Commits on May 12, 2021

1. drivers/docker+exec+java: disable net_raw capability by default …

   The default Linux Capabilities set enabled by the docker, exec, and
   java task drivers includes CAP_NET_RAW (for making ping just work),
   which has the side affect of opening an ARP DoS/MiTM attack between
   tasks using bridge networking on the same host network.
   
   https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
   
   This PR disables CAP_NET_RAW for the docker, exec, and java task
   drivers. The previous behavior can be restored for docker using the
   allow_caps docker plugin configuration option.
   
   A future version of nomad will enable similar configurability for the
   exec and java task drivers.

   

   shoenig authored and schmichael committed May 12, 2021
   Configuration menu

   • View commit details
   • Copy full SHA for 003d68f
   • Browse repository at this point

   Copy the full SHA

   003d68f View commit details

   Browse the repository at this point in the history