[jira] [Updated] (YARN-7782) Enable user re-mapping for Docker containers in yarn-default.xml

[ https://issues.apache.org/jira/browse/YARN-7782?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7782: Description: In YARN-4266, the recommendation was to use -u [uid]:[gid] numeric values to enforce user and

[jira] [Commented] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16338055#comment-16338055 ] Eric Yang commented on YARN-7797: - Thank you for the review, [~billie.rinaldi] and [~shaneku...@gmail.com]. 

[jira] [Updated] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7797: Attachment: YARN-7797.002.patch > Docker host network can not obtain IP address for RegistryDNS >

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16338078#comment-16338078 ] Eric Yang commented on YARN-7516: - Patch 15 fixed the white space. > Security check for untrusted docker

[jira] [Updated] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7516: Attachment: YARN-7516.015.patch > Security check for untrusted docker image >

[jira] [Commented] (YARN-7810) TestDockerContainerRuntime test failures due to UID lookup of a non-existent user

[ https://issues.apache.org/jira/browse/YARN-7810?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16338442#comment-16338442 ] Eric Yang commented on YARN-7810: - Overall, the patch looks good.  One small nitpick, we can use

[jira] [Updated] (YARN-7829) Rebalance UI2 cluster overview page

[ https://issues.apache.org/jira/browse/YARN-7829?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7829: Environment: (was: The cluster overview page looks like a upside down triangle.  It would be nice to

[jira] [Created] (YARN-7829) Rebalance UI2 cluster overview page

Eric Yang created YARN-7829: --- Summary: Rebalance UI2 cluster overview page Key: YARN-7829 URL: https://issues.apache.org/jira/browse/YARN-7829 Project: Hadoop YARN Issue Type: Bug

***UNCHECKED*** [jira] [Updated] (YARN-7829) Rebalance UI2 cluster overview page

[ https://issues.apache.org/jira/browse/YARN-7829?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7829: Attachment: ui2-cluster-overview.png > Rebalance UI2 cluster overview page >

[jira] [Updated] (YARN-7829) Rebalance UI2 cluster overview page

[ https://issues.apache.org/jira/browse/YARN-7829?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7829: Description: The cluster overview page looks like a upside down triangle.  It would be nice to rebalance the

[jira] [Updated] (YARN-7829) Rebalance UI2 cluster overview page

[ https://issues.apache.org/jira/browse/YARN-7829?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7829: Description: The cluster overview page looks like a upside down triangle.  It would be nice to rebalance the

[jira] [Updated] (YARN-7605) Implement doAs for Api Service REST API

[ https://issues.apache.org/jira/browse/YARN-7605?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7605: Attachment: YARN-7605.017.patch > Implement doAs for Api Service REST API >

[jira] [Commented] (YARN-7605) Implement doAs for Api Service REST API

[ https://issues.apache.org/jira/browse/YARN-7605?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16329851#comment-16329851 ] Eric Yang commented on YARN-7605: - Found a bug in registry DNS security, it doesn't handle simple security,

[jira] [Commented] (YARN-7590) Improve container-executor validation check

[ https://issues.apache.org/jira/browse/YARN-7590?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16325345#comment-16325345 ] Eric Yang commented on YARN-7590: - [~miklos.szeg...@cloudera.com] Sure, I'll add 2.x patches on Tuesday. >

[jira] [Commented] (YARN-7810) TestDockerContainerRuntime test failures due to UID lookup of a non-existent user

[ https://issues.apache.org/jira/browse/YARN-7810?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16338625#comment-16338625 ] Eric Yang commented on YARN-7810: - +1 looks good.  I just committed this.  Thank you Shane. >

[jira] [Updated] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7797: Attachment: YARN-7797.003.patch > Docker host network can not obtain IP address for RegistryDNS >

[jira] [Commented] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16339484#comment-16339484 ] Eric Yang commented on YARN-7797: - Unit test failure was fixed in YARN-7810.  Patch 003 fixed checkstyle,

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16339487#comment-16339487 ] Eric Yang commented on YARN-7516: - Unit test failure is not related to this patch.  The cause was by

[jira] [Commented] (YARN-7787) Yarn service can not be launched with User Principal

[ https://issues.apache.org/jira/browse/YARN-7787?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16340186#comment-16340186 ] Eric Yang commented on YARN-7787: - YARN Service code contains one implementation of ApplicationMaster code

[jira] [Updated] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7516: Summary: Security check for trusted docker image (was: Security check for untrusted docker image) >

[jira] [Updated] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7797: Attachment: YARN-7797.004.patch > Docker host network can not obtain IP address for RegistryDNS >

[jira] [Updated] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7797: Attachment: YARN-7797.005.patch > Docker host network can not obtain IP address for RegistryDNS >

[jira] [Commented] (YARN-7797) Docker host network can not obtain IP address for RegistryDNS

[ https://issues.apache.org/jira/browse/YARN-7797?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16340362#comment-16340362 ] Eric Yang commented on YARN-7797: - [~shaneku...@gmail.com] Thank you for the review.  Patch 005 includes

[jira] [Created] (YARN-7831) YARN Service CLI should use hadoop.http.authentication.type to determine authentication method

Eric Yang created YARN-7831: --- Summary: YARN Service CLI should use hadoop.http.authentication.type to determine authentication method Key: YARN-7831 URL: https://issues.apache.org/jira/browse/YARN-7831

[jira] [Commented] (YARN-7815) Mount the filecache as read-only in Docker containers

[ https://issues.apache.org/jira/browse/YARN-7815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16341836#comment-16341836 ] Eric Yang commented on YARN-7815: - What is the common usage for 3? > Mount the filecache as read-only in

[jira] [Commented] (YARN-7815) Mount the filecache as read-only in Docker containers

[ https://issues.apache.org/jira/browse/YARN-7815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16341835#comment-16341835 ] Eric Yang commented on YARN-7815: - I agree with [~miklos.szeg...@cloudera.com]'s view point that keeping

[jira] [Updated] (YARN-7831) YARN Service CLI should use hadoop.http.authentication.type to determine authentication method

[ https://issues.apache.org/jira/browse/YARN-7831?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7831: Attachment: YARN-7831.001.patch > YARN Service CLI should use hadoop.http.authentication.type to determine

[jira] [Assigned] (YARN-7831) YARN Service CLI should use hadoop.http.authentication.type to determine authentication method

[ https://issues.apache.org/jira/browse/YARN-7831?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang reassigned YARN-7831: --- Assignee: Eric Yang > YARN Service CLI should use hadoop.http.authentication.type to determine >

[jira] [Comment Edited] (YARN-7815) Mount the filecache as read-only in Docker containers

[ https://issues.apache.org/jira/browse/YARN-7815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16341836#comment-16341836 ] Eric Yang edited comment on YARN-7815 at 1/27/18 12:16 AM: --- What is the common

[jira] [Commented] (YARN-7731) RegistryDNS should handle upstream DNS returning CNAME

[ https://issues.apache.org/jira/browse/YARN-7731?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16324378#comment-16324378 ] Eric Yang commented on YARN-7731: - [~billie.rinaldi] Thanks Billie. > RegistryDNS should handle upstream

[jira] [Assigned] (YARN-7654) Support ENTRY_POINT for docker container

[ https://issues.apache.org/jira/browse/YARN-7654?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang reassigned YARN-7654: --- Assignee: Shane Kumpf > Support ENTRY_POINT for docker container >

[jira] [Commented] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16324453#comment-16324453 ] Eric Yang commented on YARN-7221: - Can someone review this patch? Thanks > Add security check for

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16324568#comment-16324568 ] Eric Yang commented on YARN-7516: - [~ebadger] Thanks for the review. {quote} To be consistent with the

[jira] [Updated] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7516: Attachment: YARN-7516.009.patch - Clean up how trusted image is checked. - Disable ability to

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16323102#comment-16323102 ] Eric Yang commented on YARN-7516: - The output looks weird showing all disk devices from host when I assumed

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16323213#comment-16323213 ] Eric Yang commented on YARN-7516: - [~ebadger] We can go with remove --prilvileged, and allow the container

