You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@mesos.apache.org by "Jie Yu (JIRA)" <ji...@apache.org> on 2017/03/20 20:46:41 UTC

[jira] [Updated] (MESOS-7268) CNI isolator should mount network related /etc/* files in readonly mode

     [ https://issues.apache.org/jira/browse/MESOS-7268?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jie Yu updated MESOS-7268:
--------------------------
    Shepherd: Jie Yu

> CNI isolator should mount network related /etc/* files in readonly mode
> -----------------------------------------------------------------------
>
>                 Key: MESOS-7268
>                 URL: https://issues.apache.org/jira/browse/MESOS-7268
>             Project: Mesos
>          Issue Type: Bug
>          Components: containerization, network
>            Reporter: Silas Snider
>            Assignee: Silas Snider
>
> The CNI isolator bind mounts, even for containers using host networking, several files from /etc, such as resolv.conf. These should be mounted as readonly inside the container to prevent users running inside the container as root from being able to affect the external machine.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)