Mailing-List: contact yarn-issues-help@hadoop.apache.org; run by ezmlm
Precedence: bulk
Date: Mon, 13 Nov 2017 16:55:00 +0000 (UTC)
From: "Eric Yang (JIRA)" <jira@apache.org>
To: yarn-issues@hadoop.apache.org
Message-ID: <JIRA.13115733.1509652717000.222623.1510592100532@Atlassian.JIRA>
In-Reply-To: <JIRA.13115733.1509652717000@Atlassian.JIRA>
References: <JIRA.13115733.1509652717000@Atlassian.JIRA> <JIRA.13115733.1509652717882@jira-lw-us.apache.org>
Subject: [jira] [Commented] (YARN-7430) User and Group mapping are incorrect
 in docker container
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Mon, 13 Nov 2017 16:55:06 -0000


    [ https://issues.apache.org/jira/browse/YARN-7430?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16249817#comment-16249817 ] 

Eric Yang commented on YARN-7430:
---------------------------------

[~ebadger] {quote}
What about the logs written via log4j or some other logging plugin? 
{quote}

We can recommend to write log directly to HDFS via NFS Gateway mount to container.  I have done test in this area, and proved this approach works well.  The scope of these setup are application specific, which we only need documentation for clarity.

Is there any other concern to enable user/group mapping on as default?

> User and Group mapping are incorrect in docker container
> --------------------------------------------------------
>
>                 Key: YARN-7430
>                 URL: https://issues.apache.org/jira/browse/YARN-7430
>             Project: Hadoop YARN
>          Issue Type: Sub-task
>          Components: security, yarn
>    Affects Versions: 2.9.0, 3.0.0
>            Reporter: Eric Yang
>            Assignee: Eric Yang
>            Priority: Blocker
>         Attachments: YARN-7430.001.patch
>
>
> In YARN-4266, the recommendation was to use -u [uid]:[gid] numeric values to enforce user and group for the running user.  In YARN-6623, this translated to --user=test --group-add=group1.  The code no longer enforce group correctly for launched process.  
> In addition, the implementation in YARN-6623 requires the user and group information to exist in container to translate username and group to uid/gid.  For users on LDAP, there is no good way to populate container with user and group information. 


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)

---------------------------------------------------------------------
To unsubscribe, e-mail: yarn-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: yarn-issues-help@hadoop.apache.org