►
From YouTube: Mesos Containerization WG 07272017
Description
Agenda and Notes: https://docs.google.com/a/mesosphere.io/document/d/1z55a7tLZFoRWVuUxz1FZwgxkHeugtc2nHR89skFXSpU/edit?usp=drive_web
Chat with the working group: https://mesos.slack.com/ #containerizer
A
A
B
C
A
A
A
D
A
All
right,
I
think,
let's
get
started
so
this
is
the
mesas
containerization
working
group
I.
Think
today's
topic
is
going
to
be
a
bonding
ownership
and
access
control,
discussion,
I
think
we
have
a
discuss.
We
had
a
discussion
like
it
several
weeks
ago
on
that
and
we
have
a
follow-up
meeting
between
twitter,
guys
and
Apple
guys
after
that,
and
then
we
come
up
with
some
solution,
but
I
still
want
to
end
this
meeting
I
also
pull
nice
and
Microsoft
guys
because
we
want
to
support
Windows
as
well
so
on
yeah.
A
So
we
have
this
sock
I,
think
that's
how
we,
what
we
did
is
we
try
to
capture
all
use
cases
first
and
then
trying
to
see
if
there's
any
options
that
we
can
use
to
to
solve
all
these
use
cases
I
think
we
came
up
with
a
bunch
of
user
stories,
so
the
gist
of
is
to
catch
them.
Folks,
up
if
they're
not
familiar
with
this
issue,
it's
like
so
right
now.
A
So
if
you
look
at
the
word
above
definition
of
methyls
api,
so
there's
a
user
inside
frame
in
both
the
framing
can
set
a
user
and
also
there's
a
user
of
you're
implementing
for
we're
like
going
along
to
connect
and
specify
the
user
that
we
want
to
launch
the
command
on
and
that
user
match
to
unique
UNIX
account
on
the
agent
at
the
moment
on
so
on.
So
that's
kind
of
design
constraint
because
we
need
to
maintain
backwards
compatibility.
A
So
we
have
to
maintain
that
semantics
on
to
make
sure
we
don't
break
some
other
people's
current
settings.
So
we
have
some
design
constraint,
but
I
think
the
problem
we
have
to
solve
is
like
I
think
initially,
when
we
designed
this
have
this
user.
We
don't
consider
like
containers
right
now,
but
right
now
with
containers
and
contain
yourself
can
set
users
insights
own
image.
So
that
means
like
that
means
that
the
ownership
will
be
complicated
because
the
user
inside
a
container
my
meter
might
not
be
the
same
user
on
the
host.
A
So
you
might,
you
might
have
some
access
control,
but
you
do
want
to
make
sure
that
a
container
seldom
should
be
able
to
write
to
its
sandbox.
At
very
least,
that's
the
first
user
story
we
captured
and
and
also
I
think
we
have
a
constraint
that,
like
sandbox
for
each
container
must
be
protected,
because
if
you
have
two
users,
the
launching
container
on
the
same
host,
we
under
different
users,
you
do
want
to
make
sure
that
one
container
cannot
that
one
user
cannot
Seattle
user
sandbox.
That's
for
security
concern,
I
think
that's
a
backwards.
A
A
I
have
we
have
like
sandbox
one
where
to
the
sandbox
itself
and
also
there
like
a
violence
that
you
can
like
make
a
path
make
a
directory
into
the
sandbox
and
in
treat
at
the
bong
and
I
can
by
mounting
to
the
container,
and
we
do
have
secret
valiums,
which
is
a
Rama
fest
that
contains
secrets,
and
we
have
persistent
volumes.
Local
persistent
lumps
we
have
image
volume.
A
We
also
have
host
volumes
image
ammonius,
like
kids,
mess
on
the
image,
and
then
methods
can
prepare
the
imagery
route
for
you
and
then
on
the
count,
and
in
my
mount
that's
the
entire
posture
you
into
your
container
as
a
as
a
volume,
and
we
have
host
volume
2.
So
we
have
all
these
kind
of
volumes
and
we
want
to
support
arm.
D
E
Just
going
to
capture
like
is
this
on
the
same
horse
is
on
a
separate
post
of
them.
I'm,
not
sure
whether
it
was
usable
and
useful
at
the
time.
I
guess:
okay,
we're!
Not
access,
wasn't
access.
What
exactly
that's
about!
That's
talking
about
that's
trying
to
capture
their
concurrency
requirements.
So
why
is
it
single
user
access?
