[
https://issues.apache.org/jira/browse/MESOS-8213?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gavin updated MESOS-8213:
-------------------------
Comment: was deleted
(was: www.rtat.net)
> Private user namespaces for tasks
> ---------------------------------
>
> Key: MESOS-8213
> URL: https://issues.apache.org/jira/browse/MESOS-8213
> Project: Mesos
> Issue Type: Improvement
> Components: containerization, security
> Reporter: James Peach
> Assignee: James Peach
> Priority: Major
>
> Once MESOS-8142 implements generic user namespace support, we can improve
> security by adding another layer of user namespace that encapsulates just the
> final user task. This protects the kernel objects that are providing the
> containerization from the user task (since the private task namespace would
> no longer own the other namespaces).
> This still would not alter the ID mapping of the user namespace.
> This is a little tricky since we need to make the new namespace in the mess
> containerizer, so we need to take care of:
> * when to chroot
> * when to drop capabilities after entering the new namespace
> * supporting command, default and custom executors (does the latter make
> sense?)
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
