[MESOS-2999] Implement a linux/iptables isolator

• Type: Story
• Status: Accepted
• Priority: Major
• Resolution: Unresolved
• Component/s: containerization
• Labels: security
• Assignee: Unassigned
• Reporter: Stephan Erb
• Created: 07/Jul/15 17:32
• Updated: 26/Apr/17 16:54

Description

As a user of Mesos, I would like to have control over inbound and outbound network communication of a launched Mesos container. The intention is to gain improved security and isolation of user processes on the network level.

Example Usecases:

• Preventing outgoing connections to external endpoints which have not been whitelisted (e.g., deny internet connections, only allow connections to this one production database but not the others, ...)
• Prevent incoming connections from external systems or containers which have not been whitelisted (e.g., don't allow a rough or even hijacked services to interfere with another service)

The last usecase is somewhat tricky due to the dynamic nature of a Mesos cluster but might be achieved using the available DiscoveryInfo (e.g., block all connections from foreign environments).

Issue Links

• relates to: MESOS-2044 Use one IP address per container for network isolation