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16323175#comment-16323175 ] Eric Yang commented on YARN-7516: - This is quite concerning. I also verified that {{privileged}} flag and

[jira] [Updated] (YARN-7731) RegistryDNS should handle upstream DNS returning CNAME

[ https://issues.apache.org/jira/browse/YARN-7731?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7731: Attachment: YARN-7731.002.patch - Fixed test case accuracy to verify existence of A record instead of

[jira] [Commented] (YARN-7590) Improve container-executor validation check

[ https://issues.apache.org/jira/browse/YARN-7590?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322755#comment-16322755 ] Eric Yang commented on YARN-7590: - [~miklos.szeg...@cloudera.com] Thank you for the review and commit. :)

[jira] [Commented] (YARN-7605) Implement doAs for Api Service REST API

[ https://issues.apache.org/jira/browse/YARN-7605?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322767#comment-16322767 ] Eric Yang commented on YARN-7605: - [~billie.rinaldi] Thank you for the input. I will revert the code to

[jira] [Comment Edited] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322876#comment-16322876 ] Eric Yang edited comment on YARN-7516 at 1/11/18 8:15 PM: -- [~ebadger]

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322693#comment-16322693 ] Eric Yang commented on YARN-7516: - [~ebadger] Thanks for the review. The untrusted image will appear as

[jira] [Comment Edited] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322956#comment-16322956 ] Eric Yang edited comment on YARN-7516 at 1/11/18 9:18 PM: -- [~ebadger] In

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322956#comment-16322956 ] Eric Yang commented on YARN-7516: - [~ebadger] In

[jira] [Commented] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322876#comment-16322876 ] Eric Yang commented on YARN-7516: - [~ebadger] {{--privileged --cap-drop='ALL'}} will not have /dev/shm, and

[jira] [Comment Edited] (YARN-7516) Security check for untrusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16322693#comment-16322693 ] Eric Yang edited comment on YARN-7516 at 1/11/18 6:22 PM: -- [~ebadger] Thanks for

[jira] [Updated] (YARN-7605) Implement doAs for Api Service REST API

[ https://issues.apache.org/jira/browse/YARN-7605?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7605: Attachment: YARN-7605.016.patch - Revert changes to ServiceClient. > Implement doAs for Api Service REST

[jira] [Updated] (YARN-7731) RegistryDNS should handle upstream DNS returning CNAME

[ https://issues.apache.org/jira/browse/YARN-7731?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7731: Attachment: YARN-7731.003.patch - Added detection to prevent infinite recursive lookup for cname records. >

[jira] [Commented] (YARN-7815) Mount the filecache as read-only in Docker containers

[ https://issues.apache.org/jira/browse/YARN-7815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16344071#comment-16344071 ] Eric Yang commented on YARN-7815: - [~miklos.szeg...@cloudera.com] It will be hard to enforce read-only to

[jira] [Commented] (YARN-7829) Rebalance UI2 cluster overview page

[ https://issues.apache.org/jira/browse/YARN-7829?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16343819#comment-16343819 ] Eric Yang commented on YARN-7829: - [~GergelyNovak] Thank you for the patch.  The dashboard looks better

[jira] [Commented] (YARN-7816) YARN Service - Two different users are unable to launch a service of the same name

[ https://issues.apache.org/jira/browse/YARN-7816?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16346031#comment-16346031 ] Eric Yang commented on YARN-7816: - ServiceClient is performed in doAs call, using

[jira] [Commented] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16346116#comment-16346116 ] Eric Yang commented on YARN-7516: - [~shaneku...@gmail.com] Thank you for the review. When using the double

[jira] [Updated] (YARN-7811) Service AM should use configured default docker network

[ https://issues.apache.org/jira/browse/YARN-7811?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7811: Affects Version/s: 3.1.0 Target Version/s: 3.1.0 Fix Version/s: 3.1.0 Component/s:

[jira] [Commented] (YARN-7827) Stop and Delete Yarn Service from RM UI fails with HTTP ERROR 404

