[
https://issues.apache.org/jira/browse/YARN-6623?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Varun Vasudev updated YARN-6623:
--------------------------------
Attachment: YARN-6623.001.patch
First cut of the patch. It's big because it moves a bunch of functionality into
the container-executor and the subsequent refactor on the java code has a lot
of changes.
At a high level, the changes are -
1. Move the Docker command construction into the
container-executor(docker-util.c)
2. The NM passes a file with params to the container-executor instead of a file
containing the commands.
3. Added controls in container-executor.cfg to explicitly allow capabilities,
mount directories, mount devices, and allowed networks. By default, nothing is
allowed.
4. Added a control in container-executor to disable privileged containers.
[~shaneku...@gmail.com], [~miklos.szeg...@cloudera.com], [~ebadger],
[~leftnoteasy] - can you please take a look?
Thanks!
> Add support to turn off launching privileged containers in the
> container-executor
> ---------------------------------------------------------------------------------
>
> Key: YARN-6623
> URL: https://issues.apache.org/jira/browse/YARN-6623
> Project: Hadoop YARN
> Issue Type: Sub-task
> Components: nodemanager
> Reporter: Varun Vasudev
> Assignee: Varun Vasudev
> Priority: Blocker
> Attachments: YARN-6623.001.patch
>
>
> Currently, launching privileged containers is controlled by the NM. We should
> add a flag to the container-executor.cfg allowing admins to disable launching
> privileged containers at the container-executor level.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
