[
https://issues.apache.org/jira/browse/YARN-8642?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16593856#comment-16593856
]
Eric Badger commented on YARN-8642:
-----------------------------------
{noformat}
+ const char *regex_str = "^/[^:]+$";
{noformat}
This regex is pretty permissive. Is there anything stopping a user from
maliciously crafting the tmpfs variable? Something like
"YARN_CONTAINER_RUNTIME_DOCKER_TMPFS_MOUNTS=/foo/bar || <execute_bad_code>"?
> Add support for tmpfs mounts with the Docker runtime
> ----------------------------------------------------
>
> Key: YARN-8642
> URL: https://issues.apache.org/jira/browse/YARN-8642
> Project: Hadoop YARN
> Issue Type: Sub-task
> Reporter: Shane Kumpf
> Assignee: Craig Condit
> Priority: Major
> Labels: Docker
> Attachments: YARN-8642.001.patch, YARN-8642.002.patch
>
>
> Add support to the existing Docker runtime to allow the user to request tmpfs
> mounts for their containers. For example:
> {code}/usr/bin/docker run --name=container_name --tmpfs /run image
> /bootstrap/start-systemd
> {code}
> One use case is to allow systemd to run as PID 1 in a non-privileged
> container, /run is expected to be a tmpfs mount in the container for that to
> work.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