[ https://issues.apache.org/jira/browse/YARN-7827?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16345973#comment-16345973 ] Eric Yang commented on YARN-7827: - User.name shouldn't be hard code to dr.who.  The end username should be

[jira] [Commented] (YARN-7879) NM user is unable to access the application filecache due to permissions

[ https://issues.apache.org/jira/browse/YARN-7879?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16350775#comment-16350775 ] Eric Yang commented on YARN-7879: - Are we conformable in assuming all files in filecache are world

[jira] [Commented] (YARN-7868) Provide improved error message when YARN service is disabled

[ https://issues.apache.org/jira/browse/YARN-7868?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16350632#comment-16350632 ] Eric Yang commented on YARN-7868: - [~csingh] Thank you for reviewing the patch. [~jianhe] Thanks for the

[jira] [Commented] (YARN-7868) Provide improved error message when YARN service is disabled

[ https://issues.apache.org/jira/browse/YARN-7868?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16350851#comment-16350851 ] Eric Yang commented on YARN-7868: - [~jianhe] Thank you for the commit. > Provide improved error message

[jira] [Commented] (YARN-7879) NM user is unable to access the application filecache due to permissions

[ https://issues.apache.org/jira/browse/YARN-7879?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16350981#comment-16350981 ] Eric Yang commented on YARN-7879: - [~jlowe] Thank you for the reply. We are allowing file cache to be

[jira] [Created] (YARN-7882) Server side proxy for UI2 log viewer

Eric Yang created YARN-7882: --- Summary: Server side proxy for UI2 log viewer Key: YARN-7882 URL: https://issues.apache.org/jira/browse/YARN-7882 Project: Hadoop YARN Issue Type: Bug

[jira] [Commented] (YARN-7572) Make the service status output more readable

[ https://issues.apache.org/jira/browse/YARN-7572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16350994#comment-16350994 ] Eric Yang commented on YARN-7572: - Num Container, State and Lifetime on the Service line seems to have

[jira] [Assigned] (YARN-7889) Missing kerberos token when check for RM REST API availability

[ https://issues.apache.org/jira/browse/YARN-7889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang reassigned YARN-7889: --- Assignee: Eric Yang > Missing kerberos token when check for RM REST API availability >

[jira] [Updated] (YARN-7889) Missing kerberos token when check for RM REST API availability

[ https://issues.apache.org/jira/browse/YARN-7889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7889: Attachment: YARN-7889.001.patch > Missing kerberos token when check for RM REST API availability >

[jira] [Created] (YARN-7889) Missing kerberos token when check for RM REST API availability

Eric Yang created YARN-7889: --- Summary: Missing kerberos token when check for RM REST API availability Key: YARN-7889 URL: https://issues.apache.org/jira/browse/YARN-7889 Project: Hadoop YARN

[jira] [Commented] (YARN-7879) NM user is unable to access the application filecache due to permissions

[ https://issues.apache.org/jira/browse/YARN-7879?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16351083#comment-16351083 ] Eric Yang commented on YARN-7879: - {quote} The only way I can see it being an issue specific to Docker is

[jira] [Created] (YARN-7884) Race condition in registering YARN service in ZooKeeper

Eric Yang created YARN-7884: --- Summary: Race condition in registering YARN service in ZooKeeper Key: YARN-7884 URL: https://issues.apache.org/jira/browse/YARN-7884 Project: Hadoop YARN Issue Type:

[jira] [Commented] (YARN-7572) Make the service status output more readable

[ https://issues.apache.org/jira/browse/YARN-7572?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=1635#comment-1635 ] Eric Yang commented on YARN-7572: - [~vinodkv] I saw the proposal, but I think performatted JSON is the

[jira] [Commented] (YARN-7884) Race condition in registering YARN service in ZooKeeper

[ https://issues.apache.org/jira/browse/YARN-7884?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16351175#comment-16351175 ] Eric Yang commented on YARN-7884: - ServiceScheduler sets znode /registry/users/hbase/services/yarn-service

[jira] [Updated] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7516: Attachment: YARN-7516.016.patch > Security check for trusted docker image >

