3.Submit(t, "./input/alloc_exec_java.hcl")
+	t.Cleanup(cleanup)
+
+	logs := job.Exec("group", "sleep", []string{"ps", "ax"})
+	lines := strings.Split(strings.TrimSpace(logs.Stdout), "\n")
+
+	// header, java, ps (and nothing else)
+	must.SliceLen(t, 3, lines, must.Sprintf("expected 3 lines of output, got %s", lines))
+}
+
+func testRawExecNoNamespacePID(t *testing.T) {
+	job, cleanup := jobs3.Submit(t, "./input/raw_exec.hcl")
+	t.Cleanup(cleanup)
+
+	logs := job.TaskLogs("group", "bash")
+	subs := pidRe.FindStringSubmatch(logs.Stdout)
+	must.SliceLen(t, 2, subs)
+	must.NotEq(t, "1", subs[1], must.Sprint("expected any pid other than 1"))
+}
diff --git a/e2e/v3/jobs3/allocexec3.go b/e2e/v3/jobs3/allocexec3.go
new file mode 100644
index 000000000..e9427fdd3
--- /dev/null
+++ b/e2e/v3/jobs3/allocexec3.go
@@ -0,0 +1,70 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package jobs3
+
+import (
+	"bytes"
+	"context"
+	"io"
+
+	nomadapi "github.com/hashicorp/nomad/api"
+	"github.com/shoenig/test/must"
+)
+
+// Exec executes cmd in the given task of a random allocation of the given
+// group.
+func (sub *Submission) Exec(group, task string, cmd []string) Logs {
+	queryOpts := sub.queryOptions()
+	jobsAPI := sub.nomadClient.Jobs()
+	stubs, _, err := jobsAPI.Allocations(sub.jobID, false, queryOpts)
+	must.NoError(sub.t, err, must.Sprintf("failed to query allocations for %s", group))
+
+	var allocID string
+	for _, stub := range stubs {
+		if stub.TaskGroup == group {
+			allocID = stub.ID
+			break
+		}
+	}
+	must.NotEq(sub.t, "", allocID, must.Sprintf("no allocation found for %s", group))
+
+	// do stuff
+	allocsAPI := sub.nomadClient.Allocations()
+	alloc, _, err := allocsAPI.Info(allocID, queryOpts)
+	must.NoError(sub.t, err, must.Sprintf("failed to query allocation %s", allocID))
+
+	var (
+		stdout   bytes.Buffer
+		stderr   bytes.Buffer
+		input    io.Reader = bytes.NewReader(nil)
+		tty      bool
+		resizeCh chan (nomadapi.TerminalSize) = make(chan (nomadapi.TerminalSize))
+	)
+
+	ctx, cancel := context.WithTimeout(context.Background(), sub.timeout)
+	defer cancel()
+
+	sub.logf("alloc exec %s in %s/%s, id: %s", cmd, group, task, allocID)
+	exitCode, err := allocsAPI.Exec(
+		ctx,
+		alloc,
+		task,
+		tty,
+		cmd,
+		input,
+		&stdout,
+		&stderr,
+		resizeCh,
+		queryOpts,
+	)
+	sub.logf("alloc exec exit code: %d in: %s", exitCode, allocID)
+
+	must.NoError(sub.t, err, must.Sprintf("failed to exec cmd %q in %s/%s (%s)", cmd, group, task, allocID))
+	must.Zero(sub.t, exitCode, must.Sprintf("expected success exit code executing %s in %s/%s %s", cmd, group, task, allocID))
+
+	return Logs{
+		Stdout: stdout.String(),
+		Stderr: stderr.String(),
+	}
+}