[MESOS-6391] Command task's sandbox should not be owned by root if it uses container image.

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 0.28.2, 1.0.1
• Fix Version/s: 1.0.2, 1.1.0
• Labels: won't-backport
• Target Version/s: 1.0.2, 1.1.0
• Assignee: Jie Yu
• Reporter: Jie Yu
• Created: 14/Oct/16 00:59
• Updated: 07/Nov/16 23:20
• Resolved: 15/Oct/16 00:26

Description

Currently, if the task defines a container image, the command executor will be run under root because it needs to perform pivot_root.

That means if the task wants to run under an unprivileged user, the sandbox of that task will not be writable because it's owned by root.