[jira] [Commented] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349150#comment-16349150 ] Eric Yang commented on YARN-7516: - - Patch 16 drops launch command for untrusted image. - For now, drop all

[jira] [Commented] (YARN-7446) Docker container privileged mode and --user flag contradict each other

[ https://issues.apache.org/jira/browse/YARN-7446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349008#comment-16349008 ] Eric Yang commented on YARN-7446: - [~shaneku...@gmail.com] It would be better to leave --user 0:0 out for

[jira] [Comment Edited] (YARN-7446) Docker container privileged mode and --user flag contradict each other

[ https://issues.apache.org/jira/browse/YARN-7446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349008#comment-16349008 ] Eric Yang edited comment on YARN-7446 at 2/1/18 6:00 PM: - [~shaneku...@gmail.com]

[jira] [Commented] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=1634#comment-1634 ] Eric Yang commented on YARN-7221: - [~shaneku...@gmail.com] How about get this in, and community can

[jira] [Comment Edited] (YARN-7862) YARN native service REST endpoint needs user.name as query param

[ https://issues.apache.org/jira/browse/YARN-7862?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347189#comment-16347189 ] Eric Yang edited comment on YARN-7862 at 1/31/18 5:32 PM: -- Hi [~sunilg], YARN

[jira] [Resolved] (YARN-7862) YARN native service REST endpoint needs user.name as query param

[ https://issues.apache.org/jira/browse/YARN-7862?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang resolved YARN-7862. - Resolution: Not A Bug > YARN native service REST endpoint needs user.name as query param >

[jira] [Commented] (YARN-7862) YARN native service REST endpoint needs user.name as query param

[ https://issues.apache.org/jira/browse/YARN-7862?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347248#comment-16347248 ] Eric Yang commented on YARN-7862: - [~sunilg] I don't think we ever said user.name is mandatory. In the

[jira] [Commented] (YARN-7862) YARN native service REST endpoint needs user.name as query param

[ https://issues.apache.org/jira/browse/YARN-7862?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347257#comment-16347257 ] Eric Yang commented on YARN-7862: - By the way, the above statements apply to AuthenticationFilter

[jira] [Commented] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347388#comment-16347388 ] Eric Yang commented on YARN-7516: - [~billie.rinaldi] [~shaneku...@gmail.com] How do we resolve the conflict

[jira] [Commented] (YARN-7815) Mount the filecache as read-only in Docker containers

[ https://issues.apache.org/jira/browse/YARN-7815?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347439#comment-16347439 ] Eric Yang commented on YARN-7815: - {quote} I think that leaves us with this proposal which should

[jira] [Commented] (YARN-7862) YARN native service REST endpoint needs user.name as query param

[ https://issues.apache.org/jira/browse/YARN-7862?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347189#comment-16347189 ] Eric Yang commented on YARN-7862: - Hi [~sunilg], YARN Native service rest api already support hadoop

[jira] [Comment Edited] (YARN-7446) Docker container privileged mode and --user flag contradict each other

[ https://issues.apache.org/jira/browse/YARN-7446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347300#comment-16347300 ] Eric Yang edited comment on YARN-7446 at 1/31/18 6:13 PM: -- Hi

[jira] [Commented] (YARN-7446) Docker container privileged mode and --user flag contradict each other

[ https://issues.apache.org/jira/browse/YARN-7446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347300#comment-16347300 ] Eric Yang commented on YARN-7446: - Hi [~shaneku...@gmail.com], to carry out the conversation on YARN-7516

[jira] [Commented] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349262#comment-16349262 ] Eric Yang commented on YARN-7221: - Rebased patch to current trunk. > Add security check for privileged

[jira] [Commented] (YARN-7677) Docker image cannot set HADOOP_CONF_DIR

[ https://issues.apache.org/jira/browse/YARN-7677?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349465#comment-16349465 ] Eric Yang commented on YARN-7677: - [~jlowe] I agree with [~billie.rinaldi] and YARN-5714 approach. The

[jira] [Commented] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16349474#comment-16349474 ] Eric Yang commented on YARN-7221: - The failed unit test is not related to this patch. > Add security check

