-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
user
attribute disregard membership in other groups
#2160
Comments
My suspicion is the implementation of |
Any thought on this? |
This PR fixes two issues: * Folder permissions in -dev mode were incorrect and not suitable for running as a particular user. * Was not setting the group membership properly for the launched process. Fixes #2160
@dvusboy Let me know if you want a build to test that PR or if you just want to wait till 0.6.0 RC |
@dadgar I can wait until 0.6.0 RC. Thank you for addressing this. |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Nomad v0.4.1
I'm aware this version is very old, but if my suspicion is correct, the implementation hasn't changed since.
Operating system and Environment details
Issue
I'm using the
raw_exec
driver, and if I specify auser
attribute for a task I run into problem performingdocker
operations. From theexecutor.out
file, this was reported the task command was run with the specified user, but we see error messages like this:The user in the job specification does belong to the group
docker
, but it is not the primary group the user belongs to, that'd beusers
. If it matters, that user is not part of/etc/passwd
, but registered in a directory service.Reproduction steps
Create a user, say
foo
with primary group anything butdocker
. Add said user to thedocker
group. Launch a simple batch job that does not use thedocker
driver and perform a simpledocker
operation likedocker images
. In the example belong, the userfoo
would have attributes like:[root@test /]# foo uid=1000(foo) gid=100(users) groups=100(users),992(docker)
Nomad Server logs (if appropriate)
N/A
Nomad Client logs (if appropriate)
N/A
Job file (if appropriate)
This is a simple job file that can reproduce the problem, given the user
foo
exists on the client node and has the above group membership.The job will repeatedly fail and the follow messages can be seen in the
docker-op.stderr.0
file:While the
docker-op-executor.out
file looks like this:The text was updated successfully, but these errors were encountered: