[
https://issues.apache.org/jira/browse/YARN-8376?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16792049#comment-16792049
]
Eric Badger commented on YARN-8376:
-----------------------------------
bq. If docker.trusted.no-privileged.registries is introduced, then it still
require admin to change configuration to move non-privileged images to
docker.non-privileged.registries. No?
Sorry, I didn't explain it fully. If {{docker.trusted.registries}} exists and
neither {{docker.trusted.privileged.registries}} nor
{{docker.trusted.non-privileged.registries}} exists, then we could map
{{docker.trusted.registries}} to both of the new configs. The old functionality
didn't split these configs up, so we could map the single old config into the 2
new ones. If either of the new configs are set, however, then
{{docker.trusted.registries}} would be ignored (or we could throw an error)
> Separate white list for docker.trusted.registries and
> docker.privileged-container.registries
> --------------------------------------------------------------------------------------------
>
> Key: YARN-8376
> URL: https://issues.apache.org/jira/browse/YARN-8376
> Project: Hadoop YARN
> Issue Type: Sub-task
> Reporter: Eric Yang
> Assignee: Eric Yang
> Priority: Major
> Labels: docker
> Attachments: YARN-8376.001.patch, YARN-8376.002.patch
>
>
> In the ideal world, it would be possible to have separate white lists for
> docker registry depending on the security requirement for each type of docker
> images:
> 1. Registries from which we can run non-privileged containers without mounts
> 2. Registries from which we can run non-privileged containers with mounts
> 3. Registries from which we can run privileged or non-privileged containers
> with mounts
> In the current implementation, there are only type 1 and type 2 or 3. It
> would be nice to definite a separate white list to differentiate between 2
> and 3.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
