[ https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Vinod Kone reassigned MESOS-6566: --------------------------------- Assignee: (was: Till Toenshoff) > The Docker executor should not leak task env variables in the Docker command > cmd line. > -------------------------------------------------------------------------------------- > > Key: MESOS-6566 > URL: https://issues.apache.org/jira/browse/MESOS-6566 > Project: Mesos > Issue Type: Bug > Components: docker, security > Reporter: Gastón Kleiman > Priority: Major > Labels: containerization > > Task environment variables are sensitive, as they might contain secrets. > The Docker executor starts tasks by executing a {{docker run}} command, and > it includes the env variables in the cmd line of the docker command, exposing > them to all the users in the machine: > {code} > $ ./src/mesos-execute --command="sleep 200" --containerizer=docker > --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050 > --name=test > $ ps aux | grep bar > [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine > -c sleep 200 > $ > {code} > The Docker executor could pass Docker the {{--env-file}} flag, pointing it to > a file with the environment variables. -- This message was sent by Atlassian JIRA (v7.6.14#76016)