LSF 10.x Docker integration: JOB_STARTER runs as root and does 'docker run -user <XXX>'

From: Khalid Ahmed
Date: Wednesday, March 2, 2016 at 12:23 PM
To: "Miller, Michael D"
Cc: John Toppa , Frank N Lee
Subject: Re: Fw: Follow up items

Hi Michael,

It was nice meeting with you last week in Groton. We are glad to work with you to address your requirements for Docker integration in LSF.

In current integration , we execute the 'docker run' command through the JOB_STARTER as the user who submitted the job. This is the default behaviour and as you indicate it would require the user to be the Docker group. We think an alternative would be to run the JOB_STARTER as root and do a 'docker run -user ' so that the command inside the container will run as the user. Will this work in your environment? If so would you log an RFE so that our PM has visibility and can track your requirement and ensure its gets addressed. You can just copy this email thread. If you have other questions or would like to have a deeper discussion with someone from our development side about your use case around Docker, let me know and I can try and arrange a time.

Khalid Ahmed
IBM Systems and Technology Group
STSM, Chief Architect - Systems Software, IBM Platform
3600 Steeles Avenue East
Markham, Ontario
L3R 9Z7
Internal Mail: E6/53N/3600/MKM
Tel: +1 905 316 2212
Email: khalida@ca.ibm.com

John Toppa---03/01/2016 04:04:50 PM---As mentioned here is the follow up from Mike Miller. Please respond to Mike directly and copy me.


----- Forwarded by John Toppa/Providence/IBM on 03/01/2016 04:03 PM -----

From: "Miller, Michael D"
To: John Toppa/Providence/IBM@IBMUS,
Date: 02/29/2016 03:21 PM
Subject: Follow up items
________________________________________



John

There were average items for follow up from the Friday meeting including the Watson briefing, I would like to get that on my calendar for this week. Also there were requests for more information on the database and LSF. I have one additional request/requirement for docker in LSF which is that LSF run the container not the user. We didn't get into specifics but (I believe) it would be impractical and pose a security risk if users can run containers outside of LSF because they are in the docket group

Mike


DR. MICHAEL D. MILLER: Sr Director High Performance ComputingResearch Business Technology |
Office: +1 860 715 4008 | Mobile: +1 860 237 0132 | Email: michael.d.miller@pfizer.com
Eastern Point Road, Bld 220/447F, Groton, CT 06340
Business Technology