Is
it
multiple
user
access?
Do
I
have
multiple
concurrent
jobs
trying
to
access
this
thing
so
to
the
sandbox.
He
had
a
single
task
for
accessing
it,
but
a
host
volume.
You
could
have
multiple
tasks:
scripts,
accessing
it
simultaneously.
E
E
A
A
That
construct
somehow
well
that's
a
separate
I
think
that's
a
separate
discussion.
I
think
like
whenever
we
want
to
allow
that
or
not
I
think
that's
a
separate
discussion.
Maybe,
for
example,
I
can
think
of
some
cases
where,
like
a
note,
asking
sometimes
is
privileged.
We
want
that
user
to
be
understand
special
user
and
some
prints
and
some
fantastic
as
anyone
performance
like
like
underprivileged
tasks.
I
want
to
win
tasks
that
buddy
I
can
see
you
that
I'm
in.
A
So
that's
that's
I,
think
that
known
as
you
can
figure
out
how
old
at
all
yeah
I
think
that's
something
we
need
to
figure
out.
I
think
this
is
no
different
than
like.
You
have
a
person
in
long
and
that's
shared
by
two
tasks
on
the
same
post
and
once
those
assets,
the
same
bond
I
think
the
same,
usually
that
one
to
solve
yeah.
D
So
in
this
table
perhaps
would
be
helpful.
They
can
know
that
about
what
it
is
where
the
user
comes
from,
because
in
that
yo
I'm
guessing
the
mechanism
for
having
different
users
under
the
sink
t'rul
must
be
probably
just
using
the
users
in
image.
Otherwise,
the
user
is
because
I
catered
executives
to
mention
all
right.
Other.
A
Than
yeah
I
think
another
thing
here
is
like
task
group
like
the
executor,
is
the
top
level
continues
to
execute
container
that
have
a
user
to
so
that
can
be
I,
for
example,
routes
on
nobody
or
any
other
users
that
launched
executor.
So
if
the
Chris
I'm
boxing
and
anterior,
so
that's
at
yeah,
I
mean
I,
think
right
now
the
symmetric
so
that,
if
you
create
a
sandbox
in
the
executor,
contain
like,
if
you
have
a
you,
have
a
sandbox
longing.
A
The
attitude
is
container
then
on
that
the
ownership
of
that
bonding
should
be
the
same
as
the
to
the
same
as
the
the
executors
user.
And
then,
if
you
have
tasks
or
tasks
groups
under
that
executor,
that
wants
to
add
to
that
sandbox
cast
it's
up
to
the
evening.
I
mean
the
permission,
so
the
access
control
is
given
is
governed
by
the
it's
given
by
the
the
user
of
attacking
the
user
of
the
sandbox
passed
ball.
A
So
that's
what
that's
the
current
semantics
I,
don't
know:
I
got
what's
the
bet.
What's
the
sources
I
say
that,
for
example,
if
you
have
a
a
secure
container,
has
a
sandbox
tab
called
X
cool
and
then
there's
a
task
group
which
snaps
a
container
trying
to
reference
to
that
volume
and
that
containers
and
the
nobody
and
there's
no
nobody
technologist
to
the
secure
containers,
sandbox
paths
based
on
the
access
control
units
per
mission,
then
groovy,
no
access
to
that
moaning,
I
think
yeah.
A
G
I'm
to
create
some
some
some
problems
here,
because
they
might
be
confusing
for
some
people.
So
right
now
we
have
user
in
pringle
info.
So
this
is
the
basic
user
and
if
it
is
set
so
a
newbie,
the
user.
Otherwise
it
will
be
the
user
who
launched
the
group
process
and
this
users
going
to
be
passed
into
no
matter
the
executor
or
the
task
so
other
they
can
be
override,
but
they
could
be
overwritten.
G
A
I
think
over,
let's
not
try
to
dive
into
too
much
detail
here.
I
think
like.
Let's
keep
the
discussion
at
how
about
like
what
kind
of
some
everyone
like
provides
I
think
like
we
definitely
saw
the
sandbox
volume
case
where,
like
I,
think
the
semantics
need
to
discuss
like
what
the
right
semantics
is.
Given
that
each
task,
I
have
a
user
and
the
top-level
container
can
have
a
user
and
with
the
cement
people
and
provide
can
so
that's
to
do
things
that
need
to
do,
but
I
think
we're
gonna
have
a
45
minutes.
A
Let's
keep
moving
so
I
want
to
get
out
of
this
meeting
as
much
as
possible,
so
sandbox
I
think
we
discussed
that
we
want
to
make
sure
that
a
container
has
eight
games
like
each
container
has
a
predefined
sandbox,
and
we
want
to
make
sure
that
container
at
ease
castle
to
get
sandbox
by
reading
or
writing
or
adding
at
ease
creating
files
in
that
sandbox
on
the
owner
and
that's
not
necessary
to
needs
to
match.
Look
like
right
now.
A
This
and
the
way
we
allow
container
to
yet
to
be
able
to
exit
to
assemble
is
trying
to
change
owner
of
s
emboss
to
the
same
user
as
a
container,
but
this
might
not
be
on
the
the
semantics
we
want.
I
think
the
goal
is
trying
to
I
think
we
measuring
the
user
story,
the
villagers
just
trying
to
allow
you
to
be
able
to
create
new
funds
or
actually
net
sandbox
and
be
able
to
write
and
read
the
file
that
it
creates.
I.
Think
that's
what
we
want
to
provide
any.
H
A
H
A
So
so,
right
now,
if
to
continue
on
the
same
user,
then
nothing
friend
from
these
two
containers
to
be
accessed
to
be
able
to
access
to
different
containers
and
box.
But
if
you
do
want
to
like
the
isolation,
you
want
to
make
sure
that
these
two
can
here
are
in
the
different
users.
When
you
launch
the
task,
okay
and
so
who
authenticates.
H
A
A
Alright,
so
I
think
that's
something
we
catch
your
last
time.
I
hope
that
I
get
region
notes,
but
I
think
we
kind
of
some
solutions.
I
do
want
to
get
some
feedback
from
Microsoft
the
guides
on
that
I
think
so.
One
solution
we
came
up
was
on
to
use
the
fermentor
groups
that
the
same
route
that
kubernetes
took
onto
to
solve
their
access
control
issues,
four
volumes
so
basically
on
what
they
did
is
for
each
pod.
A
Another
thing
they
did
is
they
do
a
set
G
ID
on
that
direct
on
at
all
the
directories,
not
just
when
they're
actually
said
you,
essentially
all
the
directories
in
that
volume,
so
that
on
that
make
sure
that
would
have
the
directory
that
or
files
that
on
that
container
crates.
It's
going
to
be
under
on
that
group
to
make
sure
that
give
to
containers
in
the
Polish
share
the
same
volume,
and
they
can
they
can
access
to
each
other's
file.
That's
how
they
did.
Okay.
A
J
A
J
H
A
Yeah
I'm
understanding
is
they
do
that?
Well,
every
time
they
now,
because
what
I
mean
that
volume
can
be
used
by
different
pods
and
the
different
FS
groups
later
I.
Don't
know
what
I
care,
if
they
don't
do
this,
how
they
make
sure
that
at
all
camp
yet
can
access
to
that
long.
So,
maybe
that's
in
see.
We
can
check
on
Gilbert
any
taken
notes
on
this.
A
Let's
really
came
up
this
possible
solution
called
supplementary
group
on
that
I
think
can
kind
of
solve
these
issues,
but
I
think
the
solution
is
very
unix
specific.
Another
thing:
I:
don't
I,
don't
like
it,
but
every
time
you
the
other
thing
I
don't
like
is
every
time
you
you
have
to
do
a
recursive
change
only
thing
on
the
on
the
bottom.
A
Because
you
have
to
sassette,
you
are
the
only
applies
to
the
direct
like
a
direct
like
descendent
of
directory.
So
if
you
want
to
make
sure
that
all
the
files
create
inside
that
volleying
are
under
vacuum
and
do
we
have
to
recursively
chance
of
your
party
to
concept
ID
on
all
the
directories,
which
is
unfortunate
on
so.
E
G
A
G
I
didn't
experiment,
nothing
like
so,
if
you
do
a
biobank,
no
matter,
it
is
the
edge
stitched
up
by
I'll,
just
just
just
a
session
by
mount.
So
if
you
always
been
carried
from
the
source
to
the
target,
which
means
up
the
month,
so
both
shots
and
target,
you
will
be
under
the
same.
The
user
and
permission
from
the
Archana
sauce
you
yeah,
but
why.
G
A
B
A
That's
up
to
our
design,
basically
like
one
solution
for
that
is
like
the
agent
can
reserve
a
bunch
of
ID's
say:
hey!
No
one
can
you
say
those
IDs
and
then
we'll
every
time.
There's
a
container
launch.
We
automatically
like
automatically
assign
Venture
Group
IV
to
that
container.
So
that's
one
solution
or
we
go
with
kubernetes
and
all
aware
you
ask
the
user
to
specify
ID
which,
like
I,
don't
like,
because
how
the
hell,
the
user
can
know
an
ID
I've
given
hose
and
that
you
might
be
different
on
different
hosts.
B
A
A
Okay,
so
so
the
Ferengi
group
is
one
solution
that
will
discuss
another
solution.
I
think
we
discussed
by
I,
don't
think
we
dig
deeper
is
the
ACLS
on
like
their
different
kind
of
ACLs
on
so
I
didn't
digging
on
like
the
POSIX
ACL,
so
James
you
mentioned
that
I
thought
you
comments
on
the
the
talk
you
mentioned,
that
rich
ACR
like
like.
What's
the
what's
the
ATL
used
by
NFS,
so
rich
I
see
arrows
are
basically
nfsv4.
E
E
The
windows
OSI
model-
okay,
so
you,
like
you,
have
names
in
there,
instead
of
names
in
there.
Instead
of
our
days
at
my
party,
so
I
haven't
studied
in
detail
the
specific
differences
between
rich
ICL's
and
the
traditional
Linux
project
ratios.
But
mm-hmm
I
did
look
at
the
patch
history
edit.
He
doesn't
seem
that
the
participating
but
which
ACL
patch
has
been
around
for
a
long
time
and
it
doesn't
seem
like
then
immediately
going
to
be
upstream
all
of
a
sudden
yeah.
A
And
also
I
think
the
rich
ACR
I
look
at
the
the
way.
How
limit
can
use
that
rich
ACL
kind
of
key?
Is
you
have
to
remount
the
roots,
pretty
much
on
to
to
to
support
that
based
on
documentation?
I
saw
on,
like
you
have
to
do
a
remount
to
to
to
enable
rich,
ACL
and
and
I
look
at
that
using
it
like
not
another
remover
to
the
focus
one
EA
CL
on
Linux
I.
Think
the
one
thing
that's
missing
is
inheritance.
A
That,
like
you,
has
mean
you
see.
First,
you
have
to
do
a
recursive
on
recursive
on
the
default
ACL
ah-chooooo.
You
have
to
do
that
because
I
think
it's
not
inherited
I'm,
not
sure
like
whether
like
windows,
ACO
or
NFS
ACL
solve
that
issues.
I
have
like
that,
you
have.
You
can
have
an
inheritance.
We
can
only
set
some
defaults
on
the
top
levels,
are
a
trend
that
we
get
that
would
get
inherited
by
order.
The
files
also
prefer
entries
in
that
volume.
Yeah
windows,
I.
E
So
what
you're
doing
windows-
and
this
is
the
same
I-
believe
symmetric
sort
of
rotational
issue-
is
at
the
root
of
a
directory
hierarchy.
You
apply,
what's
called
a
protective
ACL
and
that's
basically
an
ACL
with
a
bunch
of
flags
or
says
inherit
from
me,
but
don't
inherit
onto
me.
I'm
on
the
shell
API
takes
care
of
propagating
that
every
time
you
put
every
time
you
create
a
file
system,
object
animator,
so.
A
That's
like,
even
if
you
have
like
a
very
deep
directory
structure,
is
inherited
on
top
level
you're
exactly
okay,
so
yeah,
that's
something
that
I
really
wanna
fight.
We
can
have
that
I'm.
Giving
up
compared
to
well
I.
Think
only
X
is
fine
because
said
GID,
it's
inherited
according
to
on
the
experiment
you
did,
but
not
such
as
on
BSD,
but
yeah
I
think
like
right
now,
I
feel
like
it's
going
to
be
very
hard
to
find
a
solution
that
works
on
all
the
platforms.
A
E
So
that's
I'd
say
everything
that
is
in
practical
use.
I.
Thank
you.
I
did
the
big
the
big
drawback
about
trying
to
go
an
ACL
model
is
that
they're
used
so
rarely
in
the
Linux
world
other
people,
don't
people,
aren't
very
familiar
with
the
semantics
and
I
think
they.
They
kind
of
caused
a
lot
of
heartache
command
operators,
because
it's
something
that
almost
no
one
uses.
A
Okay,
I
see
okay,
so
maybe
we
should
go
down
the
symmetric
group
cats
a
little
more
and
see
what's
missing
and
what
we
can
do
better.
