make job containers isolated from host network
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 2.7k
- Forks
- 554
- Avg merge
- 20h 42m
- Merged PRs (30d)
- 14
Description
Currently, all OpenPAI job containers use hostNetwork: true in their pod definition. It will make host network resource like ip/port available to job containers. In shaiic's case, they want the job container fully isolated from host network. We could change https://github.com/microsoft/pai/blob/d61a97156d05d88c51195691c1cc092a77c350ed/src/rest-server/src/models/v2/job/k8s.js#L637 to achieve it, but I'm not sure if it will bring any side effect.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at src/rest-server/src/models/v2/job/k8s.js around line 637 and inspect how the job pod definition sets hostNetwork. Check Kubernetes networking behavior and the possible side effects of changing this setting, then verify that OpenPAI job containers no longer share the host network while the existing job behavior remains functional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, kubernetes
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100