Mailing-List: contact yarn-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: yarn-issues@hadoop.apache.org
Date: Thu, 30 May 2013 22:57:20 +0000 (UTC)
From: "Bikas Saha (JIRA)" <jira@apache.org>
To: yarn-issues@hadoop.apache.org
Message-ID: <JIRA.12650173.1369933783160.43929.1369954640711@arcas>
In-Reply-To: <JIRA.12650173.1369933783160@arcas>
References: <JIRA.12650173.1369933783160@arcas>
Subject: [jira] [Commented] (YARN-732) YARN support for container isolation
 on Windows
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit


    [ https://issues.apache.org/jira/browse/YARN-732?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13670919#comment-13670919 ] 

Bikas Saha commented on YARN-732:
---------------------------------

I like the idea of not using impersonation to achieve isolation. Would you mind sharing something about the approach/design before submitting patches. That would help shed some light and evoke discussion (better than a patch might IMO). Is the plan to continue to use winutils or create a new launcher executable?
                
> YARN support for container isolation on Windows
> -----------------------------------------------
>
>                 Key: YARN-732
>                 URL: https://issues.apache.org/jira/browse/YARN-732
>             Project: Hadoop YARN
>          Issue Type: New Feature
>          Components: nodemanager
>    Affects Versions: trunk-win
>            Reporter: Kyle Leckie
>              Labels: security
>             Fix For: trunk-win
>
>
> There is no ContainerExecutor on windows that can launch containers in a manner that creates:
> 1) container isolation
> 2) container execution with reduced rights
> I am working on patches that will add the ability to launch containers in a process with a reduced access token. My current approach does not attempt to run the process as the domain user passed into the launchContainer() call. Instead we run as a local user.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira