[ https://issues.apache.org/jira/browse/YARN-7197?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16167123#comment-16167123 ]
Eric Yang commented on YARN-7197: --------------------------------- [~ebadger] This is similar to firewall rules. We need a way to define ACCEPTED and REJECTED rules. White list could be cumbersome to express an exhaustive list of mount points sometimes. If there are a lot of paths intermixed by a lot of allow list, and few of black list path. For example, if a system admin would like to allow mounting of /mnt/hdfs/user/${USER} but not /mnt/hdfs/user/yarn using nfs gateway. White list can not express the proper constraints alone. If white list has some smarts to define if condition, black list might not be necessary. > Add support for a volume blacklist for docker containers > -------------------------------------------------------- > > Key: YARN-7197 > URL: https://issues.apache.org/jira/browse/YARN-7197 > Project: Hadoop YARN > Issue Type: Sub-task > Components: yarn > Reporter: Shane Kumpf > > Docker supports bind mounting host directories into containers. Work is > underway to allow admins to configure a whilelist of volume mounts. While > this is a much needed and useful feature, it opens the door for > misconfiguration that may lead to users being able to compromise or crash the > system. > One example would be allowing users to mount /run from a host running > systemd, and then running systemd in that container, rendering the host > mostly unusable. > This issue is to add support for a default blacklist. The default blacklist > would be where we put files and directories that if mounted into a container, > are likely to have negative consequences. Users are encouraged not to remove > items from the default blacklist, but may do so if necessary. -- This message was sent by Atlassian JIRA (v6.4.14#64029) --------------------------------------------------------------------- To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org