[ https://issues.apache.org/jira/browse/MESOS-7476?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16023909#comment-16023909 ]
James Peach commented on MESOS-7476: ------------------------------------ | [https://reviews.apache.org/r/59547/|https://reviews.apache.org/r/59547/] | Rename ContainerLaunchInfo `capabilities` field.| | [https://reviews.apache.org/r/59548/|https://reviews.apache.org/r/59548/] | Add a `bounding_capabilities` field to ContainerLaunchInfo.| | [https://reviews.apache.org/r/59549/|https://reviews.apache.org/r/59549/] | Add the agent --bounding_capabilities flag.| | [https://reviews.apache.org/r/59550/|https://reviews.apache.org/r/59550/] |Check bounding capabilities at isolator creation time | | [https://reviews.apache.org/r/59551/|https://reviews.apache.org/r/59551/] |Change launcher working directory before dropping privilege. | | [https://reviews.apache.org/r/59552/|https://reviews.apache.org/r/59552/] | Add support for explicitly setting bounding capabilities. | > Restrict capabilities to only the bounding set. > ----------------------------------------------- > > Key: MESOS-7476 > URL: https://issues.apache.org/jira/browse/MESOS-7476 > Project: Mesos > Issue Type: Bug > Components: containerization > Reporter: James Peach > Assignee: James Peach > > As a security improvement, it would be useful to be able to set the bounding > capability set without also granting those capabilities. This is what the > {{--allowed_capabilities}} flag sounds like it does. -- This message was sent by Atlassian JIRA (v6.3.15#6346)