[MESOS-8142] Improve container security with user namespaces.

• Type: Improvement
• Status: Accepted
• Priority: Major
• Resolution: Unresolved
• Component/s: containerization, security
• Epic Link: User Namespaces
• Assignee: James Peach
• Reporter: James Peach
• Created: 27/Oct/17 22:40
• Updated: 29/Apr/19 09:26

Description

As a first pass at supporting user namespaces, figure out how we can use them to improve container security when running untrusted tasks.

This ticket is specifically targeting how to build a user namespace hierarchy and excluding any sort of ID mapping for the container images.

Issue Links

• is blocked by: MESOS-8272 Fall back to bind mounting container devices.
• is blocked by: MESOS-8286 Making bind mounts readonly fails with user namespaces.
• is related to: MESOS-8155 subprocess clone argument should return a Try<pid_t>
• is related to: MESOS-4936 Improve container security for Mesos containerizer.
• is required by: MESOS-2952 Provide user namespaces for privileged access inside containers
• relates to: MESOS-8213 Private user namespaces for tasks