message: fuzz: docs for local Docker workflow.
diff: @@ -82,3 +82,43 @@ DEFINE_PROTO_FUZZER(const MyMessageType& input) {
  // Your test code goes here
  }
  ```
  +
  +## Running fuzz tests locally
  +
  +Within the Envoy repository, we have various `*_fuzz_test` targets. When run
  +under `bazel test`, these will exercise the corpus as inputs but not actually
  +link and run against any fuzzer (e.g.
  +[`libfuzzer`](https://llvm.org/docs/LibFuzzer.html)). The actual fuzzing is
  +performed by the [oss-fuzz](https://github.com/google/oss-fuzz) project, with
  +results provided on the [ClusterFuzz dashboard](https://oss-fuzz.com).
  +
  +It is possible to run against fuzzers locally by using the `oss-fuzz` Docker
  +image. This is recommended when writing new fuzz tests to check if they pick up
  +any low hanging fruit (i.e. what you can find on your local machine vs. the fuzz
  +cluster).
  +
  +1. `git clone https://github.com/google/oss-fuzz.git`
  +2. `cd oss-fuzz`
  +3. `python infra/helper.py build_image envoy`
  +4. `python infra/helper.py build_fuzzers --sanitizer=address envoy <path to
  + envoy source tree>`. The path to the Envoy source tree can be omitted if you
  + want to consume Envoy from GitHub at HEAD/master.
  +5. `python infra/helper.py run_fuzzer envoy <fuzz test target>`. The fuzz test
  + target will be the test name, e.g. `server_fuzz_test`.
  +
  +If there is a crash, `run_fuzzer` will emit a log line along the lines of:
  +
  +```
  +artifact_prefix='./'; Test unit written to ./crash-db2ee19f50162f2079dc0c5ba24fd0e3dcb8b9bc
  +```
  +
  +The test input can be found in `build/out/envoy`, e.g.
  +`build/out/envoy/crash-db2ee19f50162f2079dc0c5ba24fd0e3dcb8b9bc`. For protobuf
  +fuzz tests, this will be in text proto format.
  +
  +To test and validate fixes to the crash, add it to the corpus in the Envoy
  +source directory for the test, e.g. for `server_fuzz_test` this is
  +`test/server/corpus`, and run `bazel test`, e.g. `bazel test
  +//test/server:server_fuzz_test`. These crash cases can be added to the corpus in
  +followup PRs to provide fuzzers some interesting starting points for invalid
  +inputs.
  