diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java
index 16bd73a..e02cd33 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-api/src/main/java/org/apache/hadoop/yarn/conf/YarnConfiguration.java
@@ -1464,6 +1464,23 @@ public static boolean isAclEnabled(Configuration conf) {
/** Prefix for runtime configuration constants. */
public static final String LINUX_CONTAINER_RUNTIME_PREFIX = NM_PREFIX +
"runtime.linux.";
+
+ /**
+ * Comma separated list of runtimes that are allowed when using
+ * LinuxContainerExecutor. The allowed values are:
+ *
+ * - default
+ * - docker
+ * - javasandbox
+ *
+ */
+ public static final String LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES =
+ LINUX_CONTAINER_RUNTIME_PREFIX + "allowed-runtimes";
+
+ /** The default list of allowed runtimes when using LinuxContainerExecutor. */
+ public static final String[] DEFAULT_LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES
+ = {"default"};
+
public static final String DOCKER_CONTAINER_RUNTIME_PREFIX =
LINUX_CONTAINER_RUNTIME_PREFIX + "docker.";
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/yarn-default.xml b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/yarn-default.xml
index 0823dfe..c678bc1 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/yarn-default.xml
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-common/src/main/resources/yarn-default.xml
@@ -1572,6 +1572,14 @@
+ Comma separated list of runtimes that are allowed when using
+ LinuxContainerExecutor. The allowed values are default, docker, and
+ javasandbox.
+ yarn.nodemanager.runtime.linux.allowed-runtimes
+ default
+
+
+
This configuration setting determines the capabilities
assigned to docker containers when they are launched. While these may not
be case-sensitive from a docker perspective, it is best to keep these
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/ContainerExecutor.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/ContainerExecutor.java
index 9767fb9..0633383 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/ContainerExecutor.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/ContainerExecutor.java
@@ -51,6 +51,7 @@
import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.Container;
import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.ContainerDiagnosticsUpdateEvent;
import org.apache.hadoop.yarn.server.nodemanager.containermanager.launcher.ContainerLaunch;
+import org.apache.hadoop.yarn.server.nodemanager.containermanager.runtime.ContainerExecutionException;
import org.apache.hadoop.yarn.server.nodemanager.executor.ContainerPrepareContext;
import org.apache.hadoop.yarn.server.nodemanager.util.NodeManagerHardwareUtils;
import org.apache.hadoop.yarn.server.nodemanager.executor.ContainerLivenessContext;
@@ -660,7 +661,8 @@ public void activateContainer(ContainerId containerId, Path pidFilePath) {
}
// LinuxContainerExecutor overrides this method and behaves differently.
- public String[] getIpAndHost(Container container) {
+ public String[] getIpAndHost(Container container)
+ throws ContainerExecutionException {
return getLocalIpAndHost(container);
}
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/LinuxContainerExecutor.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/LinuxContainerExecutor.java
index dc68680..2971f83 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/LinuxContainerExecutor.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/LinuxContainerExecutor.java
@@ -625,7 +625,8 @@ private ContainerRuntimeContext buildContainerRuntimeContext(
}
@Override
- public String[] getIpAndHost(Container container) {
+ public String[] getIpAndHost(Container container)
+ throws ContainerExecutionException {
return linuxContainerRuntime.getIpAndHost(container);
}
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/DelegatingLinuxContainerRuntime.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/DelegatingLinuxContainerRuntime.java
index 5273334..2fe70aa 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/DelegatingLinuxContainerRuntime.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/DelegatingLinuxContainerRuntime.java
@@ -20,6 +20,7 @@
package org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime;
+import com.google.common.annotations.VisibleForTesting;
import org.apache.hadoop.classification.InterfaceAudience;
import org.apache.hadoop.classification.InterfaceStability;
import org.apache.hadoop.conf.Configuration;
@@ -31,8 +32,12 @@
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
+import java.util.EnumSet;
import java.util.Map;
+import static org.apache.hadoop.yarn.conf.YarnConfiguration.DEFAULT_LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES;
+import static org.apache.hadoop.yarn.conf.YarnConfiguration.LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES;
+
/**
* This class is a {@link ContainerRuntime} implementation that delegates all
* operations to a {@link DefaultLinuxContainerRuntime} instance, a
@@ -50,34 +55,57 @@
private DefaultLinuxContainerRuntime defaultLinuxContainerRuntime;
