[
https://issues.apache.org/jira/browse/MESOS-7853?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16114492#comment-16114492
]
James Peach commented on MESOS-7853:
------------------------------------
I don't think this is the right approach. A very common use case for this would
be for the executor to be in PID namespace "A" and for all the nested
containers to be in PID namespace "B" together. How can you support this with
this protobuf definition? The only scenario this can support is joining the
executor namespace, which is undesirable in many cases, since the executor is
in a different security domain.
> Support shared PID namespace.
> -----------------------------
>
> Key: MESOS-7853
> URL: https://issues.apache.org/jira/browse/MESOS-7853
> Project: Mesos
> Issue Type: Task
> Components: containerization
> Reporter: Gilbert Song
> Assignee: Qian Zhang
> Labels: containerizer, mesosphere, namespaces
>
> Currently, with the 'namespaces/pid' isolator enabled, each container will
> have its own pid namespace. This does not meet the need for some scenarios.
> For example, under the same executor container, one task wants to reach out
> to another task which need to share the same pid namespace.
> We should support container pid namespace to be configurable. Users can
> choose one container to share its parent's pid namespace or not.
> User facing API:
> {noformat}
> message LinuxInfo {
> ......
> // True if it shares the pid namepace with its parent. If the
> // container is a top level container, it means share the pid
> // namespace with the agent. If the container is a nested
> // container, it means share the pid namespce with its parent
> // container. This field will be ignored if 'namespaces/pid'
> // isolator is not enabled.
> optional bool share_pid_namespace = 4;
> }
> {noformat}
> A new agent flag:
> --disallow_top_level_pid_ns_sharing (defaults to be: false)
> this is a security concern from operator's perspective. While some of the
> nested containers share the pid namespace from their parents, the top level
> containers always not share the pid ns from the agent.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
