Details

    • Type: Sub-task
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 3.1.0
    • Component/s: None
    • Labels:

      Description

      Hadoop YARN Services can support using private docker registry image or docker image from docker hub. In current implementation, Hadoop security is enforced through username and group membership, and enforce uid:gid consistency in docker container and distributed file system. There is cloud use case for having ability to run untrusted docker image on the same cluster for testing.

      The basic requirement for untrusted container is to ensure all kernel and root privileges are dropped, and there is no interaction with distributed file system to avoid contamination. We can probably enforce detection of untrusted docker image by checking the following:

      1. If docker image is from public docker hub repository, the container is automatically flagged as insecure, and disk volume mount are disabled automatically, and drop all kernel capabilities.
      2. If docker image is from private repository in docker hub, and there is a white list to allow the private repository, disk volume mount is allowed, kernel capabilities follows the allowed list.
      3. If docker image is from private trusted registry with image name like "private.registry.local:5000/centos", and white list allows this private trusted repository. Disk volume mount is allowed, kernel capabilities follows the allowed list.

        Attachments

        1. YARN-7516.018.patch
          54 kB
          Eric Yang
        2. YARN-7516.017.patch
          62 kB
          Eric Yang
        3. YARN-7516.016.patch
          48 kB
          Eric Yang
        4. YARN-7516.015.patch
          47 kB
          Eric Yang
        5. YARN-7516.014.patch
          47 kB
          Eric Yang
        6. YARN-7516.013.patch
          45 kB
          Eric Yang
        7. YARN-7516.012.patch
          45 kB
          Eric Yang
        8. YARN-7516.011.patch
          44 kB
          Eric Yang
        9. YARN-7516.010.patch
          43 kB
          Eric Yang
        10. YARN-7516.009.patch
          41 kB
          Eric Yang
        11. YARN-7516.008.patch
          22 kB
          Eric Yang
        12. YARN-7516.007.patch
          20 kB
          Eric Yang
        13. YARN-7516.006.patch
          20 kB
          Eric Yang
        14. YARN-7516.005.patch
          20 kB
          Eric Yang
        15. YARN-7516.004.patch
          20 kB
          Eric Yang
        16. YARN-7516.003.patch
          20 kB
          Eric Yang
        17. YARN-7516.002.patch
          20 kB
          Eric Yang
        18. YARN-7516.001.patch
          19 kB
          Eric Yang

          Issue Links

            Activity

              People

              • Assignee:
                eyang Eric Yang
                Reporter:
                eyang Eric Yang
              • Votes:
                0 Vote for this issue
                Watchers:
                10 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: