Docker on YARN configuration properties

You can use the properties under the Docker on YARN filter in Cloudera Manager to configure the Docker on YARN feature.


Name	Property	Default value	Description
Enable Docker Containers		`false` (unselected)	Specifies if Docker containers in YARN are enabled.
Allowed Linux Runtimes	`yarn.nodemanager.runtime.linux.allowed-runtimes`	`default`	Specifies the runtimes that are allowed when LinuxContainerExecutor is used.
Sleep Delay Before SIGKILL	`yarn.nodemanager.sleep-delay-before-sigkill.ms`	10 (ms)	Specifies the time in milliseconds between sending a SIGTERM and a SIGKILL signal to a running container.
Allowed Docker Container Networks	`yarn.nodemanager.runtime.linux.docker.allowed-container-networks`	`host, none, bridge`	Specifies the networks that are allowed for Docker containers. Valid values are determined by Docker networks available from the `docker network ls` command.
Default Docker Container Network	`yarn.nodemanager.runtime.linux.docker.default-container-network`	`host`	Specifies which allowed network is used when launching Docker containers but no network is specifies in the request. This network must be added to `yarn.nodemanager.runtime.linux.docker.allowed-container-network`.
Allow Using Host PID Namespace for Docker Containers	`yarn.nodemanager.runtime.linux.docker.host-pid-namespace.allowed`	`false` (unselected)	Specifies if Docker containers are allowed to use the host PID namespace.
Allow Privileged Docker Containers	`yarn.nodemanager.runtime.linux.docker.privileged-containers.allowed`	`false` (unselected)	Specifies if applications are allowed to run in privileged containers. Privileged containers are granted the complete set of capabilities and are not subject to the limitations imposed by the device cgroup controller. Use with extreme care!
Allow Delayed Removal of Docker Containers	`yarn.nodemanager.runtime.linux.docker.delayed-removal.allowed`	`false` (unselected)	Specifies if Debug Deletion Delay is used for Docker containers. Debug Deletion Delay is useful for troubleshooting Docker container related launch failures. For more information, see `yarn.nodemanager.delete.debug-delay-sec`.
ACL for Privileged Docker Containers	`yarn.nodemanager.runtime.linux.docker.privileged-containers.acl`	Empty	A comma-separated list that specifies the users who can request privileged Docker containers if privileged Docker containers are allowed.
Docker Capabilities	`yarn.nodemanager.runtime.linux.docker.capabilities`	`CHOWN,DAC_OVERRIDE,FSETID,FOWNER,MKNOD,NET_RAW,SETGID,SETUID,SETFCAP,SETPCAP,NET_BIND_SERVICE,SYS_CHROOT,KILL,AUDIT_WRITE`	Specifies the capabilities assigned to Docker containers when they are launched. The values may not be case-sensitive from a docker perspective, but Cloudera recommends to keep them uppercase.
Enable User Remapping for Docker Containers	`yarn.nodemanager.runtime.linux.docker.enable-userremapping.allowed`	`true`	Specifies if Docker containers can run with the UID (User Identifier) and GID (Group Identifier) of the calling user.
User Remapping UID Threshold for Docker Containers	`yarn.nodemanager.runtime.linux.docker.userremapping-uid-threshold`	`1`	Specifies the minimum UID (User Identifier) for a remapped user. Users with UIDs lower than this minimum value are not allowed to launch Docker containers when user remapping (`yarn.nodemanager.runtime.linux.docker.enable-userremapping.allowed`) is enabled.
User Remapping GID Threshold for Docker Containers	`yarn.nodemanager.runtime.linux.docker.userremapping-gid-threshold`	`1`	Specifies the minimum GID (Group Identifier) for a remapped user. Users with GIDs lower then this minimum value are not allowed to launch Docker containers when user remapping (`yarn.nodemanager.runtime.linux.docker.enable-userremapping.allowed`) is enabled.
Default Read-Only Mounts for Docker Containers	`yarn.nodemanager.runtime.linux.docker.default-ro-mounts`	Although, it is not visible on the UI, the NodeManager Local Directories and Cgroups root are always added to this list.	A list that specifies the default read-only mounts to be bind-mounted into all Docker containers that use DockerContainerRuntime. NodeManager Local Directories and Cgroups root are always added to this list. Ensure that any additional default read-only mounts are also added to the Allowed Read-Only Mounts list.
Default Read-Write Mounts for Docker Containers	`yarn.nodemanager.runtime.linux.docker.default-rw-mounts`	Although, it is not visible on the UI, the NodeManager Local Directories and NodeManager Container Log Directories are always added to this list.	A list that specifies the default read-write mounts to be bind-mounted into all Docker containers that use DockerContainerRuntime. NodeManager Local Directories and NodeManager Container Log Directories are always added to this list. Ensure that any additional default read-write mounts are also added to the Allowed Read-Write Mounts list.
Allowed Read-Only Mounts for Docker Containers	`docker.allowed-ro-mounts`	Although, it is not visible on the UI, the NodeManager Local Directories and Cgroups root are always added to this list.	Specifies the directories that Docker containers are allowed to mount in read-only mode. NodeManager Local Directories and Cgroups root are always added to this list. Ensure that any additional default read-only mounts are also added here.
Allowed Read-Write Mounts for Docker Containers	`docker.allowed-rw-mounts`	Although, it is not visible on the UI, the NodeManager Local Directories and NodeManager Container Log Directories are always added to this list.	Specifies the directories that Docker containers are allowed to mount in read-write mode. NodeManager Local Directories and NodeManager Container Log Directories are always added to this list. Ensure that any additional default read-write mounts are also added here.
Default Tempfs Mounts for Docker Containers	`yarn.nodemanager.runtime.linux.docker.default-tmpfs-mounts`	Empty - no directories are allowed in tmpfs to be mounted.	Specifies the directories in tmpfs that Docker containers are allowed to mount. By default, no directories are allowed in tmpfs to be mounted.
Docker Binary Path	`docker.binary`	`/usr/bin/docker`	Specifies the path of the binary in the hosts that is used to launch Docker containers.
Allowed Devices for Docker Containers	`docker.allowed.devices`	Empty - no devices are allowed to be mounted.	Specifies the devices that Docker containers are allowed to mount.
Allowed Volume Drivers for Docker Containers	`docker.allowed.volume-drivers`	Empty - no volume drivers are allowed.	Specifies the volume drivers which are allowed to be used with Docker.
Enable No-new-privileges Flag for Docker Containers	`docker.no-new-privileges.enabled`	`false` (unselected)	Specifies if the no-new-privileges flag for docker run is enabled. The no-new-privileges flag ensures that the process or its children processes do not gain any additional privileges.
Trusted Registries for Docker Containers	`docker.trusted-registries`	Empty - no registries are defined.	A list that specifies the trusted docker registries for running trusted Docker containers.