This is an automated email from the ASF dual-hosted git repository. gilbert pushed a commit to branch 1.6.x in repository https://gitbox.apache.org/repos/asf/mesos.git
commit 25f073d1e53c60a1856326dd7255c8c514c4e85a Author: Gilbert Song <[email protected]> AuthorDate: Mon May 20 15:13:47 2019 -0700 Revert "Made nested contaienr can access its sandbox via `MESOS_SANDBOX`." This reverts commit e5149a4a00625845995e38eaf96c35ef6817be37. --- src/slave/containerizer/mesos/containerizer.cpp | 24 ++++++--------------- .../mesos/isolators/filesystem/linux.cpp | 25 ---------------------- 2 files changed, 7 insertions(+), 42 deletions(-) diff --git a/src/slave/containerizer/mesos/containerizer.cpp b/src/slave/containerizer/mesos/containerizer.cpp index a34978a..6e635d8 100644 --- a/src/slave/containerizer/mesos/containerizer.cpp +++ b/src/slave/containerizer/mesos/containerizer.cpp @@ -1747,25 +1747,15 @@ Future<Containerizer::LaunchResult> MesosContainerizerProcess::_launch( if (container->containerClass() == ContainerClass::DEFAULT) { // TODO(jieyu): Consider moving this to filesystem isolator. // - // NOTE: For the command executor case, although it uses the host filesystem - // for itself, we still set `MESOS_SANDBOX` according to the root filesystem - // of the task (if specified). Command executor itself does not use this - // environment variable. For nested container which does not have its own - // rootfs, if the `filesystem/linux` isolator is enabled, we will also set - // `MESOS_SANDBOX` to `flags.sandbox_directory` since in `prepare` method - // of the `filesystem/linux` isolator we bind mount such nested container's - // sandbox to `flags.sandbox_directory`. Since such bind mount is only done - // by the `filesystem/linux` isolator, if another filesystem isolator (e.g., - // `filesystem/posix`) is enabled instead, nested container may still have - // no permission to access its sandbox via `MESOS_SANDBOX`. + // NOTE: For the command executor case, although it uses the host + // filesystem for itself, we still set 'MESOS_SANDBOX' according to + // the root filesystem of the task (if specified). Command executor + // itself does not use this environment variable. Environment::Variable* variable = containerEnvironment.add_variables(); variable->set_name("MESOS_SANDBOX"); - variable->set_value( - (container->config->has_rootfs() || - (strings::contains(flags.isolation, "filesystem/linux") && - containerId.has_parent())) - ? flags.sandbox_directory - : container->config->directory()); + variable->set_value(container->config->has_rootfs() + ? flags.sandbox_directory + : container->config->directory()); } // `launchInfo.environment` contains the environment returned by diff --git a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp index b3d1d4e..2844327 100644 --- a/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp +++ b/src/slave/containerizer/mesos/isolators/filesystem/linux.cpp @@ -203,16 +203,6 @@ Try<Isolator*> LinuxFilesystemIsolatorProcess::create(const Flags& flags) } } - // Create sandbox directory. We will bind mount the sandbox of nested - // container which does not have its own rootfs to this directory. See - // `prepare` for details. - Try<Nothing> mkdir = os::mkdir(flags.sandbox_directory); - if (mkdir.isError()) { - return Error( - "Failed to create sandbox directory at '" + - flags.sandbox_directory + "': " + mkdir.error()); - } - Owned<MesosIsolatorProcess> process( new LinuxFilesystemIsolatorProcess(flags)); @@ -406,21 +396,6 @@ Future<Option<ContainerLaunchInfo>> LinuxFilesystemIsolatorProcess::prepare( mount->set_source(containerConfig.directory()); mount->set_target(sandbox); mount->set_flags(MS_BIND | MS_REC); - } else if (containerId.has_parent()) { - // For nested container which does not have its own rootfs, bind mount its - // sandbox to the directory specified via `flags.sandbox_directory` (e.g., - // `/mnt/mesos/sandbox`) in its own mount namespace and set the environment - // variable `MESOS_SANDBOX` to `flags.sandbox_directory` (see the `_launch` - // method of `MesosContainerizerProcess` for details). The reason that we do - // this is, in MESOS-8332 we narrowed task sandbox permissions from 0755 to - // 0750, since nested container's sandbox is subdirectory under its parent's - // sandbox, if we still set `MESOS_SANDBOX` to `containerConfig.directory()` - // for nested container, it will not have permission to access its sandbox - // via `MESOS_SANDBOX` if its user is different from its parent's user. - ContainerMountInfo* mount = launchInfo.add_mounts(); - mount->set_source(containerConfig.directory()); - mount->set_target(flags.sandbox_directory); - mount->set_flags(MS_BIND | MS_REC); } // Currently, we only need to update resources for top level containers.
