You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@mesos.apache.org by Qian Zhang <zh...@gmail.com> on 2018/12/10 17:05:35 UTC
Review Request 69542: Made non-root containers can access SANDBOX_PATH
volume of PARENT type.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69542/
-----------------------------------------------------------
Review request for mesos, Andrei Budnik, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Bugs: MESOS-8810
https://issues.apache.org/jira/browse/MESOS-8810
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp ecd467c5a33c2f41396bc72ddd7cb806bb8adc52
src/slave/containerizer/mesos/launch.cpp 2f1c9e7a8748c9d7eab25bc8567ca68308e680f9
Diff: https://reviews.apache.org/r/69542/diff/1/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69542: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69542/
-----------------------------------------------------------
(Updated Dec. 21, 2018, 10:59 a.m.)
Review request for mesos, Andrei Budnik, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
Changes
-------
Added more logs.
Bugs: MESOS-8810
https://issues.apache.org/jira/browse/MESOS-8810
Repository: mesos
Description
-------
If a nested container running as a non-root user tries to use a
SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
by a unique gid allocated by the volume gid manager and the container
process launched with that gid as its supplementary group.
Diffs (updated)
-----
include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp ecd467c5a33c2f41396bc72ddd7cb806bb8adc52
src/slave/containerizer/mesos/launch.cpp 2f1c9e7a8748c9d7eab25bc8567ca68308e680f9
Diff: https://reviews.apache.org/r/69542/diff/2/
Changes: https://reviews.apache.org/r/69542/diff/1-2/
Testing
-------
Thanks,
Qian Zhang
Re: Review Request 69542: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Qian Zhang <zh...@gmail.com>.
> On Dec. 11, 2018, 11:22 p.m., Andrei Budnik wrote:
> > src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
> > Lines 422 (patched)
> > <https://reviews.apache.org/r/69542/diff/1/?file=2112793#file2112793line423>
> >
> > Let's assume that the `volumeGidManager` got backlogged due to a very slow/unresponsive disk. How can we detect the reason for a task stuck in `PREPARING` state due to a backlogged `volumeGidManager`? Currently, we silently call `allocate()` and then wait for these futures later, so there is no chance to find out the root cause of the task stuck in `PREPARING`.
Agree. I updated the patch by adding more logs.
- Qian
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69542/#review211193
-----------------------------------------------------------
On Dec. 21, 2018, 10:59 a.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69542/
> -----------------------------------------------------------
>
> (Updated Dec. 21, 2018, 10:59 a.m.)
>
>
> Review request for mesos, Andrei Budnik, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Bugs: MESOS-8810
> https://issues.apache.org/jira/browse/MESOS-8810
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp ecd467c5a33c2f41396bc72ddd7cb806bb8adc52
> src/slave/containerizer/mesos/launch.cpp 2f1c9e7a8748c9d7eab25bc8567ca68308e680f9
>
>
> Diff: https://reviews.apache.org/r/69542/diff/2/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>
Re: Review Request 69542: Made non-root containers can access
SANDBOX_PATH volume of PARENT type.
Posted by Andrei Budnik <ab...@mesosphere.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69542/#review211193
-----------------------------------------------------------
src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
Lines 422 (patched)
<https://reviews.apache.org/r/69542/#comment296125>
Let's assume that the `volumeGidManager` got backlogged due to a very slow/unresponsive disk. How can we detect the reason for a task stuck in `PREPARING` state due to a backlogged `volumeGidManager`? Currently, we silently call `allocate()` and then wait for these futures later, so there is no chance to find out the root cause of the task stuck in `PREPARING`.
- Andrei Budnik
On Dec. 10, 2018, 5:05 p.m., Qian Zhang wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69542/
> -----------------------------------------------------------
>
> (Updated Dec. 10, 2018, 5:05 p.m.)
>
>
> Review request for mesos, Andrei Budnik, Gilbert Song, Greg Mann, Ilya Pronin, and Jie Yu.
>
>
> Bugs: MESOS-8810
> https://issues.apache.org/jira/browse/MESOS-8810
>
>
> Repository: mesos
>
>
> Description
> -------
>
> If a nested container running as a non-root user tries to use a
> SANDBOX_PATH volume of PARENT type, we will make sure the volume owned
> by a unique gid allocated by the volume gid manager and the container
> process launched with that gid as its supplementary group.
>
>
> Diffs
> -----
>
> include/mesos/slave/containerizer.proto 5b4dcdda0f55ea3355c78d1447c7be9ca54d9dc9
> src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6
> src/slave/containerizer/mesos/containerizer.cpp a5cf2da55c046c5c45e0c2ca3400f64de12de62b
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563
> src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp ecd467c5a33c2f41396bc72ddd7cb806bb8adc52
> src/slave/containerizer/mesos/launch.cpp 2f1c9e7a8748c9d7eab25bc8567ca68308e680f9
>
>
> Diff: https://reviews.apache.org/r/69542/diff/1/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Qian Zhang
>
>