mesos-reviews mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Benjamin Bannier <benjamin.bann...@mesosphere.io>
Subject Re: Review Request 69345: Made non-root containers can access PARENT type SANDBOX_PATH volume.
Date Mon, 25 Feb 2019 14:15:38 GMT

-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/69345/#review213165
-----------------------------------------------------------



How is this patch related to https://reviews.apache.org/r/69542/? Some issues were raised
over there and a discussion started. We should strongly avoid loosing such context as it makes
it harder to understand patches later.

- Benjamin Bannier


On Jan. 29, 2019, 8:34 a.m., Qian Zhang wrote:
> 
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/69345/
> -----------------------------------------------------------
> 
> (Updated Jan. 29, 2019, 8:34 a.m.)
> 
> 
> Review request for mesos, Andrei Budnik, Gilbert Song, Greg Mann, Ilya Pronin, and Jie
Yu.
> 
> 
> Bugs: MESOS-8810
>     https://issues.apache.org/jira/browse/MESOS-8810
> 
> 
> Repository: mesos
> 
> 
> Description
> -------
> 
> If a nested container running as a non-root user tries to use a PARENT
> type SANDBOX_PATH volume, we will make sure the volume owned by a unique
> gid allocated by the volume gid manager and the container process
> launched with that gid as its supplementary group.
> 
> 
> Diffs
> -----
> 
>   include/mesos/slave/containerizer.proto 7d16463fcce3df14d256f5a4f2deb42c482d0734 
>   src/local/local.cpp 608706811486e59b9472c026876d1d84cbccc279 
>   src/slave/containerizer/containerizer.hpp 66f73a306deffc51503479420531ea1948c574e1

>   src/slave/containerizer/containerizer.cpp c6b5e64a72d16b871dcbfc17c05566affea6bd44

>   src/slave/containerizer/mesos/containerizer.hpp 3102b8755c1fa3b205081d0198c6021c02d15ec6

>   src/slave/containerizer/mesos/containerizer.cpp 35f51ad33da53b3e6a8eec275fbf3e77782b0fba

>   src/slave/containerizer/mesos/isolators/volume/sandbox_path.hpp 1631160236379f84c6e1ed1be1370b5f2f2fd563

>   src/slave/containerizer/mesos/isolators/volume/sandbox_path.cpp ecd467c5a33c2f41396bc72ddd7cb806bb8adc52

>   src/slave/containerizer/mesos/launch.cpp 7f401cdf481123b8c6cc500ac02bb7daf2613d2c 
>   src/slave/main.cpp d1ce45455f2867cb71378da122fbd598aca4546d 
>   src/slave/slave.hpp 2bcd7a93a8f25b77c71c7f931bfaac87649f987c 
>   src/slave/slave.cpp ed92f672f5155d70a36ba3619bb6f06fa09bc836 
>   src/tests/cluster.cpp 61489840fb1491ab56fd9edd5bcbb1c1dca2c0d2 
>   src/tests/mock_slave.hpp 3c0d602a981d76dcf10f9e413851e606d835e113 
>   src/tests/mock_slave.cpp a78ca9c7911bb7928a93be6867abe62e8cd20712 
> 
> 
> Diff: https://reviews.apache.org/r/69345/diff/6/
> 
> 
> Testing
> -------
> 
> 
> Thanks,
> 
> Qian Zhang
> 
>


Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message