[jira] [Commented] (MESOS-6566) The Docker executor should not leak task env variables in the Docker command cmd line.
[
https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16883994#comment-16883994
]
Vinod Kone commented on MESOS-6566:
---
See the description in MESOS-6951 for a potential solution using `--env`
argument.
> The Docker executor should not leak task env variables in the Docker command
> cmd line.
> --
>
> Key: MESOS-6566
> URL: https://issues.apache.org/jira/browse/MESOS-6566
> Project: Mesos
> Issue Type: Bug
> Components: docker, security
>Reporter: Gastón Kleiman
>Assignee: Till Toenshoff
>Priority: Major
>
> Task environment variables are sensitive, as they might contain secrets.
> The Docker executor starts tasks by executing a {{docker run}} command, and
> it includes the env variables in the cmd line of the docker command, exposing
> them to all the users in the machine:
> {code}
> $ ./src/mesos-execute --command="sleep 200" --containerizer=docker
> --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050
> --name=test
> $ ps aux | grep bar
> [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine
> -c sleep 200
> $
> {code}
> The Docker executor could pass Docker the {{--env-file}} flag, pointing it to
> a file with the environment variables.
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
[jira] [Commented] (MESOS-6566) The Docker executor should not leak task env variables in the Docker command cmd line.
[
https://issues.apache.org/jira/browse/MESOS-6566?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16096869#comment-16096869
]
Joseph Wu commented on MESOS-6566:
--
NOTE: We basically reversed this change in {{1.2.1}} because of MESOS-6951.
> The Docker executor should not leak task env variables in the Docker command
> cmd line.
> --
>
> Key: MESOS-6566
> URL: https://issues.apache.org/jira/browse/MESOS-6566
> Project: Mesos
> Issue Type: Bug
> Components: docker, security
>Reporter: Gastón Kleiman
>Assignee: Till Toenshoff
> Fix For: 1.2.0
>
>
> Task environment variables are sensitive, as they might contain secrets.
> The Docker executor starts tasks by executing a {{docker run}} command, and
> it includes the env variables in the cmd line of the docker command, exposing
> them to all the users in the machine:
> {code}
> $ ./src/mesos-execute --command="sleep 200" --containerizer=docker
> --docker_image=alpine --env='{"foo": "bar"}' --master=10.0.2.15:5050
> --name=test
> $ ps aux | grep bar
> [...] docker -H unix:///var/run/docker.sock run [...] -e foo=bar [...] alpine
> -c sleep 200
> $
> {code}
> The Docker executor could pass Docker the {{--env-file}} flag, pointing it to
> a file with the environment variables.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
