aws / aws/containers-roadmap

Feature Request: Add support for disabling volumes

Open
#353 0 comments 0 reactions 0 assignees View on GitHub
ECS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

In poorly configured Docker environments, volumes can be use to escalate to root on the Docker host. It would be nice if ECS added an attribute if the task definition has volumes.

For example, if a I have a task definition that specifies mount points on the host, then the task definition would get a required attribute like:

```json
{
"requiresAttributes": [
{
"value": null,
"name": "com.amazonaws.ecs.capability.volumes",
"targetId": null,
"targetType": null
}
]
}
```

By default, the ECS agent would be registered with this capability, but could be disabled with a configuration option, so that ECS won't attempt to schedule any tasks that include volumes on the container instance.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how ECS task definitions expose requiresAttributes and how the ECS agent registers capabilities. Check the task-definition handling, scheduling, and container-instance configuration entry points in the relevant repositories. Done means volume-using tasks require the new capability and an agent configuration option can disable scheduling them.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker
Domain
cloud, devops, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.