kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

drivers/docker+exec+java: disable net_raw capability by default

Browse Source 
The default Linux Capabilities set enabled by the docker, exec, and
java task drivers includes CAP_NET_RAW (for making ping just work),
which has the side affect of opening an ARP DoS/MiTM attack between
tasks using bridge networking on the same host network.

https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

This PR disables CAP_NET_RAW for the docker, exec, and java task
drivers. The previous behavior can be restored for docker using the
allow_caps docker plugin configuration option.

A future version of nomad will enable similar configurability for the
exec and java task drivers.
This commit is contained in:
Seth Hoenig
2021-05-12 13:22:09 -07:00
committed by Michael Schurter
parent 1235684be7
commit 003d68fe6d
9 changed files with 416 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/shared/executor/executor_linux_test.go
View File

@@ -478,7 +478,7 @@ func TestExecutor_Capabilities(t *testing.T) {
CapInh: 0000000000000000
CapPrm: 0000000000000000
CapEff: 0000000000000000
CapBnd: 0000003fffffffff
CapBnd: 0000003fffffdfff
CapAmb: 0000000000000000`,
},
{