You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by ji...@apache.org on 2016/11/12 02:57:28 UTC
[07/11] mesos git commit: Added proper dependencies on the
'filesystem/linux' isolator.
Added proper dependencies on the 'filesystem/linux' isolator.
For some isolators, this meant adding an explicit dependency on
'filesystem/linux' and then removing any of their local calls to
'set_clone_namespaces(CLONE_NEWNS)'. For others, this meant simply
removing their explicit 'set_clone_namespaces(CLONE_NEWNS)' calls
since they are redundant with the one made by 'filesystem/linux'.
The 'cni' isolator is a special case, however, because it may need to
call 'set_clone_namespaces(CLONE_NEWNS)' even if the
'filesystem/posix' isolator is enabled. For this we added a comment.
Review: https://reviews.apache.org/r/53682/
Project: http://git-wip-us.apache.org/repos/asf/mesos/repo
Commit: http://git-wip-us.apache.org/repos/asf/mesos/commit/09d42454
Tree: http://git-wip-us.apache.org/repos/asf/mesos/tree/09d42454
Diff: http://git-wip-us.apache.org/repos/asf/mesos/diff/09d42454
Branch: refs/heads/master
Commit: 09d42454c01398e0b7b6588aab4488b68cb82435
Parents: 329f3ea
Author: Kevin Klues <kl...@gmail.com>
Authored: Fri Nov 11 16:52:54 2016 -0800
Committer: Jie Yu <yu...@gmail.com>
Committed: Fri Nov 11 18:54:11 2016 -0800
----------------------------------------------------------------------
.../mesos/isolators/gpu/isolator.cpp | 18 +++++++++++++++---
.../mesos/isolators/namespaces/pid.cpp | 9 ++++++++-
.../mesos/isolators/volume/image.cpp | 10 +++++++++-
.../mesos/isolators/volume/sandbox_path.cpp | 6 ------
4 files changed, 32 insertions(+), 11 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/mesos/blob/09d42454/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
index 4bd3785..a3a140d 100644
--- a/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
+++ b/src/slave/containerizer/mesos/isolators/gpu/isolator.cpp
@@ -92,14 +92,17 @@ Try<Isolator*> NvidiaGpuIsolatorProcess::create(
const Flags& flags,
const NvidiaComponents& components)
{
- // Make sure the 'cgroups/devices' isolator is present and
- // precedes the GPU isolator.
+ // Make sure both the 'cgroups/devices' isolator and the
+ // 'filesystem/linux' isolators are present and precede the GPU
+ // isolator.
vector<string> tokens = strings::tokenize(flags.isolation, ",");
auto gpuIsolator =
std::find(tokens.begin(), tokens.end(), "gpu/nvidia");
auto devicesIsolator =
std::find(tokens.begin(), tokens.end(), "cgroups/devices");
+ auto filesystemIsolator =
+ std::find(tokens.begin(), tokens.end(), "filesystem/linux");
CHECK(gpuIsolator != tokens.end());
@@ -108,11 +111,21 @@ Try<Isolator*> NvidiaGpuIsolatorProcess::create(
" order to use the 'gpu/nvidia' isolator");
}
+ if (filesystemIsolator == tokens.end()) {
+ return Error("The 'filesystem/linux' isolator must be enabled in"
+ " order to use the 'gpu/nvidia' isolator");
+ }
+
if (devicesIsolator > gpuIsolator) {
return Error("'cgroups/devices' must precede 'gpu/nvidia'"
" in the --isolation flag");
}
+ if (filesystemIsolator > gpuIsolator) {
+ return Error("'filesystem/linux' must precede 'gpu/nvidia'"
+ " in the --isolation flag");
+ }
+
// Retrieve the cgroups devices hierarchy.
Result<string> hierarchy = cgroups::hierarchy(CGROUP_SUBSYSTEM_DEVICES_NAME);
@@ -329,7 +342,6 @@ Future<Option<ContainerLaunchInfo>> NvidiaGpuIsolatorProcess::_prepare(
}
ContainerLaunchInfo launchInfo;
- launchInfo.set_clone_namespaces(CLONE_NEWNS);
// Inject the Nvidia volume into the container.
//
http://git-wip-us.apache.org/repos/asf/mesos/blob/09d42454/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
index f3438b8..8ebf2e7 100644
--- a/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
+++ b/src/slave/containerizer/mesos/isolators/namespaces/pid.cpp
@@ -79,7 +79,14 @@ Future<Option<ContainerLaunchInfo>> NamespacesPidIsolatorProcess::prepare(
const ContainerConfig& containerConfig)
{
ContainerLaunchInfo launchInfo;
- launchInfo.set_clone_namespaces(CLONE_NEWPID | CLONE_NEWNS);
+
+ if (containerId.has_parent()) {
+ // If we are a nested container, then we want to enter our
+ // parent's pid namespace before cloning a new one.
+ launchInfo.set_enter_namespaces(CLONE_NEWPID);
+ }
+
+ launchInfo.set_clone_namespaces(CLONE_NEWPID);
// Mount /proc with standard options for the container's pid
// namespace to show the container's pids (and other /proc files),
http://git-wip-us.apache.org/repos/asf/mesos/blob/09d42454/src/slave/containerizer/mesos/isolators/volume/image.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/volume/image.cpp b/src/slave/containerizer/mesos/isolators/volume/image.cpp
index ee9bd35..e954182 100644
--- a/src/slave/containerizer/mesos/isolators/volume/image.cpp
+++ b/src/slave/containerizer/mesos/isolators/volume/image.cpp
@@ -72,6 +72,15 @@ Try<Isolator*> VolumeImageIsolatorProcess::create(
const Flags& flags,
const Shared<Provisioner>& provisioner)
{
+ // Make sure 'filesystem/linux' isolator is used.
+ // NOTE: 'filesystem/linux' isolator will make sure mounts in the
+ // child mount namespace will not be propagated back to the host
+ // mount namespace.
+ if (!strings::contains(flags.isolation, "filesystem/linux")) {
+ return Error("'filesystem/linux' must be enabled"
+ " to create the volume image isolator");
+ }
+
process::Owned<MesosIsolatorProcess> process(
new VolumeImageIsolatorProcess(flags, provisioner));
@@ -180,7 +189,6 @@ Future<Option<ContainerLaunchInfo>> VolumeImageIsolatorProcess::_prepare(
const list<Future<ProvisionInfo>>& futures)
{
ContainerLaunchInfo launchInfo;
- launchInfo.set_clone_namespaces(CLONE_NEWNS);
vector<string> messages;
vector<string> sources;
http://git-wip-us.apache.org/repos/asf/mesos/blob/09d42454/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
----------------------------------------------------------------------
diff --git a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
index a6f9794..cb7aa4f 100644
--- a/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
+++ b/src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp
@@ -120,12 +120,6 @@ Future<Option<ContainerLaunchInfo>> VolumeSandboxPathIsolatorProcess::prepare(
ContainerLaunchInfo launchInfo;
-#ifdef __linux__
- if (bindMountSupported) {
- launchInfo.set_clone_namespaces(CLONE_NEWNS);
- }
-#endif // __linux__
-
foreach (const Volume& volume, containerInfo.volumes()) {
if (!volume.has_source() ||
!volume.source().has_type() ||