Linux Container Executor
A setuid binary called container-executor
is part of the hadoop-yarn
package and is installed in /var/lib/hadoop-yarn/bin/container-executor
.
This
container-executor
program, which is used
on YARN only and supported on GNU/Linux only, runs the containers as the user who submitted
the application. It requires all user accounts to be created on the cluster hosts where the
containers are launched. It uses a setuid executable that is included in the Hadoop
distribution. The NodeManager uses this executable to launch and stop containers. The setuid
executable switches to the user who has submitted the application and launches or stops the
containers. For maximum security, this executor sets up restricted permissions and user/group
ownership of local files and directories used by the containers such as the shared objects,
jars, intermediate files, and log files. As a result, only the application owner and
NodeManager can access any of the local files/directories including those localized as part of
the distributed cache.