[jira] [Updated] (MESOS-6566) The Docker executor should not leak task env variables in the Docker command cmd line.

["Till Toenshoff (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Till Toenshoff updated MESOS-6566:
----------------------------------
    Shepherd: Kapil Arya

> The Docker executor should not leak task env variables in the Docker command cmd line.
> --------------------------------------------------------------------------------------
>
>                 Key: MESOS-6566
>                 URL: https://issues.apache.org/jira/browse/MESOS-6566
>             Project: Mesos
>          Issue Type: Bug
>          Components: docker, security
>            Reporter: Gastón Kleiman
>            Assignee: Till Toenshoff
>
> Task environment variables are sensitive, as they might contain secrets.
> The Docker executor starts tasks by executing a {{docker run}} command, and it includes the env variables in the cmd line of the docker command, exposing them to all the users in the machine:
> {code}
> $ ./src/mesos-execute --command="sleep 200" --containerizer=docker --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050 --name=test
> $ ps aux | grep bar
> [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine -c sleep 200
> $
> {code}
> The Docker executor could pass Docker the {{--env-file}} flag, pointing it to a file with the environment variables.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)