HDP 2.3.4 min_user_id in container-executor.cfg does not take effect

[#1]

According to our documentation any user ID with UID 1000 and up can execute jobs on YARN. In my tests, having a user below the UID min number defined for a cluster still executes a job and I cannot prevent it from executing jobs. Can someone confirm it works with HDP 2.3.4, also does it only take effect in a secure cluster?

[#2]

It will only take effect on secure clusters.

[#3]

Not quite, I was able to make it work using https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html tested on standard sandbox

[#4 · Accepted solution]

Hi Artem, as we discussed, min.user.id (min_user_id is used only in Ambari) and container-executor.cfg are only referenced by LinuxContainerExecutor (LCE). By default, DefaultContainerExecutor is used. More details here (the doc is about Hadoop-2.7.2 but this part applies to 2.7.1 as well). Besides secure clusters LCE can also be used in non-secure ones to enable CGroups.