I
I
think
I,
don't
realize
that
I'm
going
to
ideas
inherited
that's
good,
so
any
founder
and
Clinics.
This
is
a
pretty
good
thing
and
I
probably
don't
care
about.
Yes
at
the
moment,
I'm
not
either
like
I'm,
not
sure
like
microscopic
guys,
do,
have
an
experience
and
I
got
this
kind
of
supplementary
group
support
on
Windows.
I
I
So
this
is
relief
from
Microsoft,
so
I
think
I
work
with
mesosphere
staff
team,
engineer
team
to
support
my
sauce
on
Windows
and
then
I
think
ccos
on
windows,
so
I
doing
that
Windows
doctor
came
here
to
the
meeting,
but
I
don't
see
him
in
the
meeting
list
so
I
before
the
meeting
I
actually
do
a
briefing
half
machine
so
so
far
the
implementation
for
the
volume,
our
permissions
port
on
Windows
docker
container,
is
very
limited.
Pretty
much.
They
don't
have
any.
You
know
anyone
can
read
anyone's
container,
so
they
don't
have
any.
I
You
know
limitation
or
privilege
on
the
wall
in
my
house,
so
the
one
that
you
discussed
about
this
easy.
You
know
ACS
implementations,
they
don't
use
that
or
the
other
the
talker
windows
docker
container.
Yet
so
one
of
the
goal
for
this
meeting
actually
I
would
like
to
see.
You
know
base
our
implementation.
We
may
have
to
go
back
and
ask
them
to
implement.
You
know
some
of
the
features
for
us,
but
well
you
know
I
go
with
the
discussion
by
listening.
I
You
guys
I
realize
that
you
know
the
community
part
actually
also
implemented
a
similar
mechanism.
Already
I
know
that
another
team
in
Microsoft
also
working
on
you,
know
cobranet
in
Windows
port.
So,
like
my
you
know,
one
of
my
thing
I
can
do
is
as
a
follow-up
I
can
go
back
to
them
and
ask
discuss
with
them.
You
know
how
to
support
that
the
port
won't
share
the
104
coronet
on
Windows
and
then
I
think
that
those
knowledge
can
help
us
to
make
a
better
design.
Later.
With
my
sauce,
a
shared
one,
yeah.
A
I
Yes,
I
think
this
is
a
I
think.
Is
that
point
for
me,
because
I'm
also
curious
if
a
Windows
docker
container
doesn't
support
its
functionality
and
how
they
implement
it
in
the
in
the
core
energy
for
Windows,
so
I'll
follow
up
and
I'll
come
back
to
this
group
and
the
update
mine
are
fine
findings.
Okay,
okay,.
A
B
I
wanted
to
point
out
on
the
field.
I
think
we
should
explore
them
because
I
and
well
I
agree
they're
not
frequently
used
they're,
not
entirely
unused.
I
mean
you'll,
find
the
ACL
package
installed
on
those
systems
is
like
systemd
take
the
dependency
on
it.
It
is
used
on
linux
to
solve
this
kind
of
problem
at
least
every.
So
often
it
might
still
be
a
reasonable
solution
for
us.
Although
it's
not
widely
used
yeah.
A
I
think
yeah
I
think
the
tricky
part
is
on
Linux
I
did
this?
Is
the
default
ACR
like
the
positionally
ACO
is
not
I'm
useful,
especially
the
inheritance
is
not
implemented.
You
have
to
do
a
recursive
on
changing
the
default
HDL
for
each
direction.
At
that
volume,
which
is
unfortunate,
yeah
I,
agree
you
and
I.
We
should
dig
deeper
on
to
do
more
experiments
and
see
what's
going
on,
and
it's
also
like
I
want
to
wait
for
the
feedback
from
the
Microsoft
kubernetes
support
guys
and
see.
I
I
A
A
So
so,
basically,
the
idea
is
like
the
main
idea
using
for
financial
group
is
trying
to
be
type
of
ownership
from
access
control.
So,
basically
like
the
right
now,
we
couple
them
together
inside
make
those
so,
but
here
we
change
the
owner
of
the
volume
to
the
same
user
as
the
container,
so
that
we
make
sure
that
the
container
cam
can
access
to
the
volume,
but
that's
not
necessary.
A
A
The
idea
is
for
sandbox,
for
example,
on
the
sandbox
self
can
be
still
owned
by
roots
like
the
agent
user,
pretty
much
on
and
and
we
can
change
the
owner,
we
can
add
a
like.
