[MESOS-7268] CNI isolator should mount network related /etc/* files in readonly mode

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0
• Component/s: containerization, network
• Assignee: Silas Snider
• Reporter: Silas Snider
• Shepherd: Jie Yu
• Created: 20/Mar/17 16:40
• Updated: 14/Jun/17 19:12
• Resolved: 14/Jun/17 19:12

Description

The CNI isolator bind mounts, even for containers using host networking, several files from /etc, such as resolv.conf. These should be mounted as readonly inside the container to prevent users running inside the container as root from being able to affect the external machine.