James Peach created MESOS-8213:
----------------------------------
Summary: Private user namespaces for tasks
Key: MESOS-8213
URL: https://issues.apache.org/jira/browse/MESOS-8213
Project: Mesos
Issue Type: Improvement
Components: containerization, security
Reporter: James Peach
Once MESOS-8142 implements generic user namespace support, we can improve
security by adding another layer of user namespace that encapsulates just the
final user task. This protects the kernel objects that are providing the
containerization from the user task (since the private task namespace would no
longer own the other namespaces).
This still would not alter the ID mapping of the user namespace.
This is a little tricky since we need to make the new namespace in the mess
containerizer, so we need to take care of:
* when to chroot
* when to drop capabilities after entering the new namespace
* supporting command, default and custom executors (does the latter make sense?)
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