Oh,
we
can
generate
a
separate
metric
group,
stick
a
and
we
can
change
the
primary
group
of
that
sandbox
to
a
to
be
a
so
that
any
container
has
this
super
mentor
group
a
on
can
next
to
the
sandbox.
A
So
that's
all
the
access,
control
and
problem
any
questions
so
far
and
the
sandbox
mode
should
be
set
to
at
7-7
0
to
make
sure
that
the
users
under
the
same
group
can
access
to
the
sandbox,
because
the
owner
of
the
set
the
container
mob
you'll
act
like
nobody,
and
you
want
to
make
sure
that
you
can
ask
the
sandbox
like
on
10
the
mode
to
be
seven
times.
There's
a
group
actors
can
invent.
A
E
A
A
I
mean
that's
the
worst
that
GID
does
right,
you
want.
So
all
the
other
point.
Once
you
have
a
set
tid
bits
on
the
right
rate,
all
the
file
you
craters,
that
following
will
be
under
that
primary
GID,
a
that's.
What
Jia's
for
elect
you
wanted
the
file
to
be
like
the
file
you
creating
a
sandbox.
The
primary
group
ID
is
the
same
as
the
users
primary
group
IDs.
A
Unless
you
want
that,
then
that's
a
different
story
like
continuing
to
think
about
like
if
you
want
to
support
that
and
then
what's
the
implications
because,
especially
for
sharing
you
have
you
have
multiple
tasks
in
the
same
task.
You
will
also
share
the
same
volume
and
they
are
under
different
users
and
groups,
and
but
you
do
want
them
to
be
able
to
share
the
same
bond
and
then
then
there's
no
way.
You
can
do
that
because
the
file
query
by
one
task
and
the
group
a
cannot
be
accessed
by
a
different
task
and
a
groupie.
M
L
Their
their
IDs
they're
lost
with
sizing
credit,
de-escalated
and
drop
down
to
nobody
starts
it
again.
So
there's
there's,
there's
Linux
applications
that
when
you
launch
them
they
look
and
they
launch
with
some
initial
user
ID
and
group
ID,
but
then
I,
probably
using
very
technical
word
for
it,
but
they
they
effectively
want
to
drop
that
we're
at
least
deescalate
the
permissions
that
they're
launched
with
and
then
part
of
that
can
be
changing
the
user
that
they
run
as
so
do
we
do
we
see
any
potential
conflict
there.
A
Yeah
I
think
as
sed
I
mentioned,
like
it's:
okay,
because
even
you've
changed
your
owner
and
if
you
tend
to
use
in
a
group
the
job
your
privilege
on
since
the
directory
itself,
the
Bonilla
style
has
set
you
up
these
sticky
bits
set.
So
all
of
us
create
by
that
thing
query
by
dialogue
that
that
process
will
be
having
time
and
GID
of
that's
a
fermenter
group.
E
A
E
A
Okay,
yeah
anyway,
I
think
this
is
just
like
that.
An
option
I
we
haven't
decided,
which
way
to
go
in
to
wait
for
the
feedback
from
Windows
folks,
but
yeah
we
should
document
dislike,
like
maybe
like
attention
is
a
fermented
group
is
the
last
step
you
do.
I,
don't
know
like
what
is
a
possible
answer
after
you
change
user
job
privilege,
but
before
anyway,
that's
just
like
we
can't
be
wrong.
I,
look
na
just
remember.
A
C
D
A
A
So
yeah
I
think
that
that
that
does
have
an
implication,
especially
like.
If
you
have
like
the
roof
structure,
organisation
structure,
you
have
a
service
account,
like
you
say,
your
user
G
is
under
group
edge
and
previously
any
user
in
their
group
and
should
be
able
to
see
my
sandbox
on
the
right
now
with
this
changed
and
they
won't
be
able
to
see
the
sandbox
because
on
the
group
of
sandbox,
is
being
it's,
a
temporary
got
GID
a
and
that
has
something
to
do
with
edge,
so
any
other
user.
So
except
gkx
to
my
sandbox.
A
A
D
A
I
think
I
think
maybe
that's
okay,
because
I
think
that
the
like
we
should
discourage
discourage
people
to
try
to
log
into
the
box
if
possible.
