LinuxContainerExecutor Security Best Practices

[#1]

container-executor.cfg

YARN containers in a secure cluster use the operating system facilities to offer execution isolation for containers. Secure containers execute under the credentials of the job user. The operating system enforces access restriction for the container. The container must run as the user that submitted the application. Therefore it is recommended to never submit jobs from a superuser account (HDFS or Linux) when LinuxContainerExecutor is used.

To prevent superusers from submitting jobs, the container executor configuration (/etc/hadoop/conf/container-executor.cfg) includes the properties banned.users and min.user.id. Attempting to submit a job that violates either of these settings will result in an error indicating the AM container failed to launch:

INFO org.apache.hadoop.yarn.server.resourcemanager.rmapp.RMAppImpl:
 Application application_1234567890123_4567 failed 2 times due to AM 
Container for appattempt_1234567890123_4567_000002 exited with exitCode: -1000

Followed by one of these two diagnostic messages:

Diagnostics: Application application_1234567890123_4567 initialization failed (exitCode=255) with output: 
Requested user hdfs is not whitelisted and has id 507,which is below the minimum allowed 1000

Diagnostics: Application application_1234567890123_4567 initialization failed (exitCode=255) with output: Requested user hdfs is banned

Although it is possible to modify these properties, leaving the default values is recommended for security reasons.

yarn-site.xml yarn.nodemanager.linux-container-executor.group - A special group (e.g. hadoop) with executable permissions for the container executor, of which the NodeManager Unix user is the group member and no ordinary application user is. If any application user belongs to this special group, security will be compromised. This special group name should be specified for the configuration property.

Learn more about YARN Secure Containers from the Apache Hadoop docs.