Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-3611 Support Docker Containers In LinuxContainerExecutor
  3. YARN-7197

Add support for a volume blacklist for docker containers

    XMLWordPrintableJSON

Details

    • Sub-task
    • Status: Resolved
    • Major
    • Resolution: Won't Fix
    • None
    • None
    • yarn

    Description

      Docker supports bind mounting host directories into containers. Work is underway to allow admins to configure a whilelist of volume mounts. While this is a much needed and useful feature, it opens the door for misconfiguration that may lead to users being able to compromise or crash the system.

      One example would be allowing users to mount /run from a host running systemd, and then running systemd in that container, rendering the host mostly unusable.

      This issue is to add support for a default blacklist. The default blacklist would be where we put files and directories that if mounted into a container, are likely to have negative consequences. Users are encouraged not to remove items from the default blacklist, but may do so if necessary.

      Attachments

        1. YARN-7197.001.patch
          7 kB
          Eric Yang
        2. YARN-7197.002.patch
          7 kB
          Eric Yang
        3. YARN-7197.003.patch
          14 kB
          Eric Yang
        4. YARN-7197.004.patch
          14 kB
          Eric Yang
        5. YARN-7197.005.patch
          13 kB
          Eric Yang

        Activity

          People

            Unassigned Unassigned
            shanekumpf@gmail.com Shane Kumpf
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: