[
https://issues.apache.org/jira/browse/YARN-10867?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17384623#comment-17384623
]
Chi Heng commented on YARN-10867:
---------------------------------
Hi [~ebadger]
First,regardless of security issues,{{YARN_CONTAINER_RUNTIME_DOCKER_MOUNTS will
be turned to an -v arg when docker container starts(docker do this using Linux
binding mount).I suppose it is not suitable for /dev/fuse,GPU,RDMA or other
devices.Actually I tried to mount device as a volume into docker,but the device
cant't be used in container.}}
And back to security issues, actually I just need some docker capabilites like
'SYS_ADMIN' .But since I can't mount a device into container,I had to request a
privileged docker container to complete this job ('–privileged'),where devices
is inluded by default.Thus the problem became complex.The privileged container
runs with root user,so the log aggregation can't work normally.And the user
which submitted the application is used to call the docker command, so I had to
add all non-privileged user into docker group .
I suppose it is not a good idea using privileged container to complete this
job, expose an new ENV like '{{YARN_CONTAINER_RUNTIME_DOCKER_DEVICES}}' may be
a better option
> YARN should expose a ENV used to map a custom device into docker container
> --------------------------------------------------------------------------
>
> Key: YARN-10867
> URL: https://issues.apache.org/jira/browse/YARN-10867
> Project: Hadoop YARN
> Issue Type: Improvement
> Reporter: Chi Heng
> Priority: Major
>
> In some scenarios, like mounting a FUSE in docker,user needs to map a custom
> device (eg. /dev/fuse) into docker container.I notice that an adddevice
> method is defined in [
> hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/docker/DockerRunCommand.java
>
> |https://github.com/apache/hadoop/blob/trunk/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/docker/DockerRunCommand.java]
> ,I suppose that an ENV or config property should to be exposed to user to
> call this method
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscr...@hadoop.apache.org
For additional commands, e-mail: yarn-issues-h...@hadoop.apache.org
