You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@mesos.apache.org by Qian Zhang <zh...@gmail.com> on 2018/11/15 09:23:28 UTC
Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/
-----------------------------------------------------------
Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
Diff: https://reviews.apache.org/r/69345/diff/1/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
Posted by Mesos Reviewbot Windows <re...@mesos.apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/#review210575
-----------------------------------------------------------
FAIL: Some of the unit tests failed. Please check the relevant logs.
Reviews applied: `['69342', '69344', '69345']`
Failed command: `Start-MesosCITesting`
All the build artifacts available at: http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2602/mesos-review-69345
Relevant logs:
- [mesos-tests-cmake.log](http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2602/mesos-review-69345/logs/mesos-tests-cmake.log):
```
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\zookeeper.c(3501): warning C4996: 'sprintf': This function or variable may be unsafe. Consider using sprintf_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\zookeeper.c(3479): warning C4101: 'addrstr': unreferenced local variable [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\recordio.c(170): warning C4267: '=': conversion from 'size_t' to 'int32_t', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\mt_adaptor.c(496): warning C4244: '=': conversion from 'time_t' to 'int32_t', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(256): warning C4090: 'function': different 'const' qualifiers [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(166): warning C4716: 'pthread_cond_broadcast': must return a value [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(205): warning C4716: 'pthread_cond_wait': must return a value [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(124): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(128): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(279): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(301): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(368): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(372): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(512): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(543): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(548): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(569): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
"D:\DCOS\mesos\src\tests\mesos-tests.vcxproj" (default target) (1) ->
"D:\DCOS\mesos\src\slave\mesos-agent.vcxproj" (default target) (17) ->
(Link target) ->
main.obj : error LNK2019: unresolved external symbol "public: __cdecl mesos::internal::slave::VolumeGidManager::~VolumeGidManager(void)" (??1VolumeGidManager@slave@internal@mesos@@QEAA@XZ) referenced in function "public: void * __cdecl mesos::internal::slave::VolumeGidManager::`scalar deleting destructor'(unsigned int)" (??_GVolumeGidManager@slave@internal@mesos@@QEAAPEAXI@Z) [D:\DCOS\mesos\src\slave\mesos-agent.vcxproj]
D:\DCOS\mesos\src\mesos-agent.exe : fatal error LNK1120: 1 unresolved externals [D:\DCOS\mesos\src\slave\mesos-agent.vcxproj]
172 Warning(s)
2 Error(s)
Time Elapsed 00:20:07.79
```
- Mesos Reviewbot Windows
On Nov. 15, 2018, 1:55 p.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69345/
> -----------------------------------------------------------
>
> (Updated Nov. 15, 2018, 1:55 p.m.)
>
>
> Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
> src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
> src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
> src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
> src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
> src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
> src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
> src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
> src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
> src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
>
>
> Diff: https://reviews.apache.org/r/69345/diff/2/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>
Re: Review Request 69345: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/
-----------------------------------------------------------
(Updated Nov. 21, 2018, 10:41 p.m.)
Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Bugs: MESOS-8810
https://issues.apache.org/jira/browse/MESOS-8810
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
Diff: https://reviews.apache.org/r/69345/diff/4/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69345: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Mesos Reviewbot Windows <re...@mesos.apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/#review210721
-----------------------------------------------------------
PASS: Mesos patch 69345 was successfully built and tested.
Reviews applied: `['69342', '69344', '69345']`
All the build artifacts available at: http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2629/mesos-review-69345
- Mesos Reviewbot Windows
On Nov. 20, 2018, 2:13 p.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69345/
> -----------------------------------------------------------
>
> (Updated Nov. 20, 2018, 2:13 p.m.)
>
>
> Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
> src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
> src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
> src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
> src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
> src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
> src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
> src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
> src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
> src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
>
>
> Diff: https://reviews.apache.org/r/69345/diff/4/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>
Re: Review Request 69345: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/
-----------------------------------------------------------
(Updated Nov. 20, 2018, 10:13 p.m.)
Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Summary (updated)
-----------------
Made non-root containers can access SANDBOX_PATH volume of PARENT type.
Repository: mesos
Description (updated)
-------
If a nested container running as a non-root user tries to use a
SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs (updated)
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
Diff: https://reviews.apache.org/r/69345/diff/4/
Changes: https://reviews.apache.org/r/69345/diff/3-4/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
Posted by Mesos Reviewbot Windows <re...@mesos.apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/#review210580
-----------------------------------------------------------
PASS: Mesos patch 69345 was successfully built and tested.
Reviews applied: `['69342', '69344', '69345']`
All the build artifacts available at: http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2603/mesos-review-69345
- Mesos Reviewbot Windows
On Nov. 15, 2018, 2:51 p.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69345/
> -----------------------------------------------------------
>
> (Updated Nov. 15, 2018, 2:51 p.m.)
>
>
> Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
> src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
> src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
> src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
> src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
> src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
> src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
> src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
> src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
> src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
>
>
> Diff: https://reviews.apache.org/r/69345/diff/3/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>
Re: Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/
-----------------------------------------------------------
(Updated Nov. 15, 2018, 10:51 p.m.)
Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs (updated)
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
Diff: https://reviews.apache.org/r/69345/diff/3/
Changes: https://reviews.apache.org/r/69345/diff/2-3/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/
-----------------------------------------------------------
(Updated Nov. 15, 2018, 9:55 p.m.)
Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs (updated)
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
Diff: https://reviews.apache.org/r/69345/diff/2/
Changes: https://reviews.apache.org/r/69345/diff/1-2/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69345: Made non-root containers can access SANDBOX
volume of PARENT type.
Posted by Mesos Reviewbot Windows <re...@mesos.apache.org>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/#review210565
-----------------------------------------------------------
FAIL: Some of the unit tests failed. Please check the relevant logs.
Reviews applied: `['69342', '69344', '69345']`
Failed command: `Start-MesosCITesting`
All the build artifacts available at: http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2601/mesos-review-69345
Relevant logs:
- [mesos-tests-cmake.log](http://dcos-win.westus2.cloudapp.azure.com/artifacts/mesos-reviewbot-testing/2601/mesos-review-69345/logs/mesos-tests-cmake.log):
```
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\zookeeper.c(3479): warning C4101: 'addrstr': unreferenced local variable [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\recordio.c(170): warning C4267: '=': conversion from 'size_t' to 'int32_t', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\mt_adaptor.c(496): warning C4244: '=': conversion from 'time_t' to 'int32_t', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(256): warning C4090: 'function': different 'const' qualifiers [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(166): warning C4716: 'pthread_cond_broadcast': must return a value [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\winport.c(205): warning C4716: 'pthread_cond_wait': must return a value [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\zookeeper.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(124): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(128): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(279): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(301): warning C4267: 'initializing': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(368): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(372): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(512): warning C4267: 'function': conversion from 'size_t' to 'int', possible loss of data [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(543): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(548): warning C4996: 'fopen': This function or variable may be unsafe. Consider using fopen_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
d:\dcos\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8\src\c\src\cli.c(569): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details. [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8\src\zookeeper-3.4.8-build\cli.vcxproj] [D:\DCOS\mesos\3rdparty\zookeeper-3.4.8.vcxproj]
"D:\DCOS\mesos\src\tests\mesos-tests.vcxproj" (default target) (1) ->
"D:\DCOS\mesos\src\slave\mesos-agent.vcxproj" (default target) (16) ->
(Link target) ->
main.obj : error LNK2019: unresolved external symbol "public: __cdecl mesos::internal::slave::VolumeGidManager::~VolumeGidManager(void)" (??1VolumeGidManager@slave@internal@mesos@@QEAA@XZ) referenced in function "public: void * __cdecl mesos::internal::slave::VolumeGidManager::`scalar deleting destructor'(unsigned int)" (??_GVolumeGidManager@slave@internal@mesos@@QEAAPEAXI@Z) [D:\DCOS\mesos\src\slave\mesos-agent.vcxproj]
mesos.lib(containerizer.cpp.obj) : error LNK2019: unresolved external symbol "public: class process::Future<struct Nothing> __cdecl mesos::internal::slave::VolumeGidManager::deallocate(class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const &)const " (?deallocate@VolumeGidManager@slave@internal@mesos@@QEBA?AV?$Future@UNothing@@@process@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z) referenced in function "private: void __cdecl mesos::internal::slave::MesosContainerizerProcess::____destroy(class mesos::ContainerID const &,class Option<class mesos::slave::ContainerTermination> const &)" (?____destroy@MesosContainerizerProcess@slave@internal@mesos@@AEAAXAEBVContainerID@4@AEBV?$Option@VContainerTermination@slave@mesos@@@@@Z) [D:\DCOS\mesos\src\slave\mesos-agent.vcxproj]
D:\DCOS\mesos\src\mesos-agent.exe : fatal error LNK1120: 2 unresolved externals [D:\DCOS\mesos\src\slave\mesos-agent.vcxproj]
172 Warning(s)
3 Error(s)
Time Elapsed 00:20:07.34
```
- Mesos Reviewbot Windows
On Nov. 15, 2018, 9:23 a.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69345/
> -----------------------------------------------------------
>
> (Updated Nov. 15, 2018, 9:23 a.m.)
>
>
> Review request for mesos, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279
> src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1
> src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp 181a4da1d18b215348d183f104157d996f2da096
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp 300b3d95d74b73fbe0221096f3f3f172be745081
> src/slave/containerizer/mesos/launch.cpp 882bcdf89e2b0cca3d3f62e6d017849a51ceaead
> src/slave/main.cpp e774092ff2c3941f17cdebfb26d80c05a26497c6
> src/slave/slave.hpp 0bd340176e2a8cefdfa7ef71e059441fb171aff6
> src/slave/slave.cpp 74f6fb9036a9ac4f587f53ec2df04eeb4c167bfb
> src/tests/cluster.cpp 2b351ca70d8e80008e49722aa7d46918b5ecd9b0
> src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113
> src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712
>
>
> Diff: https://reviews.apache.org/r/69345/diff/1/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>