Feature Request: Add support for disabling volumes
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
In poorly configured Docker environments, volumes can be use to escalate to root on the Docker host. It would be nice if ECS added an attribute if the task definition has volumes.
For example, if a I have a task definition that specifies mount points on the host, then the task definition would get a required attribute like:
```json
{
"requiresAttributes": [
{
"value": null,
"name": "com.amazonaws.ecs.capability.volumes",
"targetId": null,
"targetType": null
}
]
}
```
By default, the ECS agent would be registered with this capability, but could be disabled with a configuration option, so that ECS won't attempt to schedule any tasks that include volumes on the container instance.
Contributor guide
Research direction
Start by tracing how ECS task definitions expose requiresAttributes and how the ECS agent registers capabilities. Check the task-definition handling, scheduling, and container-instance configuration entry points in the relevant repositories. Done means volume-using tasks require the new capability and an agent configuration option can disable scheduling them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker
- Domain
- cloud, devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100