User Isolation

Note

These instructions only apply to :doc:`Dataiku Custom </installation/index>.

With Dataiku Cloud and Dataiku Cloud Stacks, User Isolation is automatically managed for you, and you do not need to follow these instructions.

Most Dataiku Custom installations should enable User Isolation.

On an out-of-the-box custom installation of Agent Management, code actions performed by Agent Management is performed as a single account on the host machine. This account which runs the Agent Management service is called the dssuser. For example, when a Agent Management end-user executes a code recipe, it runs as the UNIX dssuser

If the Agent Management end-user is hostile and has the permission to execute “unisolated” code, they can run arbitrary code as UNIX dssuser and modify the Agent Management configuration

Agent Management features a set of mechanisms to isolate code which can be controlled by the user, so as to guarantee both traceability and inability for a hostile user to attack the dssuser. Together, these mechanisms form the User Isolation Framework.

The User Isolation Framework is not a single technology but a set of capabilities that permit isolation depending on the context. Most of the components of the User Isolation Framework imply that Agent Management impersonates the end-user and runs all user-controlled code under different identities than dssuser.

Your Dataiku Sales Engineer or Customer Success Manager is ready to help for any specific deployment questions.

• Capabilities of User Isolation Framework
• Prerequisites and limitations
  • Prerequisites
    • Local machine
    • LDAP
    • Agent Management
    • Required information
  • Limitations
    • Unsafe features
• Initial Setup
  • Prerequisites and required information
  • Perform a regular Agent Management installation
  • Initialize UIF
    • Additional setup for local filesystem access
  • Configure filesystem access on the Agent Management folders
  • Configure identity mapping