> On Sept. 10, 2016, 6:23 p.m., Jie Yu wrote: > > src/slave/containerizer/mesos/isolators/linux/capabilities.cpp, lines 47-49 > > <https://reviews.apache.org/r/50271/diff/9/?file=1495004#file1495004line47> > > > > We need to have special case for command tasks (i.e., > > containerConfig.has_task_info()). > > > > For command tasks, we need to make sure the executor is running under > > root, having all capabilities. I.e., `launchInfo.capability` should not be > > set. > > > > Instead, we need to add a new flag to command executor > > (`--capabilities`) and command executor will pass that to > > `mesos-containerizer launch` helper.
You need this patch: https://reviews.apache.org/r/51784 - Jie ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/50271/#review148399 ----------------------------------------------------------- On Sept. 9, 2016, 3:26 p.m., Benjamin Bannier wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/50271/ > ----------------------------------------------------------- > > (Updated Sept. 9, 2016, 3:26 p.m.) > > > Review request for mesos, Jay Guo and Jie Yu. > > > Bugs: MESOS-5275 > https://issues.apache.org/jira/browse/MESOS-5275 > > > Repository: mesos > > > Description > ------- > > This isolator evaluates agent allowed capabilities and passes net > capabilities on to `mesos-containerizer` which enforces the > capabilities. > > Capability information is passed via a new field in > `ContainerLaunchInfo`. > > > Diffs > ----- > > include/mesos/slave/containerizer.proto > 16dd3a19145b9764273cdb9a8899e353c98730e5 > src/CMakeLists.txt 01ef494f7120156de3b826d7def76fb30bcc61b5 > src/Makefile.am 15b9a63822eca8d0b428191940026756fba7821e > src/slave/containerizer/mesos/containerizer.cpp > 89b7e8db38916d69d9b2d4fe305d4397b0859a10 > src/slave/containerizer/mesos/isolators/linux/capabilities.hpp PRE-CREATION > src/slave/containerizer/mesos/isolators/linux/capabilities.cpp PRE-CREATION > src/tests/containerizer/isolator_tests.cpp > f8056ca08029feed5f164d4f94e24d521183bdfc > > Diff: https://reviews.apache.org/r/50271/diff/ > > > Testing > ------- > > `make check` and `sudo make check` (Debian jessie, gcc-4.9.2, w/o > optimizations) > > > Thanks, > > Benjamin Bannier > >
