Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-6145

Isolator namespaces/pid is leaking mounts

    XMLWordPrintableJSON

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 1.1.0
    • Component/s: containerization, security
    • Labels:
      None

      Description

      As the operator of a Mesos cluster, I would like every container/executor to run in a single PID namespace, so that a task cannot see what else is running on the same host.

      The existing namespaces/pid isolator seems to provide this feature. However, it seems like it is leaking files. I have exactly one task running currently, but there are still left overs from earlier invocations

      vagrant@aurora:~/aurora$ ls -l /var/run/mesos/pidns/
      total 0
      -rw-r--r-- 1 root root 0 Aug 26 20:30 32b6e4c7-3d22-47ed-a350-9eb929daa241
      -rw-r--r-- 1 root root 0 Aug 26 20:30 7b812f00-4614-4016-a76c-ff78a175a1b0
      -rw-r--r-- 1 root root 0 Aug 26 20:24 d501829e-7cf8-40fb-a895-0ad3416da7dc
      -rw-r--r-- 1 root root 0 Aug 26 20:24 d56ca91f-eb72-426c-8bbb-f3239358a4ef
      -r--r--r-- 1 root root 0 Aug 26 20:35 fef9a109-de52-45f3-ae41-171de6495705
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                jieyu Jie Yu
                Reporter:
                StephanErb Stephan Erb
              • Votes:
                0 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: