executor: add option to allow privileged containers

* add a config option allowPrivilegedContainers
* fail task setup if privileged containers are requested but they aren't
allowed.
* report if privileged containers are allowed to the runservice

internal/services/config/config.go

@@ -110,6 +110,8 @@ type Executor struct {
 	Labels map[string]string `yaml:"labels"`
 	// ActiveTasksLimit is the max number of concurrent active tasks
 	ActiveTasksLimit int `yaml:"active_tasks_limit"`
+
+	AllowPrivilegedContainers bool `yaml:"allowPrivilegedContainers"`
 }
 
 type Configstore struct {

internal/services/executor/executor.go

@@ -695,6 +695,7 @@ func (e *Executor) sendExecutorStatus(ctx context.Context) error {
 	executor := &types.Executor{
 		ID:                        e.id,
 		Archs:                     archs,
+		AllowPrivilegedContainers: e.c.AllowPrivilegedContainers,
 		ListenURL:                 e.listenURL,
 		Labels:                    labels,
 		ActiveTasksLimit:          e.c.ActiveTasksLimit,
@@ -834,6 +835,29 @@ func (e *Executor) setupTask(ctx context.Context, rt *runningTask) error {
 		return err
 	}
 
+	setupLogPath := e.setupLogPath(et.ID)
+	if err := os.MkdirAll(filepath.Dir(setupLogPath), 0770); err != nil {
+		return err
+	}
+	outf, err := os.Create(setupLogPath)
+	if err != nil {
+		return err
+	}
+	defer outf.Close()
+
+	// error out if privileged containers are required but not allowed
+	requiresPrivilegedContainers := false
+	for _, c := range et.Containers {
+		if c.Privileged == true {
+			requiresPrivilegedContainers = true
+			break
+		}
+	}
+	if requiresPrivilegedContainers == true && e.c.AllowPrivilegedContainers == false {
+		outf.WriteString("Executor doesn't allow executing privileged containers.\n")
+		return errors.Errorf("executor doesn't allow executing privileged containers")
+	}
+
 	log.Debugf("starting pod")
 
 	dockerConfig, err := registry.GenDockerConfig(et.DockerRegistriesAuth, []string{et.Containers[0].Image})
@@ -869,16 +893,6 @@ func (e *Executor) setupTask(ctx context.Context, rt *runningTask) error {
 		}
 	}
 
-	setupLogPath := e.setupLogPath(et.ID)
-	if err := os.MkdirAll(filepath.Dir(setupLogPath), 0770); err != nil {
-		return err
-	}
-	outf, err := os.Create(setupLogPath)
-	if err != nil {
-		return err
-	}
-	defer outf.Close()
-
 	outf.WriteString("Starting pod.\n")
 	pod, err := e.driver.NewPod(ctx, podConfig, outf)
 	if err != nil {

internal/services/runservice/types/types.go

@@ -605,6 +605,8 @@ type Executor struct {
 
 	Labels map[string]string `json:"labels,omitempty"`
 
+	AllowPrivilegedContainers bool `json:"allow_privileged_containers,omitempty"`
+
 	ActiveTasksLimit int `json:"active_tasks_limit,omitempty"`
 	ActiveTasks      int `json:"active_tasks,omitempty"`