I
think
the
main
thing
we
want
to
protect
prevent
is
like
one
container
and
the
different
framework
into
a
different
organization,
be
able
to
access
to
sandbox
by
just
writing
a
script
in
their
job,
which
is
bad.
It's
not
something
that
we
may
want
to
prevent.
H
I
have
a
question
on
upgrade
so
retaining
the
way
seals
are
set
up
on
the
sandbox
right,
so
I
guess
it
should
not
affect
any
upgrades
from
an
agent
that
doesn't
support.
This
was
an
agent
that
supports
whatever
decisions
are
made
over
here
because
I
we
do
it
only
for
new
container
launches
right,
yeah.
A
H
A
Would
be
problematic
yeah?
We
just
think
about
that.
I
think
the
sandbox
not
an
issue,
because
sandbox
are
not
those
finance
in
do
we
have
antennas
that
should
be
okay,
but
it
might
be
a
protocol
persistent
longing,
because
when
I
use
personally
like
you
would
either
winter
clear
document
that
if
you
want
to
do
that
transition,
you
have
to
train
the
task
on
and
relaunch
the
task.
We.
H
A
Okay,
so
Devon
get
the
general
idea
like
any
comments
of
fossil,
so
PN,
so
are
you
guys
are
I?
Remember
we
used
to
have
discussion
on
that
and
you
guys
want
to
explicitly
set
a
group
to
like,
like
I.
Remember
some
discussion
you
guys
on
have
that
you
don't
want
to
change
the
group
to
a
random
group
and
you
do
want
to
maintain
the
primary
credit
daddy
of
the
one
that
creative
on
the
limitation
opens.
You
guys
do
a
French
thing
that
you
guys
do
want
to
make
sure
that
I.
A
Okay,
okay,
so
I
think
that
the
other
user
story
we
have
is
the
sandbox
of
each
container
should
be
protected
so
that
contain
a
different
user.
Cannot
access
to
other
users
container
I,
think
of
Yui?
Okay,
as
long
as
you
can
make
sure
that
the
sacramentary
group
assigned
to
each
container
is
different,
I
think
that
does
open
a
question
where
I
think
you're
on
a
limited
number
of.
A
There
are
living
in
number
of
G
IDs
that
we
can
assign
so
product
a
flag,
saying:
okay,
these
are
the
range
we
want
to
reserve
for
agent
and
Ageing.
Will
dynamically
assigned
a
GID
to
each
container
I
think
as
long
as
we
I
mean
I
think
we
need
to
terminating
the
container
sandbox
as
well,
because
people
want
to
debug
after
that,
the
containers
terminated.
So
we
have
to
make
sure
that
all
these
containers,
including
terminate
containers,
do
not
share
the
same.
Id,
do
not
reuse
the
same
ID.
Otherwise,
then
we
can
write
into
an
initiative.
A
G
A
Yeah,
so
the
sandbox
will
live
longer
than
the
container
right,
because
when
the
container
terminated,
we
still
maintain
a
sandbox
they're
on
for
a
while
until
it
gets
you
see.
This
is
the
primary
reason,
for
that
is
that
people
want
to
debugger
and
they
want
to
keep
object
and
hand
terminals.
I
want
to
get
a
log.
D
So
it
almost
just
suggest
to
me
that
we
have
to
have
a
measurement
gorgeous
or
for
the
sandbox
is
and
GC
it's
part
of
its
week
now.
But
then
you
can
convince
things
that
you
might
want
to
plug
back
into
it,
which
would
take
care
of
things
like
physical
variable
comes
IV
one
different
box
gets
depleted
and
then
probably
wants
to
achieve
something
out
by
path,
but
by
packing.
A
A
Otherwise,
it's
going
to
be
pragmatic
because,
like
you
have
you
have,
you
can
write
them
straight
to
scan
the
agents.
The
sandbox
direct
agents
work
like
work
there
and
then,
like
you,
can
select
X
Q
some
other
users
eye
maps,
which
is
unfortunate.
I
can
show
it
at
the
very
least
prevent
that,
so
that
pose
the
limitation
on
mental
active
container.
You
can
add
on
agent
I
think
that
should
be
ok,
yeah.
Yes,.
E
No,
you
eat,
so
you
can.
You
shouldn't
have
to
the
resolutions
to
get
along
with
so
to
get
from
to
get
from
Q
to
P
the
traverse
between
to
sub
box
containers.
