This is an automatically generated e-mail. To reply, visit:
(Updated Dec. 26, 2014, 9:05 p.m.)
Review request for Aurora, Jay Buffington, Kevin Sweeney, and Bill Farner.
This should address almost all code review comments. Some notable
* A wrapper script is no longer needed, instead arguments (such as the
announcer config) can be supplied by the scheduler via
-thermos_executor_extra_args. In addition, the task factory will correctly
configure the command line for the executor inside docker. There is still a
small WIP here, although the executor's working directory is now the same
inside and outside the container, it still believes it's running in
$MESOS_SANDBOX because of how getcwd() works (it resolves symlinks).
* What was previously cryptically named --execute_as_container is now
--nosetuid. This causes the runner to not setuid on launch. It is intended
for docker containers but we're already using it outside docker as well. In
this case processes will run was whatever the ambient user is (either inside
the container or outside).
* A flag was added to the scheduler, -allow_docker_mounts, which is an "opt in"
to allow jobs to bind mount into a docker process. As was previously
mentioned, this can compromise security on the host, as any job could bind
mount any part of the file system into the docker container and gain full
* The RunnerHeader no longer has/needs host_log_dir and host_sandbox_dir, and
these are now autodetected if running inside a docker container and correctly
reported to the observer.
* Support for running a container with no executor has been dropped (for now?).
This was because it caused issues with the aurora GC and jobs being lost /
abandoned because there was no executor to check into the observer.
This change adds support for launching docker containers through aurora. These
changes are based off of the discussion in
As of now, a special thermos_executor.sh script is needed to launch the
executor inside docker containers. A sample script is in examples/jobs/docker,
as well as an example aurora file.
In addition, mesos-slave must be run with `--containerizers=docker,mesos`, the
example upstart config in examples/vagrant/upstart has been updated to reflect
The thermos root path defaults to /var/run/thermos, however if a different path
is used, it must be passed to the scheduler via `--thermos_observer_root=<some