You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by gi...@apache.org on 2019/05/20 22:10:53 UTC
[mesos] branch 1.8.x updated (6c6546d -> f5770dc)
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a change to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git.
from 6c6546d Added MESOS-9786 to the 1.8.1 CHANGELOG.
new 444240d Revert "Added MESOS-9536 to the 1.8.1 CHANGELOG.".
new f5770dc Revert "Made nested contaienr can access its sandbox via `MESOS_SANDBOX`."
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
CHANGELOG | 1 -
src/slave/containerizer/mesos/containerizer.cpp | 24 +++++++---------------
.../mesos/isolators/filesystem/linux.cpp | 23 ---------------------
3 files changed, 7 insertions(+), 41 deletions(-)
[mesos] 01/02: Revert "Added MESOS-9536 to the 1.8.1 CHANGELOG.".
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 444240d144d26654ccad9d90c38cc6f9c53589d1
Author: Gilbert Song <so...@gmail.com>
AuthorDate: Mon May 20 15:10:02 2019 -0700
Revert "Added MESOS-9536 to the 1.8.1 CHANGELOG.".
This reverts commit 616031597e0fcd3476f93b4ead90055502434306.
---
CHANGELOG | 1 -
1 file changed, 1 deletion(-)
diff --git a/CHANGELOG b/CHANGELOG
index 6649f87..431df6a 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,7 +3,6 @@ Release Notes - Mesos - Version 1.8.1 (WIP)
* This is a bug fix release.
** Bug
- * [MESOS-9536] - Nested container launched with non-root user may not be able to write to its sandbox via the environment variable `MESOS_SANDBOX`.
* [MESOS-9616] - `Filters.refuse_seconds` declines resources not in offers.
* [MESOS-9695] - Remove the duplicate pid check in Docker containerizer
* [MESOS-9766] - /__processes__ endpoint can hang.
[mesos] 02/02: Revert "Made nested contaienr can access its sandbox
via `MESOS_SANDBOX`."
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a commit to branch 1.8.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit f5770dcf322bd8a88e6c88041364a4089d92be90
Author: Gilbert Song <so...@gmail.com>
AuthorDate: Mon May 20 15:10:14 2019 -0700
Revert "Made nested contaienr can access its sandbox via `MESOS_SANDBOX`."
This reverts commit d6ac03b3374c1f674c1229e9a6e68df2ea54c0a9.
---
src/slave/containerizer/mesos/containerizer.cpp | 24 +++++++---------------
.../mesos/isolators/filesystem/linux.cpp | 23 ---------------------
2 files changed, 7 insertions(+), 40 deletions(-)
diff --git a/src/slave/containerizer/mesos/containerizer.cpp b/src/slave/containerizer/mesos/containerizer.cpp
index c4a6827..0432448 100644
--- a/src/slave/containerizer/mesos/containerizer.cpp
+++ b/src/slave/containerizer/mesos/containerizer.cpp
@@ -1837,25 +1837,15 @@ Future<Containerizer::LaunchResult> MesosContainerizerProcess::_launch(
if (container->containerClass() == ContainerClass::DEFAULT) {
// TODO(jieyu): Consider moving this to filesystem isolator.
//
- // NOTE: For the command executor case, although it uses the host filesystem
- // for itself, we still set `MESOS_SANDBOX` according to the root filesystem
- // of the task (if specified). Command executor itself does not use this
- // environment variable. For nested container which does not have its own
- // rootfs, if the `filesystem/linux` isolator is enabled, we will also set
- // `MESOS_SANDBOX` to `flags.sandbox_directory` since in `prepare` method
- // of the `filesystem/linux` isolator we bind mount such nested container's
- // sandbox to `flags.sandbox_directory`. Since such bind mount is only done
- // by the `filesystem/linux` isolator, if another filesystem isolator (e.g.,
- // `filesystem/posix`) is enabled instead, nested container may still have
- // no permission to access its sandbox via `MESOS_SANDBOX`.
+ // NOTE: For the command executor case, although it uses the host
+ // filesystem for itself, we still set 'MESOS_SANDBOX' according to
+ // the root filesystem of the task (if specified). Command executor
+ // itself does not use this environment variable.
Environment::Variable* variable = containerEnvironment.add_variables();
variable->set_name("MESOS_SANDBOX");
- variable->set_value(
- (container->config->has_rootfs() ||
- (strings::contains(flags.isolation, "filesystem/linux") &&
- containerId.has_parent()))
- ? flags.sandbox_directory
- : container->config->directory());
+ variable->set_value(container->config->has_rootfs()
+ ? flags.sandbox_directory
+ : container->config->directory());
}
// `launchInfo.environment` contains the environment returned by
diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
index 7b50258..725754f 100644
--- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
@@ -502,16 +502,6 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(
containersRuntimeDir + "': " + mkdir.error());
}
- // Create sandbox directory. We will bind mount the sandbox of nested
- // container which does not have its own rootfs to this directory. See
- // `prepare` for details.
- mkdir = os::mkdir(flags.sandbox_directory);
- if (mkdir.isError()) {
- return Error(
- "Failed to create sandbox directory at '" +
- flags.sandbox_directory + "': " + mkdir.error());
- }
-
Try<Nothing> containersDirMount = ensureAllowDevices(containersRuntimeDir);
if (containersDirMount.isError()) {
return Error(containersDirMount.error());
@@ -754,19 +744,6 @@ Future<Option<ContainerLaunchInfo>> LinuxFilesystemIsolatorProcess::prepare(
*launchInfo.add_mounts() = createContainerMount(
containerConfig.directory(), sandbox, MS_BIND | MS_REC);
- } else if (containerId.has_parent()) {
- // For nested container which does not have its own rootfs, bind mount its
- // sandbox to the directory specified via `flags.sandbox_directory` (e.g.,
- // `/mnt/mesos/sandbox`) in its own mount namespace and set the environment
- // variable `MESOS_SANDBOX` to `flags.sandbox_directory` (see the `_launch`
- // method of `MesosContainerizerProcess` for details). The reason that we do
- // this is, in MESOS-8332 we narrowed task sandbox permissions from 0755 to
- // 0750, since nested container's sandbox is subdirectory under its parent's
- // sandbox, if we still set `MESOS_SANDBOX` to `containerConfig.directory()`
- // for nested container, it will not have permission to access its sandbox
- // via `MESOS_SANDBOX` if its user is different from its parent's user.
- *launchInfo.add_mounts() = createContainerMount(
- containerConfig.directory(), flags.sandbox_directory, MS_BIND | MS_REC);
}
// Currently, we only need to update resources for top level containers.