luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity
open-nomad/.changelog/16375.txt

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

4 lines
96 B
Plaintext
Raw Normal View History

client: disable running artifact downloader as nobody (#16375) * client: disable running artifact downloader as nobody This PR reverts a change from Nomad 1.5 where artifact downloads were executed as the nobody user on Linux systems. This was done as an attempt to improve the security model of artifact downloading where third party tools such as git or mercurial would be run as the root user with all the security implications thereof. However, doing so conflicts with Nomad's own advice for securing the Client data directory - which when setup with the recommended directory permissions structure prevents artifact downloads from working as intended. Artifact downloads are at least still now executed as a child process of the Nomad agent, and on modern Linux systems make use of the kernel Landlock feature for limiting filesystem access of the child process. * docs: update upgrade guide for 1.5.1 sandboxing * docs: add cl * docs: add title to upgrade guide fix
2023-03-08 21:58:43 +00:00
```release-note:bug
client: Fixed a bug where artifact downloading failed on hardened nodes
```