private DockerLinuxContainerRuntime dockerLinuxContainerRuntime;
private JavaSandboxLinuxContainerRuntime javaSandboxLinuxContainerRuntime;
+ private EnumSet allowedRuntimes =
+ EnumSet.noneOf(LinuxContainerRuntimeType.class);
@Override
public void initialize(Configuration conf)
throws ContainerExecutionException {
- PrivilegedOperationExecutor privilegedOperationExecutor =
- PrivilegedOperationExecutor.getInstance(conf);
- defaultLinuxContainerRuntime = new DefaultLinuxContainerRuntime(
- privilegedOperationExecutor);
- defaultLinuxContainerRuntime.initialize(conf);
- dockerLinuxContainerRuntime = new DockerLinuxContainerRuntime(
- privilegedOperationExecutor);
- dockerLinuxContainerRuntime.initialize(conf);
- javaSandboxLinuxContainerRuntime = new JavaSandboxLinuxContainerRuntime(
- privilegedOperationExecutor);
- javaSandboxLinuxContainerRuntime.initialize(conf);
+ String[] configuredRuntimes = conf.getTrimmedStrings(
+ LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ DEFAULT_LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES);
+ try {
+ for (String configuredRuntime : configuredRuntimes) {
+ allowedRuntimes.add(
+ LinuxContainerRuntimeType.valueOf(configuredRuntime.toUpperCase()));
+ }
+ } catch (IllegalArgumentException e) {
+ throw new ContainerExecutionException("Invalid runtime configuration for "
+ + LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES);
+ }
+ if (isRuntimeAllowed(LinuxContainerRuntimeType.JAVASANDBOX)) {
+ javaSandboxLinuxContainerRuntime = new JavaSandboxLinuxContainerRuntime(
+ PrivilegedOperationExecutor.getInstance(conf));
+ javaSandboxLinuxContainerRuntime.initialize(conf);
+ }
+ if (isRuntimeAllowed(LinuxContainerRuntimeType.DOCKER)) {
+ dockerLinuxContainerRuntime = new DockerLinuxContainerRuntime(
+ PrivilegedOperationExecutor.getInstance(conf));
+ dockerLinuxContainerRuntime.initialize(conf);
+ }
+ if (isRuntimeAllowed(LinuxContainerRuntimeType.DEFAULT)) {
+ defaultLinuxContainerRuntime = new DefaultLinuxContainerRuntime(
+ PrivilegedOperationExecutor.getInstance(conf));
+ defaultLinuxContainerRuntime.initialize(conf);
+ }
}
- private LinuxContainerRuntime pickContainerRuntime(
- Map environment){
+ @VisibleForTesting
+ LinuxContainerRuntime pickContainerRuntime(
+ Map environment) throws ContainerExecutionException {
LinuxContainerRuntime runtime;
//Sandbox checked first to ensure DockerRuntime doesn't circumvent controls
- if (javaSandboxLinuxContainerRuntime.isSandboxContainerRequested()){
- runtime = javaSandboxLinuxContainerRuntime;
- } else if (DockerLinuxContainerRuntime
- .isDockerContainerRequested(environment)){
+ if (javaSandboxLinuxContainerRuntime != null &&
+ javaSandboxLinuxContainerRuntime.isSandboxContainerRequested()){
+ runtime = javaSandboxLinuxContainerRuntime;
+ } else if (dockerLinuxContainerRuntime != null &&
+ DockerLinuxContainerRuntime.isDockerContainerRequested(environment)){
runtime = dockerLinuxContainerRuntime;
- } else {
+ } else if (defaultLinuxContainerRuntime != null &&
+ !DockerLinuxContainerRuntime.isDockerContainerRequested(environment)) {
runtime = defaultLinuxContainerRuntime;
+ } else {
+ throw new ContainerExecutionException("Requested runtime not allowed.");
}
if (LOG.isDebugEnabled()) {
@@ -88,7 +116,8 @@ private LinuxContainerRuntime pickContainerRuntime(
return runtime;
}
- private LinuxContainerRuntime pickContainerRuntime(Container container) {
+ private LinuxContainerRuntime pickContainerRuntime(Container container)
+ throws ContainerExecutionException {
return pickContainerRuntime(container.getLaunchContext().getEnvironment());
}
@@ -127,8 +156,14 @@ public void reapContainer(ContainerRuntimeContext ctx)
}
@Override
- public String[] getIpAndHost(Container container) {
+ public String[] getIpAndHost(Container container)
+ throws ContainerExecutionException {
LinuxContainerRuntime runtime = pickContainerRuntime(container);
return runtime.getIpAndHost(container);
}
+
+ @VisibleForTesting
+ boolean isRuntimeAllowed(LinuxContainerRuntimeType runtimeType) {
+ return allowedRuntimes.contains(runtimeType);
+ }
}
\ No newline at end of file
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/LinuxContainerRuntimeType.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/LinuxContainerRuntimeType.java
new file mode 100644
index 0000000..387fe28
--- /dev/null
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/LinuxContainerRuntimeType.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime;
+
+public enum LinuxContainerRuntimeType {
+ DEFAULT,
+ DOCKER,
+ JAVASANDBOX;
+}
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/monitor/ContainersMonitorImpl.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/monitor/ContainersMonitorImpl.java
index d764e1d..2b99cc7 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/monitor/ContainersMonitorImpl.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/monitor/ContainersMonitorImpl.java
@@ -38,6 +38,7 @@
import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.Container;
import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.ContainerImpl;
import org.apache.hadoop.yarn.server.nodemanager.containermanager.container.ContainerKillEvent;
+import org.apache.hadoop.yarn.server.nodemanager.containermanager.runtime.ContainerExecutionException;
import org.apache.hadoop.yarn.server.nodemanager.timelineservice.NMTimelinePublisher;
import org.apache.hadoop.yarn.server.nodemanager.util.NodeManagerHardwareUtils;
import org.apache.hadoop.yarn.util.ResourceCalculatorPlugin;
@@ -502,7 +503,8 @@ public void run() {
* @param entry process tree entry to fill in
*/
private void initializeProcessTrees(
- Entry entry) {
+ Entry entry)
+ throws ContainerExecutionException {
ContainerId containerId = entry.getKey();
ProcessTreeInfo ptInfo = entry.getValue();
String pId = ptInfo.getPID();
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/runtime/ContainerRuntime.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/runtime/ContainerRuntime.java
index b15690f..7caa0ed 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/runtime/ContainerRuntime.java
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/main/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/runtime/ContainerRuntime.java
@@ -77,6 +77,10 @@ void reapContainer(ContainerRuntimeContext ctx)
/**
* Return the host and ip of the container
+ *
+ * @param container the {@link Container}
+ * @throws ContainerExecutionException if an error occurs while getting the ip
+ * and hostname
*/
- String[] getIpAndHost(Container container);
+ String[] getIpAndHost(Container container) throws ContainerExecutionException;
}
\ No newline at end of file
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/TestDelegatingLinuxContainerRuntime.java b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/TestDelegatingLinuxContainerRuntime.java
new file mode 100644
index 0000000..a542407
--- /dev/null
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-nodemanager/src/test/java/org/apache/hadoop/yarn/server/nodemanager/containermanager/linux/runtime/TestDelegatingLinuxContainerRuntime.java
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.hadoop.yarn.server.nodemanager.containermanager.linux.runtime;
+
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.yarn.server.nodemanager.containermanager.runtime.ContainerRuntime;
+import org.junit.Before;
+import org.junit.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.apache.hadoop.yarn.conf.YarnConfiguration.DEFAULT_LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES;
+import static org.apache.hadoop.yarn.conf.YarnConfiguration.LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES;
+import static org.apache.hadoop.yarn.conf.YarnConfiguration.YARN_CONTAINER_SANDBOX;
+import static org.apache.hadoop.yarn.server.nodemanager.containermanager.runtime.ContainerRuntimeConstants.ENV_CONTAINER_TYPE;
+import static org.junit.Assert.*;
+
+/**
+ * Test container runtime delegation.
+ */
+public class TestDelegatingLinuxContainerRuntime {
+
+ private DelegatingLinuxContainerRuntime delegatingLinuxContainerRuntime;
+ private Configuration conf;
+ private Map env = new HashMap<>();
+
+ @Before
+ public void setUp() throws Exception {
+ delegatingLinuxContainerRuntime = new DelegatingLinuxContainerRuntime();
+ conf = new Configuration();
+ env.clear();
+ }
+
+ @Test
+ public void testIsRuntimeAllowedDefault() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ DEFAULT_LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES[0]);
+ System.out.println(conf.get(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES));
+ delegatingLinuxContainerRuntime.initialize(conf);
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DEFAULT));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DOCKER));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.JAVASANDBOX));
+ }
+
+ @Test
+ public void testIsRuntimeAllowedDocker() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES, "docker");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DOCKER));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DEFAULT));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.JAVASANDBOX));
+ }
+
+ @Test
+ public void testIsRuntimeAllowedJavaSandbox() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES, "javasandbox");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.JAVASANDBOX));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DEFAULT));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DOCKER));
+ }
+
+ @Test
+ public void testIsRuntimeAllowedMultiple() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ "docker,javasandbox");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DOCKER));
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.JAVASANDBOX));
+ assertFalse(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DEFAULT));
+ }
+
+ @Test
+ public void testIsRuntimeAllowedAll() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ "default,docker,javasandbox");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DEFAULT));
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.DOCKER));
+ assertTrue(delegatingLinuxContainerRuntime.isRuntimeAllowed(
+ LinuxContainerRuntimeType.JAVASANDBOX));
+ }
+
+ @Test
+ public void testJavaSandboxNotAllowedButPermissive() throws Exception {
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ "default,docker");
+ conf.set(YARN_CONTAINER_SANDBOX, "permissive");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ ContainerRuntime runtime =
+ delegatingLinuxContainerRuntime.pickContainerRuntime(env);
+ assertTrue(runtime instanceof DefaultLinuxContainerRuntime);
+ }
+
+ @Test
+ public void testJavaSandboxNotAllowedButPermissiveDockerRequested()
+ throws Exception {
+ env.put(ENV_CONTAINER_TYPE, "docker");
+ conf.set(LINUX_CONTAINER_RUNTIME_ALLOWED_RUNTIMES,
+ "default,docker");
+ conf.set(YARN_CONTAINER_SANDBOX, "permissive");
+ delegatingLinuxContainerRuntime.initialize(conf);
+ ContainerRuntime runtime =
+ delegatingLinuxContainerRuntime.pickContainerRuntime(env);
+ assertTrue(runtime instanceof DockerLinuxContainerRuntime);
+ }
+}
\ No newline at end of file
diff --git a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-site/src/site/markdown/DockerContainers.md b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-site/src/site/markdown/DockerContainers.md
index 4de0a6a..2e56d81 100644
--- a/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-site/src/site/markdown/DockerContainers.md
+++ b/hadoop-yarn-project/hadoop-yarn/hadoop-yarn-site/src/site/markdown/DockerContainers.md
@@ -71,68 +71,82 @@ request. For example:
The following properties should be set in yarn-site.xml:
```xml
-
- yarn.nodemanager.container-executor.class
- org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor
-
- This is the container executor setting that ensures that all applications
- are started with the LinuxContainerExecutor.
-
-
-
-
- yarn.nodemanager.linux-container-executor.group
- hadoop
-
- The POSIX group of the NodeManager. It should match the setting in
- "container-executor.cfg". This configuration is required for validating
- the secure access of the container-executor binary.
-
-
-
-
- yarn.nodemanager.linux-container-executor.nonsecure-mode.limit-users
- false
-
- Whether all applications should be run as the NodeManager process' owner.
- When false, applications are launched instead as the application owner.
-
-
-
-
- yarn.nodemanager.runtime.linux.docker.allowed-container-networks
- host,none,bridge
-
- Optional. A comma-separated set of networks allowed when launching
- containers. Valid values are determined by Docker networks available from
- `docker network ls`
-
-
-
-
- The network used when launching Docker containers when no
- network is specified in the request. This network must be one of the
- (configurable) set of allowed container networks.
- yarn.nodemanager.runtime.linux.docker.default-container-network
- host
-
-
-
- yarn.nodemanager.runtime.linux.docker.privileged-containers.allowed
- false
-
- Optional. Whether applications are allowed to run in privileged containers.
-
-
-
-
- yarn.nodemanager.runtime.linux.docker.privileged-containers.acl
-
-
- Optional. A comma-separated list of users who are allowed to request
- privileged contains if privileged containers are allowed.
-
-
+
+
+ yarn.nodemanager.container-executor.class
+ org.apache.hadoop.yarn.server.nodemanager.LinuxContainerExecutor
+
+ This is the container executor setting that ensures that all applications
+ are started with the LinuxContainerExecutor.
+
+
+
+
+ yarn.nodemanager.linux-container-executor.group
+ hadoop
+
+ The POSIX group of the NodeManager. It should match the setting in
+ "container-executor.cfg". This configuration is required for validating
+ the secure access of the container-executor binary.
+
+
+
+
+ yarn.nodemanager.linux-container-executor.nonsecure-mode.limit-users
+ false
+
+ Whether all applications should be run as the NodeManager process' owner.
+ When false, applications are launched instead as the application owner.
+
+
+
+
+ yarn.nodemanager.runtime.linux.allowed-runtimes
+ DefaultLinuxContainerRuntime,DockerLinuxContainerRuntime
+
+ Comma separated list of runtimes that are allowed when using
+ LinuxContainerExecutor.
+
+
+
+
+ yarn.nodemanager.runtime.linux.docker.allowed-container-networks
+ host,none,bridge
+
+ Optional. A comma-separated set of networks allowed when launching
+ containers. Valid values are determined by Docker networks available from
+ `docker network ls`
+
+
+
+
+ yarn.nodemanager.runtime.linux.docker.default-container-network
+ host
+
+ The network used when launching Docker containers when no
+ network is specified in the request. This network must be one of the
+ (configurable) set of allowed container networks.
+
+
+
+
+ yarn.nodemanager.runtime.linux.docker.privileged-containers.allowed
+ false
+
+ Optional. Whether applications are allowed to run in privileged
+ containers.
+
+
+
+
+ yarn.nodemanager.runtime.linux.docker.privileged-containers.acl
+
+
+ Optional. A comma-separated list of users who are allowed to request
+ privileged contains if privileged containers are allowed.
+
+
+
```
In addition, a container-executer.cfg file must exist and contain settings for