[YARN-732] YARN support for container isolation on Windows

• Type: New Feature
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: trunk-win
• Component/s: nodemanager
• Labels: security
• Assignee: Unassigned
• Reporter: Kyle Leckie
• Created: 30/May/13 17:09
• Updated: 01/Oct/14 17:02

Description

There is no ContainerExecutor on windows that can launch containers in a manner that creates:
1) container isolation
2) container execution with reduced rights
I am working on patches that will add the ability to launch containers in a process with a reduced access token.
Update: After examining several approaches I have settled on launching the task as a domain user. I have attached the current winutils diff which is a work in progress.
Work remaining:

• Create isolated desktop for task processes.
• Set integrity of spawned processed to low.

Issue Links

• incorporates: YARN-2198 Remove the need to run NodeManager as privileged account for Windows Secure Container Executor
• is related to: HADOOP-9533 Centralized Hadoop SSO/Token Server

Sub-Tasks

• Winutils needs ability to create task as domain user: Closed
• Implement secure Windows Container Executor: Closed
• Add scheduling priority to the WindowsSecureContainerExecutor: Resolved