> On Aug. 21, 2017, 7:15 a.m., Qian Zhang wrote: > > src/slave/containerizer/mesos/isolators/network/ports.cpp > > Lines 245-246 (patched) > > <https://reviews.apache.org/r/60591/diff/10/?file=1800291#file1800291line245> > > > > Won't agent listen on another available ephemeral port when it is > > restarted? > > James Peach wrote: > The port the agent listens on is never ephemeral; the default is > `0.0.0.0:5051`. Thinking some more about this, it is quite difficult to > prevent a container listening on the agent port. If the agent is running, a > container could only listen on this port if `SO_REUSEPORT` is being used. If > the agent isn't running, then we could not prevent a container taking this > port and thereby preventing the agent starting. > > Qian Zhang wrote: > Agree, so I think we may not need this logic in this isolator.
I'll consider it a bit more today but I think I agree with you :) > On Aug. 21, 2017, 7:15 a.m., Qian Zhang wrote: > > src/slave/flags.cpp > > Lines 1012-1018 (patched) > > <https://reviews.apache.org/r/60591/diff/10/?file=1800293#file1800293line1012> > > > > So by default this flag is not enabled, that means any libprocess-based > > exectuors (e.g., command executor and default executor) will be killed > > since they will listen on ephemeral port? > > James Peach wrote: > Yes, that's correct. > > Qian Zhang wrote: > That is a breaking change. I mean once this code is merged, any > frameworks which uses command executor or default executor (e.g., Marathon) > will be broken since the tasks that they launch will be killed. No, you'd have to enable the isolator to break your containers. - James ----------------------------------------------------------- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/60591/#review183303 ----------------------------------------------------------- On Aug. 21, 2017, 8:36 p.m., James Peach wrote: > > ----------------------------------------------------------- > This is an automatically generated e-mail. To reply, visit: > https://reviews.apache.org/r/60591/ > ----------------------------------------------------------- > > (Updated Aug. 21, 2017, 8:36 p.m.) > > > Review request for mesos, Qian Zhang and Jiang Yan Xu. > > > Bugs: MESOS-7675 > https://issues.apache.org/jira/browse/MESOS-7675 > > > Repository: mesos > > > Description > ------- > > Normally, the `network/ports` isolator will kill any task that > listens on a port that it does not have resources for. However, > executors that are based on the libprocess API will always listen > on a port in the ephemeral range, and we want to make it possible > to use libprocess-based executors. > > Added the `--container_ports_watch_resources_only` option to only > kill tasks when they listen on un-allocated ports within the port > range published by the agent resources. This still prevents port > collisions between tasks, but doesn't kill them just because the > executor is listening on a port. > > > Diffs > ----- > > src/slave/containerizer/mesos/isolators/network/ports.hpp PRE-CREATION > src/slave/containerizer/mesos/isolators/network/ports.cpp PRE-CREATION > src/slave/flags.hpp 2970fea0cfac6af275a758d4bfedfe9a943c2b60 > src/slave/flags.cpp 3b02f3e909a554f15104739832ae3f252926b45f > > > Diff: https://reviews.apache.org/r/60591/diff/12/ > > > Testing > ------- > > make check (Fedora 26) > > > Thanks, > > James Peach > >
