[MESOS-8272] Fall back to bind mounting container devices.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Component/s: containerization
• Epic Link: User Namespaces
• Assignee: James Peach
• Reporter: James Peach
• Created: 29/Nov/17 00:19
• Updated: 29/Nov/17 23:17
• Resolved: 29/Nov/17 23:17

Description

When we use mknod to create device files within a container root, we require CAP_MKNOD in the root user namespace. If we have already entered a private user namespace, this fails with EPERM. To work around this, we can do what systemd-nspawn does (though for different reasons), which is to fall back bind mounting the device files into the chroot from the host.

Issue Links

• blocks: MESOS-8142 Improve container security with user namespaces.