[jira] [Updated] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7221: Attachment: YARN-7221.003.patch > Add security check for privileged docker container >

[jira] [Created] (YARN-7868) Provide improved error message when YARN service is disabled

Eric Yang created YARN-7868: --- Summary: Provide improved error message when YARN service is disabled Key: YARN-7868 URL: https://issues.apache.org/jira/browse/YARN-7868 Project: Hadoop YARN Issue

[jira] [Updated] (YARN-7868) Provide improved error message when YARN service is disabled

[ https://issues.apache.org/jira/browse/YARN-7868?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7868: Attachment: YARN-7868.001.patch > Provide improved error message when YARN service is disabled >

[jira] [Assigned] (YARN-7868) Provide improved error message when YARN service is disabled

[ https://issues.apache.org/jira/browse/YARN-7868?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang reassigned YARN-7868: --- Assignee: Eric Yang > Provide improved error message when YARN service is disabled >

[jira] [Created] (YARN-7867) Enable YARN service by default

Eric Yang created YARN-7867: --- Summary: Enable YARN service by default Key: YARN-7867 URL: https://issues.apache.org/jira/browse/YARN-7867 Project: Hadoop YARN Issue Type: Sub-task

[jira] [Commented] (YARN-7816) YARN Service - Two different users are unable to launch a service of the same name

[ https://issues.apache.org/jira/browse/YARN-7816?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347882#comment-16347882 ] Eric Yang commented on YARN-7816: - +1 looks good. I just committed this. Thank you [~gsaha]. > YARN

[jira] [Commented] (YARN-7446) Docker container privileged mode and --user flag contradict each other

[ https://issues.apache.org/jira/browse/YARN-7446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16347865#comment-16347865 ] Eric Yang commented on YARN-7446: - [~shaneku...@gmail.com] I understand that docker can run as user defined

[jira] [Commented] (YARN-7811) Service AM should use configured default docker network

[ https://issues.apache.org/jira/browse/YARN-7811?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16344318#comment-16344318 ] Eric Yang commented on YARN-7811: - +1 This patch works on my cluster.  I will commit this tomorrow if no

[jira] [Updated] (YARN-5366) Improve handling of the Docker container life cycle

[ https://issues.apache.org/jira/browse/YARN-5366?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-5366: Affects Version/s: 3.1.0 Target Version/s: 3.1.0 Fix Version/s: 3.1.0 > Improve handling of the

[jira] [Commented] (YARN-7221) Add security check for privileged docker container

[ https://issues.apache.org/jira/browse/YARN-7221?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16348116#comment-16348116 ] Eric Yang commented on YARN-7221: - [~shaneku...@gmail.com] [~ebadger] Thanks for the review. I agree with

[jira] [Commented] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16353102#comment-16353102 ] Eric Yang commented on YARN-7516: - - Added more test cases in patch 17. > Security check for trusted

[jira] [Commented] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16353125#comment-16353125 ] Eric Yang commented on YARN-7516: - Summary of the security check is reflected in the following table: || 

[jira] [Updated] (YARN-7889) Missing kerberos token when check for RM REST API availability

[ https://issues.apache.org/jira/browse/YARN-7889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7889: Attachment: YARN-7889.003.patch > Missing kerberos token when check for RM REST API availability >

[jira] [Updated] (YARN-7516) Security check for trusted docker image

[ https://issues.apache.org/jira/browse/YARN-7516?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7516: Attachment: YARN-7516.017.patch > Security check for trusted docker image >

[jira] [Updated] (YARN-7889) Missing kerberos token when check for RM REST API availability

[ https://issues.apache.org/jira/browse/YARN-7889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7889: Attachment: YARN-7889.003.patch > Missing kerberos token when check for RM REST API availability >

[jira] [Updated] (YARN-7889) Missing kerberos token when check for RM REST API availability

[ https://issues.apache.org/jira/browse/YARN-7889?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Eric Yang updated YARN-7889: Attachment: (was: YARN-7889.003.patch) > Missing kerberos token when check for RM REST API availability

<    4   5   6   7   8   9   10   11   12   13   >