Configuration for task namespace isolation in driver plugin #9969
Assignees
Labels
stage/accepted
Confirmed, and intend to work on. No timeline committment though.
theme/driver
type/enhancement
Comments
shoenig
added
stage/accepted
shoenig
added a commit
that referenced
this issue
Feb 5, 2021
…space behavior. This PR adds default_pid_mode and default_ipc_mode options to the exec and java task drivers. By default these will default to "private" mode, enabling PID and IPC isolation for tasks. Setting them to "host" mode disables isolation. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9969
shoenig
added a commit
that referenced
this issue
Feb 5, 2021
…space behavior. This PR adds default_pid_mode and default_ipc_mode options to the exec and java task drivers. By default these will default to "private" mode, enabling PID and IPC isolation for tasks. Setting them to "host" mode disables isolation. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9969
shoenig
added a commit
that referenced
this issue
Feb 5, 2021
…space behavior. This PR adds default_pid_mode and default_ipc_mode options to the exec and java task drivers. By default these will default to "private" mode, enabling PID and IPC isolation for tasks. Setting them to "host" mode disables isolation. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9969
shoenig
added a commit
that referenced
this issue
Feb 5, 2021
…space behavior. This PR adds default_pid_mode and default_ipc_mode options to the exec and java task drivers. By default these will default to "private" mode, enabling PID and IPC isolation for tasks. Setting them to "host" mode disables isolation. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9969
shoenig
added a commit
that referenced
this issue
Feb 8, 2021
… isolation behavior This PR adds pid_mode and ipc_mode options to the exec and java task driver config options. By default these will defer to the default_pid_mode and default_ipc_mode agent plugin options created in #9969. Setting these values to "host" mode disables isolation for the task. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9970
shoenig
added a commit
that referenced
this issue
Feb 8, 2021
… isolation behavior This PR adds pid_mode and ipc_mode options to the exec and java task driver config options. By default these will defer to the default_pid_mode and default_ipc_mode agent plugin options created in #9969. Setting these values to "host" mode disables isolation for the task. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9970
shoenig
added a commit
that referenced
this issue
Feb 8, 2021
… isolation behavior This PR adds pid_mode and ipc_mode options to the exec and java task driver config options. By default these will defer to the default_pid_mode and default_ipc_mode agent plugin options created in #9969. Setting these values to "host" mode disables isolation for the task. Doing so is not recommended, but may be necessary to support legacy job configurations. Closes #9970
|
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Nomad v1.0.3 fixes a security issue where task PID and IPC namespaces were shared among tasks using the same user. To re-enable the previous behavior, we can add configuration options to the exec-based driver plugins, e.g.
default_pid_mode: "private" or "host" [default: "private"]default_ipc_mode: "private" or "host" [default: "private"]These would be applied cluster-wide to all tasks using an exec-based task driver (e.g.
execandjava).The text was updated successfully, but these errors were encountered: