Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-6145

Isolator namespaces/pid is leaking mounts

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • None
    • 1.1.0
    • containerization, security
    • None

    Description

      As the operator of a Mesos cluster, I would like every container/executor to run in a single PID namespace, so that a task cannot see what else is running on the same host.

      The existing namespaces/pid isolator seems to provide this feature. However, it seems like it is leaking files. I have exactly one task running currently, but there are still left overs from earlier invocations

      vagrant@aurora:~/aurora$ ls -l /var/run/mesos/pidns/
total 0
-rw-r--r-- 1 root root 0 Aug 26 20:30 32b6e4c7-3d22-47ed-a350-9eb929daa241
-rw-r--r-- 1 root root 0 Aug 26 20:30 7b812f00-4614-4016-a76c-ff78a175a1b0
-rw-r--r-- 1 root root 0 Aug 26 20:24 d501829e-7cf8-40fb-a895-0ad3416da7dc
-rw-r--r-- 1 root root 0 Aug 26 20:24 d56ca91f-eb72-426c-8bbb-f3239358a4ef
-r--r--r-- 1 root root 0 Aug 26 20:35 fef9a109-de52-45f3-ae41-171de6495705

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. MESOS-5893 mesos-executor should adopt and reap orphan child processes

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. MESOS-6180 Several tests are flaky, with futures timing out early

          • Major - Major loss of function.
          • Resolved
          relates to

          Improvement - An improvement or enhancement to an existing feature or task. MESOS-1094 Introduce pid namespace abstraction to subprocess

          • Major - Major loss of function.
          • Open

          Documentation - Documentation or Website MESOS-2725 undocumented how to enable pid namespace isolation and shared filesystem isolation

          • Major - Major loss of function.
          • Accepted

          Activity

            People

              jieyu Jie Yu
              StephanErb Stephan Erb
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: