You are viewing a plain text version of this content. The canonical link for it is here.
Posted to yarn-dev@hadoop.apache.org by "Haibo Chen (JIRA)" <ji...@apache.org> on 2018/03/28 16:54:00 UTC
[jira] [Resolved] (YARN-2480) DockerContainerExecutor must support
user namespaces
[ https://issues.apache.org/jira/browse/YARN-2480?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Haibo Chen resolved YARN-2480.
------------------------------
Resolution: Won't Fix
Closing this as DockerContainerExecutor has been deprecated in branch-2 and removed in trunk
> DockerContainerExecutor must support user namespaces
> ----------------------------------------------------
>
> Key: YARN-2480
> URL: https://issues.apache.org/jira/browse/YARN-2480
> Project: Hadoop YARN
> Issue Type: New Feature
> Reporter: Abin Shahab
> Priority: Major
> Labels: security
>
> When DockerContainerExector launches a container, the root inside that container has root privileges on the host.
> This is insecure in a mult-tenant environment. The uid of the container's root user must be mapped to a non-privileged user on the host.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-dev-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-dev-help@hadoop.apache.org