You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@mesos.apache.org by gi...@apache.org on 2019/05/20 22:12:44 UTC
[mesos] branch 1.7.x updated (4a2949c -> 40ea2b5)
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a change to branch 1.7.x
in repository https://gitbox.apache.org/repos/asf/mesos.git.
from 4a2949c Fixed the broken backport for MESOS-9787.
new cbdf028 Revert "Added MESOS-9536 to the 1.7.3 CHANGELOG."
new 40ea2b5 Revert "Made nested contaienr can access its sandbox via `MESOS_SANDBOX`."
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
CHANGELOG | 1 -
src/slave/containerizer/mesos/containerizer.cpp | 24 ++++++---------------
.../mesos/isolators/filesystem/linux.cpp | 25 ----------------------
3 files changed, 7 insertions(+), 43 deletions(-)
[mesos] 01/02: Revert "Added MESOS-9536 to the 1.7.3 CHANGELOG."
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a commit to branch 1.7.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit cbdf028e03443e7433178f1424839bab2f28cfd2
Author: Gilbert Song <so...@gmail.com>
AuthorDate: Mon May 20 15:12:31 2019 -0700
Revert "Added MESOS-9536 to the 1.7.3 CHANGELOG."
This reverts commit f0cbafdc82bfa9b93df01053c9b1bd5855dc0dba.
---
CHANGELOG | 1 -
1 file changed, 1 deletion(-)
diff --git a/CHANGELOG b/CHANGELOG
index e1ae23c..4f76198 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -6,7 +6,6 @@ Release Notes - Mesos - Version 1.7.3 (WIP)
* [MESOS-8467] - Destroyed executors might be used after `Slave::publishResource()`.
* [MESOS-9507] - Agent could not recover due to empty docker volume checkpointed files.
* [MESOS-9529] - `/proc` should be remounted even if a nested container set `share_pid_namespace` to true.
- * [MESOS-9536] - Nested container launched with non-root user may not be able to write to its sandbox via the environment variable `MESOS_SANDBOX`.
* [MESOS-9549] - nvidia/cuda 10 does not work on GPU isolator.
* [MESOS-9564] - Logrotate container logger lets tasks execute arbitrary commands in the Mesos agent's namespace.
* [MESOS-9568] - SLRP does not clean up mount directories for destroyed MOUNT disks.
[mesos] 02/02: Revert "Made nested contaienr can access its sandbox
via `MESOS_SANDBOX`."
Posted by gi...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
gilbert pushed a commit to branch 1.7.x
in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 40ea2b571b62dc90bacb80b4977b30da6c73a48f
Author: Gilbert Song <so...@gmail.com>
AuthorDate: Mon May 20 15:12:33 2019 -0700
Revert "Made nested contaienr can access its sandbox via `MESOS_SANDBOX`."
This reverts commit beaae8df702e51102069b2b0502e924697ae36a2.
---
src/slave/containerizer/mesos/containerizer.cpp | 24 ++++++---------------
.../mesos/isolators/filesystem/linux.cpp | 25 ----------------------
2 files changed, 7 insertions(+), 42 deletions(-)
diff --git a/src/slave/containerizer/mesos/containerizer.cpp b/src/slave/containerizer/mesos/containerizer.cpp
index 1867f3b..e8a4ab3 100644
--- a/src/slave/containerizer/mesos/containerizer.cpp
+++ b/src/slave/containerizer/mesos/containerizer.cpp
@@ -1779,25 +1779,15 @@ Future<Containerizer::LaunchResult> MesosContainerizerProcess::_launch(
if (container->containerClass() == ContainerClass::DEFAULT) {
// TODO(jieyu): Consider moving this to filesystem isolator.
//
- // NOTE: For the command executor case, although it uses the host filesystem
- // for itself, we still set `MESOS_SANDBOX` according to the root filesystem
- // of the task (if specified). Command executor itself does not use this
- // environment variable. For nested container which does not have its own
- // rootfs, if the `filesystem/linux` isolator is enabled, we will also set
- // `MESOS_SANDBOX` to `flags.sandbox_directory` since in `prepare` method
- // of the `filesystem/linux` isolator we bind mount such nested container's
- // sandbox to `flags.sandbox_directory`. Since such bind mount is only done
- // by the `filesystem/linux` isolator, if another filesystem isolator (e.g.,
- // `filesystem/posix`) is enabled instead, nested container may still have
- // no permission to access its sandbox via `MESOS_SANDBOX`.
+ // NOTE: For the command executor case, although it uses the host
+ // filesystem for itself, we still set 'MESOS_SANDBOX' according to
+ // the root filesystem of the task (if specified). Command executor
+ // itself does not use this environment variable.
Environment::Variable* variable = containerEnvironment.add_variables();
variable->set_name("MESOS_SANDBOX");
- variable->set_value(
- (container->config->has_rootfs() ||
- (strings::contains(flags.isolation, "filesystem/linux") &&
- containerId.has_parent()))
- ? flags.sandbox_directory
- : container->config->directory());
+ variable->set_value(container->config->has_rootfs()
+ ? flags.sandbox_directory
+ : container->config->directory());
}
// `launchInfo.environment` contains the environment returned by
diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
index 93a88a0..a47899c 100644
--- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
+++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp
@@ -202,16 +202,6 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags)
}
}
- // Create sandbox directory. We will bind mount the sandbox of nested
- // container which does not have its own rootfs to this directory. See
- // `prepare` for details.
- Try<Nothing> mkdir = os::mkdir(flags.sandbox_directory);
- if (mkdir.isError()) {
- return Error(
- "Failed to create sandbox directory at '" +
- flags.sandbox_directory + "': " + mkdir.error());
- }
-
Owned<MesosIsolatorProcess> process(
new LinuxFilesystemIsolatorProcess(flags));
@@ -405,21 +395,6 @@ Future<Option<ContainerLaunchInfo>> LinuxFilesystemIsolatorProcess::prepare(
mount->set_source(containerConfig.directory());
mount->set_target(sandbox);
mount->set_flags(MS_BIND | MS_REC);
- } else if (containerId.has_parent()) {
- // For nested container which does not have its own rootfs, bind mount its
- // sandbox to the directory specified via `flags.sandbox_directory` (e.g.,
- // `/mnt/mesos/sandbox`) in its own mount namespace and set the environment
- // variable `MESOS_SANDBOX` to `flags.sandbox_directory` (see the `_launch`
- // method of `MesosContainerizerProcess` for details). The reason that we do
- // this is, in MESOS-8332 we narrowed task sandbox permissions from 0755 to
- // 0750, since nested container's sandbox is subdirectory under its parent's
- // sandbox, if we still set `MESOS_SANDBOX` to `containerConfig.directory()`
- // for nested container, it will not have permission to access its sandbox
- // via `MESOS_SANDBOX` if its user is different from its parent's user.
- ContainerMountInfo* mount = launchInfo.add_mounts();
- mount->set_source(containerConfig.directory());
- mount->set_target(flags.sandbox_directory);
- mount->set_flags(MS_BIND | MS_REC);
}
// Currently, we only need to update resources for top level containers.