We
have
to
go
to
movie
directories
and
then
the
intermediate
directories
are
not
owned
by
any
one
of
those
supplementary
groups,
and
you
don't
have
to
know
how
to
get
there
so
basically
to
get
from
the
sandbox
get
to
go
then
path
up
to
the
next
a
box.
It
requires
that
you
have
traverse
for
the
intermediate
directories.
I
see.
E
A
Okay,
yeah
I,
don't
know
that:
okay,
okay,
that
sounds
fine.
I,
think
that
you
say
it
sounds
fine
I
think
so.
Another
user,
sir,
is
that
I
want
to
continue
to
be
able
to
rewrite
a
host
phone
in
with
the
relative
paths,
so
sandbox
volume
I
think
this
is
not
the.
We
have
two
different
types
like:
let's
talk
about
the
sandbox
bonding
night
from
the
parent,
but
is
for
on
itself.
A
So
I
think
this
is
a
user
that
captured
that
on
the
volunteer,
JSON
yeah
thanks
thanks
earlier
I,
think
you
feel
the
dog
bye-bye
think
yeah.
Thank
you.
I
didn't
notice
how
you
feel
the
dock
with
all
the
rest
of
us.
That's
great!
So
long
directory
is
owned
by
reach
GID.
Okay,
that's
what
we
discussed
above
sandbox.
There
are
ten
cents
at
expiry,
ensure
the
types
of
returning
her
GI.
This
one
on
PSP
has
been
selected
to.
A
A
Basically,
I
a
relative
path
that
does
it
click
post
passage
relative
yeah,
it's
kind
of
a
legacy
issue
like
initially
we
introduced
long,
and
we
just
say
we
have
a
host
pads
in
the
container
pad
and
the
container
paths
can
be
relative.
Post
paths
can
be
relative
to
if
the
parameter
is
relative
to
the
sandbox.
The
later
we
were
like,
then
we
had
so
many
out
of
own,
and
so
we
lose
this
knowledge.
A
A
Do
you
defend
Box,
falling
back,
specified
a
source
to
be
sandbox
and
you
specify
a
path
which
has
to
be
relative,
and
then
we
also
a
first-class
host
pass
the
whole
time
so,
which
means
that
the
host
has
its
absolute.
So
we
need
to
like
a
clean
this
up
and
definitely
the
old
way
of
launching
that
and
then
then
it
would
be
much
clearer.
A
K
So
I
actually
just
did
insurance
on
my
Mac,
which
is
Fiesta
Bates
right.
But
although,
when
I
used
LS
dash
L,
it
doesn't
show
that
the
sub
theory
I
created
undersecretary,
shows
the
the
assets
on
the
sub
G
I.
Do
you
own
I
use
LS,
but
I?
Well,
I
think
it
actually
worked
so
I
am
able
to
set
GID
honest
territory,
create
the
dirty
inside
after
using
another
account,
but
the
same
group
and
I
still
quit
I'm
still
be
able
to
create
something
else
inside
that
rotary
with.
A
The
group
ID
I
think
that
I
think
the
x-ray
idea
is
like
I
changed
the
top
levels
like
GID
to
be
a
different
one
and
there
and
then
the
it's
not
inherited.
So
if
you
have
like
say
you
have
a
500
a
and
then
you
have
a
beer
like
cement
and
your
a
and
then
you
can
chase
on
GRE
bits
and
GID
to
be
like
a
different
user
than
before
I'm
the
you
can
create
a
little
hot
under
bead,
which
is
Nessa
and
a
that
far
is
not
going
to
get
yeah.
K
A
A
New
stuff,
oh
yeah,
a
dead
attitude,
I
mean
I.
Think
the
exercise
is
trying
to
attend
to
di
di
respect
once
you
change
the
topology
at
every
metric,
which
is
on
top
of
GID,
and
then
that
will
get
inherited
for
all
the
rest
of
the
hierarchy.
So
whenever
you
create
a
fire
under
invested,
creet
like
nested
directory
and
that
will
under
the
same
group
of
the
top-level
directory,
a
new
one,
but
that's
another
case,
I'll,
probably
at
any
time.
K
E
A
E
A
A
My
stuff
I
need
to
do
some
cleanup
on
this
I
would
do
that
part
and
I'll
set
up
the
phone
meeting
one
so
I
got
a
feedback
for
microscopy
guys
anyway.
Thank
you
guys-
and
this
is
a
good
discussion
and
on
and
I
will
see
you
in
two
weeks
in
this
working
group
meeting
and
thanks
guys.
Sorry
about
Africa,
so
I
do.