mesos-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Yan Xu (JIRA)" <j...@apache.org>
Subject [jira] [Comment Edited] (MESOS-6526) `mesos-containerizer launch --environment` exposes executor env vars in `ps`.
Date Wed, 02 Nov 2016 01:24:58 GMT

    [ https://issues.apache.org/jira/browse/MESOS-6526?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15627289#comment-15627289
] 

Yan Xu edited comment on MESOS-6526 at 11/2/16 1:24 AM:
--------------------------------------------------------

Will you guys be able to get to this one soon? If not we can pick it up.


was (Author: xujyan):
Will you guys able to get to this one soon? If not we can pick it up.

> `mesos-containerizer launch --environment` exposes executor env vars in `ps`.
> -----------------------------------------------------------------------------
>
>                 Key: MESOS-6526
>                 URL: https://issues.apache.org/jira/browse/MESOS-6526
>             Project: Mesos
>          Issue Type: Bug
>          Components: containerization
>    Affects Versions: 1.1.0
>            Reporter: Yan Xu
>            Priority: Critical
>
> With MESOS-6323, the helper {{mesos-containerizer launch}} takes a `--environment` flag
for the env vars used by the executor. This is unpleasant because its a common practice that
people use env vars to hide configs that are sensitive and now it's visible to non-root users
on the host with a {{ps}} command.
> Given that we want to separate the environments of {{mesos-containerizer launch}} and
the executor itself, perhaps we can just package and serialize the executor env vars in one
env var {{MESOS_EXECUTOR_ENVIRONMENT}} and pass that to {{mesos-containerizer launch}} which
could then get it through a flag the usual way. 
> In general Mesos should do more to protect env vars but I'll file separate issues for
them.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message