-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
'nomad alloc exec' with 'raw_exec' driver doesn't respect task 'user' field #9210
Comments
Can you please also support setting the user in Windows? Please note that in Windows, you also need to define the password. It would also be pretty interesting to support Group Managed Service Accounts and Local Service Accounts (these do not have a user managed password, as such, are more convenient to use). Please note these require the application to run (or be wrapped) as a Windows service. |
@rgl your suggestion looks unrelated to this issue, which is about the |
Indeed, I've now opened #9424. |
Fix #9210 . This update the executor so it honors the User when using nomad alloc exec. The bug was that the exec task didn't honor the init command when execing.
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Using the following jobspec with the
user
field on the task :The task runs as
nobody
, butnomad alloc exec
is running as Nomad's user (root
):Note that because in clusters with ACLs this requires the highly-privileged
node-alloc-exec
capability, which isn't included in thewrite
coarse-grained capability and which is specifically warned as breaking filesystem isolation, there's no privilege escalation available here. It is a surprising behavior and one we want to have fixed.But I've also double-checked that drivers like
exec
still give younobody
when younomad alloc exec
and those are working as expected.The text was updated successfully, but these errors were encountered: