You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@aurora.apache.org by Benjamin Staffin <be...@folsomlabs.com> on 2016/01/10 01:43:58 UTC
Re: Review Request 34568: run tasks as user that match aurora-role
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/34568/#review113633
-----------------------------------------------------------
Any chance of getting this merged? It might be a surprise to some users, since right now there's no requirement for matching role accounts to exist inside the docker images, but with the right documentation about how to retain the "always root in the container" behavior it ought to be ok.
- Benjamin Staffin
On Nov. 2, 2015, 10:26 a.m., Bhuvan Arumugam wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/34568/
> -----------------------------------------------------------
>
> (Updated Nov. 2, 2015, 10:26 a.m.)
>
>
> Review request for Aurora, Kevin Sweeney and Zameer Manji.
>
>
> Bugs: AURORA-1237
> https://issues.apache.org/jira/browse/AURORA-1237
>
>
> Repository: aurora
>
>
> Description
> -------
>
> The tasks inside container should run as user that match aurora-role, if
> --nosetuid option is not passed for executor.
>
> Testing Done:
> ./pants test.pytest --no-fast --options='--verbose' src/test/python::
>
> Bugs closed: AURORA-1237
>
>
> Diffs
> -----
>
> src/main/python/apache/aurora/executor/thermos_task_runner.py 8ce9168
>
> Diff: https://reviews.apache.org/r/34568/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Bhuvan Arumugam
>
>
Re: Review Request 34568: run tasks as user that match aurora-role
Posted by Benjamin Staffin <be...@gmail.com>.
> On Jan. 9, 2016, 4:43 p.m., Benjamin Staffin wrote:
> > Any chance of getting this merged? It might be a surprise to some users, since right now there's no requirement for matching role accounts to exist inside the docker images, but with the right documentation about how to retain the "always root in the container" behavior it ought to be ok.
>
> Bill Farner wrote:
> Unless Bhuvan is willing to revisit, you might have to take over the patch (which i would welcome). I would like to see a few changes to accept this:
> - enabled with a flag to the executor at least for the first release
> - e2e test case verifying the expected behavior
Here's my take on it, currently sans tests: https://reviews.apache.org/r/43027/
- Benjamin
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/34568/#review113633
-----------------------------------------------------------
On Nov. 2, 2015, 10:26 a.m., Bhuvan Arumugam wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/34568/
> -----------------------------------------------------------
>
> (Updated Nov. 2, 2015, 10:26 a.m.)
>
>
> Review request for Aurora, Kevin Sweeney and Zameer Manji.
>
>
> Bugs: AURORA-1237
> https://issues.apache.org/jira/browse/AURORA-1237
>
>
> Repository: aurora
>
>
> Description
> -------
>
> The tasks inside container should run as user that match aurora-role, if
> --nosetuid option is not passed for executor.
>
> Testing Done:
> ./pants test.pytest --no-fast --options='--verbose' src/test/python::
>
> Bugs closed: AURORA-1237
>
>
> Diffs
> -----
>
> src/main/python/apache/aurora/executor/thermos_task_runner.py 8ce9168
>
> Diff: https://reviews.apache.org/r/34568/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Bhuvan Arumugam
>
>
Re: Review Request 34568: run tasks as user that match aurora-role
Posted by Bill Farner <wf...@apache.org>.
> On Jan. 9, 2016, 4:43 p.m., Benjamin Staffin wrote:
> > Any chance of getting this merged? It might be a surprise to some users, since right now there's no requirement for matching role accounts to exist inside the docker images, but with the right documentation about how to retain the "always root in the container" behavior it ought to be ok.
Unless Bhuvan is willing to revisit, you might have to take over the patch (which i would welcome). I would like to see a few changes to accept this:
- enabled with a flag to the executor at least for the first release
- e2e test case verifying the expected behavior
- Bill
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/34568/#review113633
-----------------------------------------------------------
On Nov. 2, 2015, 10:26 a.m., Bhuvan Arumugam wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/34568/
> -----------------------------------------------------------
>
> (Updated Nov. 2, 2015, 10:26 a.m.)
>
>
> Review request for Aurora, Kevin Sweeney and Zameer Manji.
>
>
> Bugs: AURORA-1237
> https://issues.apache.org/jira/browse/AURORA-1237
>
>
> Repository: aurora
>
>
> Description
> -------
>
> The tasks inside container should run as user that match aurora-role, if
> --nosetuid option is not passed for executor.
>
> Testing Done:
> ./pants test.pytest --no-fast --options='--verbose' src/test/python::
>
> Bugs closed: AURORA-1237
>
>
> Diffs
> -----
>
> src/main/python/apache/aurora/executor/thermos_task_runner.py 8ce9168
>
> Diff: https://reviews.apache.org/r/34568/diff/
>
>
> Testing
> -------
>
>
> Thanks,
>
> Bhuvan Arumugam
>
>