[jira] [Issue Comment Deleted] (MESOS-6566) The Docker executor should not leak task env variables in the Docker command cmd line.

["Gavin (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Gavin updated MESOS-6566:
-------------------------
    Comment: was deleted

(was: www.rtat.net)

> The Docker executor should not leak task env variables in the Docker command cmd line.
> --------------------------------------------------------------------------------------
>
>                 Key: MESOS-6566
>                 URL: https://issues.apache.org/jira/browse/MESOS-6566
>             Project: Mesos
>          Issue Type: Bug
>          Components: docker, security
>            Reporter: Gastón Kleiman
>            Assignee: Till Toenshoff
>            Priority: Major
>             Fix For: 1.2.0
>
>
> Task environment variables are sensitive, as they might contain secrets.
> The Docker executor starts tasks by executing a {{docker run}} command, and it includes the env variables in the cmd line of the docker command, exposing them to all the users in the machine:
> {code}
> $ ./src/mesos-execute --command="sleep 200" --containerizer=docker --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050 --name=test
> $ ps aux | grep bar
> [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine -c sleep 200
> $
> {code}
> The Docker executor could pass Docker the {{--env-file}} flag, pointing it to a file with the environment variables.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)