Agent Options

Note that if the --authorizer flag is provided with a value other than local, the ACLs contents will be ignored.

See the ACLs protobuf in acls.proto for the expected format.

Example:

{
  "get_endpoints": [
    {
      "principals": { "values": ["a"] },
      "paths": { "values": ["/flags", "/monitor/statistics"] }
    }
  ]
}

Example:

{
    "capabilities": [
        {"type": "MULTI_ROLE"},
        {"type": "HIERARCHICAL_ROLE"},
        {"type": "RESERVATION_REFINEMENT"},
        {"type": "AGENT_OPERATION_FEEDBACK"},
        {"type": "RESOURCE_PROVIDER"},
        {"type": "AGENT_DRAINING"},
        {"type": "TASK_RESOURCE_LIMITS"}
    ]
}

--slave_subsystems=VALUE

To set capabilities the agent should have the SETPCAP capability.

This flag is effective iff linux/capabilities isolation is enabled. When linux/capabilities isolation is enabled, the absence of this flag implies that the operator intends to allow ALL capabilities.

Example:

{
  "capabilities": [
    "NET_RAW",
    "SYS_ADMIN"
  ]
}

This flag is effective iff linux/capabilities isolation is enabled. When linux/capabilities isolation is enabled, the absence of this flag implies that the operator intends to allow ALL capabilities.

This flag has the same syntax as --effective_capabilities.

NOTE that since authentication retry cancels the previous authentication request, one should consider what is the normal authentication delay when setting this flag to prevent premature retry.

Note that if the --authorizer flag is provided with a value other than the default local, the ACLs passed through the --acls flag will be ignored.

  * /dev/console
  * /dev/tty0
  * /dev/tty1
  * /dev/pts/*
  * /dev/ptmx
  * /dev/net/tun
  * /dev/null
  * /dev/zero
  * /dev/full
  * /dev/tty
  * /dev/urandom
  * /dev/random

Example:

{
  "allowed_devices": [
    {
      "device": {
        "path": "/path/to/device"
      },
      "access": {
        "read": true,
        "write": false,
        "mknod": false
      }
    }
  ]
}

{
  "principal": "username",
  "secret": "secret"
}

See the ContainerDNS message in `flags.proto` for the expected format.

Example:

{
  "mesos": [
    {
      "network_mode": "CNI",
      "network_name": "net1",
      "dns": {
        "nameservers": [ "8.8.8.8", "8.8.4.4" ]
      }
    }
  ],
  "docker": [
    {
      "network_mode": "BRIDGE",
      "dns": {
        "nameservers": [ "8.8.8.8", "8.8.4.4" ]
      }
    },
    {
      "network_mode": "USER",
      "network_name": "net2",
      "dns": {
        "nameservers": [ "8.8.8.8", "8.8.4.4" ]
      }
    }
  ]
}

See the ContainerInfo protobuf in mesos.proto for the expected format.

Example:

{
  "type": "MESOS",
  "volumes": [
    {
      "host_path": ".private/tmp",
      "container_path": "/tmp",
      "mode": "RW"
    }
  ]
}

{
  "auths": {
    "https://index.docker.io/v1/": {
      "auth": "xXxXxXxXxXx=",
      "email": "username@example.com"
    }
  }
}

{
  "PATH": "/bin:/usr/bin",
  "LD_LIBRARY_PATH": "/usr/local/lib"
}

• The cache directories are transient and not meant to be backed up. Upon restarting the agent, the cache is always empty.
• The cache and container sandboxes can potentially interfere with each other when occupying a shared space (i.e. disk contention).

Example:

{
  "credentials": [
    {
      "principal": "yoda",
      "secret": "usetheforce"
    }
  ]
}

See the ImageGcConfig message in `flags.proto` for the expected format.

In the following example, image garbage collection is configured to sample disk usage every hour, and will attempt to maintain at least 10% of free space on the container image filesystem:

{
  "image_disk_headroom": 0.1,
  "image_disk_watch_interval": {
    "nanoseconds": 3600000000000
  },
  "excluded_images": []
}

NOTE: Currently Mesos doesn't listen on IPv6 sockets and hence this IPv6 address is only used to advertise IPv6 addresses for containers running on the host network.

NOTE: Currently Mesos doesn't listen on IPv6 sockets and hence this IPv6 address is only used to advertise IPv6 addresses for containers running on the host network.

As a key:value list: name(role):value;name:value...

To use JSON, pass a JSON-formatted string or use --resources=filepath to specify the resources via a file containing a JSON-formatted string. 'filepath' can only be of the form file:///path/to/file.

Example JSON:

[
  {
    "name": "cpus",
    "type": "SCALAR",
    "scalar": {
      "value": 24
    }
  },
  {
    "name": "mem",
    "type": "SCALAR",
    "scalar": {
      "value": 24576
    }
  }
]

Example config file in this directory:

{
  "type": "org.mesos.apache.rp.local.storage",
  "name": "lvm"
}

Example config files in this directory:

{
  "type": "org.apache.mesos.csi.managed-plugin",
  "containers": [
    {
      "services": [
        "NODE_SERVICE"
      ],
      "command": {
        "value": " --endpoint=$CSI_ENDPOINT"
      },
      "resources": [
        {"name": "cpus", "type": "SCALAR", "scalar": {"value": 0.1}},
        {"name": "mem", "type": "SCALAR", "scalar": {"value": 1024}}
      ]
    }
  ]
}

{
  "type": "org.apache.mesos.csi.unmanaged-plugin",
  "endpoints": [
    {
      "csi_service": "NODE_SERVICE",
      "endpoint": "/var/lib/unmanaged-plugin/csi.sock"
    }
  ],
  "target_path_root": "/mnt/unmanaged-plugin"
}