[YARN-6623] Add support to turn off launching privileged containers in the container-executor

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 2.9.0, 3.0.0
• Component/s: nodemanager
• Labels: Docker
• Target Version/s: 2.9.0, 3.0.0
• Hadoop Flags: Incompatible change, Reviewed

Release Note

A change in configuration for launching Docker containers under YARN. Docker container capabilities, mounts, networks and allowing privileged container have to specified in the container-executor.cfg. By default, all of the above are turned off. This change will break existing setups launching Docker containers under YARN. Please refer to the Docker containers under YARN documentation for more information.

• Assignee: Varun Vasudev
• Reporter: Varun Vasudev
• Created: 18/May/17 07:00
• Updated: 14/Dec/18 18:06
• Resolved: 19/Oct/17 22:13

Description

Currently, launching privileged containers is controlled by the NM. We should add a flag to the container-executor.cfg allowing admins to disable launching privileged containers at the container-executor level.

Issue Links

• breaks: YARN-7430 Enable user re-mapping for Docker containers by default
• causes: YARN-9125 Carriage Return character in launch command cause node manager to become unhealthy
• duplicates: YARN-6988 container-executor fails for docker when command length > 4096 B
• is blocked by: YARN-6033 Add support for sections in container-executor configuration file