[
https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16883994#comment-16883994
]
Vinod Kone commented on MESOS-6566:
-----------------------------------
See the description in MESOS-6951 for a potential solution using `--env`
argument.
> The Docker executor should not leak task env variables in the Docker command
> cmd line.
> --------------------------------------------------------------------------------------
>
> Key: MESOS-6566
> URL: https://issues.apache.org/jira/browse/MESOS-6566
> Project: Mesos
> Issue Type: Bug
> Components: docker, security
> Reporter: Gastón Kleiman
> Assignee: Till Toenshoff
> Priority: Major
>
> Task environment variables are sensitive, as they might contain secrets.
> The Docker executor starts tasks by executing a {{docker run}} command, and
> it includes the env variables in the cmd line of the docker command, exposing
> them to all the users in the machine:
> {code}
> $ ./src/mesos-execute --command="sleep 200" --containerizer=docker
> --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050
> --name=test
> $ ps aux | grep bar
> [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine
> -c sleep 200
> $
> {code}
> The Docker executor could pass Docker the {{--env-file}} flag, pointing it to
> a file with the environment variables.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
