[YARN-7430] Enable user re-mapping for Docker containers by default

• Type: Sub-task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 2.9.0, 3.0.0
• Fix Version/s: 3.0.0, 3.1.0, 2.10.0, 2.9.1
• Component/s: security, yarn
• Labels: Docker
• Hadoop Flags: Reviewed
• Assignee: Eric Yang
• Reporter: Eric Yang
• Created: 02/Nov/17 22:58
• Updated: 03/May/18 01:34
• Resolved: 17/Nov/17 09:42

Description

In YARN-4266, the recommendation was to use -u [uid]:[gid] numeric values to enforce user and group for the running user. In YARN-6623, this translated to --user=test --group-add=group1. The code no longer enforce group correctly for launched process.

In addition, the implementation in YARN-6623 requires the user and group information to exist in container to translate username and group to uid/gid. For users on LDAP, there is no good way to populate container with user and group information.

Issue Links

• is broken by: YARN-6623 Add support to turn off launching privileged containers in the container-executor
• is cloned by: YARN-7782 Enable user re-mapping for Docker containers in yarn-default.xml
• relates to: YARN-7221 Add security check for privileged docker container
• relates to: YARN-3611 Support Docker Containers In LinuxContainerExecutor