[MESOS-9386] Implement Seccomp profile inheritance for POD containers

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Won't Do
• Component/s: containerization
• Labels: mesosphere
• Epic Link: Seccomp Improvement
• Story Points: 5
• Assignee: Andrei Budnik
• Reporter: Andrei Budnik
• Shepherd: Gilbert Song
• Created: 14/Nov/18 16:38
• Updated: 28/Jan/19 13:47
• Resolved: 28/Jan/19 13:47

Description

Child containers inherit its parent container's Seccomp profile by default. Also, Seccomp profile can be overridden by a Framework for a particular child container by specifying a path to the Seccomp profile.

Mesos containerizer persists information about containers on disk via `ContainerLaunchInfo` proto, which includes `ContainerSeccompProfile` proto. Mesos containerizer should use this proto to load the parent's profile for a child container. When a child inherits the parent's Seccomp profile, Mesos agent doesn't have to re-read a Seccomp profile from the disk, which was used for the parent container. Otherwise, we would have to check that a file content hasn't changed since the last time the parent was launched.