import org.apache.hadoop.yarn.exceptions.InvalidContainerException; //导入依赖的package包/类
/**
 * @param containerTokenIdentifier
 *          of the container whose resource is to be started or increased
 * @throws YarnException
 */
@Private
@VisibleForTesting
protected void authorizeStartAndResourceIncreaseRequest(
    NMTokenIdentifier nmTokenIdentifier,
    ContainerTokenIdentifier containerTokenIdentifier,
    boolean startRequest)
    throws YarnException {
  if (nmTokenIdentifier == null) {
    throw RPCUtil.getRemoteException(INVALID_NMTOKEN_MSG);
  }
  if (containerTokenIdentifier == null) {
    throw RPCUtil.getRemoteException(INVALID_CONTAINERTOKEN_MSG);
  }
  /*
   * Check the following:
   * 1. The request comes from the same application attempt
   * 2. The request possess a container token that has not expired
   * 3. The request possess a container token that is granted by a known RM
   */
  ContainerId containerId = containerTokenIdentifier.getContainerID();
  String containerIDStr = containerId.toString();
  boolean unauthorized = false;
  StringBuilder messageBuilder =
      new StringBuilder("Unauthorized request to " + (startRequest ?
          "start container." : "increase container resource."));
  if (!nmTokenIdentifier.getApplicationAttemptId().getApplicationId().
      equals(containerId.getApplicationAttemptId().getApplicationId())) {
    unauthorized = true;
    messageBuilder.append("\nNMToken for application attempt : ")
      .append(nmTokenIdentifier.getApplicationAttemptId())
      .append(" was used for "
          + (startRequest ? "starting " : "increasing resource of ")
          + "container with container token")
      .append(" issued for application attempt : ")
      .append(containerId.getApplicationAttemptId());
  } else if (startRequest && !this.context.getContainerTokenSecretManager()
      .isValidStartContainerRequest(containerTokenIdentifier)) {
    // Is the container being relaunched? Or RPC layer let startCall with
    // tokens generated off old-secret through?
    unauthorized = true;
    messageBuilder.append("\n Attempt to relaunch the same ")
      .append("container with id ").append(containerIDStr).append(".");
  } else if (containerTokenIdentifier.getExpiryTimeStamp() < System
    .currentTimeMillis()) {
    // Ensure the token is not expired.
    unauthorized = true;
    messageBuilder.append("\nThis token is expired. current time is ")
      .append(System.currentTimeMillis()).append(" found ")
      .append(containerTokenIdentifier.getExpiryTimeStamp());
    messageBuilder.append("\nNote: System times on machines may be out of sync.")
      .append(" Check system time and time zones.");
  }
  if (unauthorized) {
    String msg = messageBuilder.toString();
    LOG.error(msg);
    throw RPCUtil.getRemoteException(msg);
  }
  if (containerTokenIdentifier.getRMIdentifier() != nodeStatusUpdater
      .getRMIdentifier()) {
    // Is the container coming from unknown RM
    StringBuilder sb = new StringBuilder("\nContainer ");
    sb.append(containerTokenIdentifier.getContainerID().toString())
      .append(" rejected as it is allocated by a previous RM");
    throw new InvalidContainerException(sb.toString());
  }
}
 

import org.apache.hadoop.yarn.exceptions.InvalidContainerException; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private void startContainerInternal(NMTokenIdentifier nmTokenIdentifier,
    ContainerTokenIdentifier containerTokenIdentifier,
    StartContainerRequest request) throws YarnException, IOException {

  /*
   * 1) It should save the NMToken into NMTokenSecretManager. This is done
   * here instead of RPC layer because at the time of opening/authenticating
   * the connection it doesn't know what all RPC calls user will make on it.
   * Also new NMToken is issued only at startContainer (once it gets renewed).
   * 
   * 2) It should validate containerToken. Need to check below things. a) It
   * is signed by correct master key (part of retrieve password). b) It
   * belongs to correct Node Manager (part of retrieve password). c) It has
   * correct RMIdentifier. d) It is not expired.
   */
  authorizeStartRequest(nmTokenIdentifier, containerTokenIdentifier);
 
  if (containerTokenIdentifier.getRMIdentifer() != nodeStatusUpdater
      .getRMIdentifier()) {
      // Is the container coming from unknown RM
      StringBuilder sb = new StringBuilder("\nContainer ");
      sb.append(containerTokenIdentifier.getContainerID().toString())
        .append(" rejected as it is allocated by a previous RM");
      throw new InvalidContainerException(sb.toString());
  }
  // update NMToken
  updateNMTokenIdentifier(nmTokenIdentifier);

  ContainerId containerId = containerTokenIdentifier.getContainerID();
  String containerIdStr = containerId.toString();
  String user = containerTokenIdentifier.getApplicationSubmitter();

  LOG.info("Start request for " + containerIdStr + " by user " + user);

  ContainerLaunchContext launchContext = request.getContainerLaunchContext();

  Credentials credentials = parseCredentials(launchContext);

  Container container =
      new ContainerImpl(getConfig(), this.dispatcher, launchContext,
        credentials, metrics, containerTokenIdentifier);
  ApplicationId applicationID =
      containerId.getApplicationAttemptId().getApplicationId();
  if (context.getContainers().putIfAbsent(containerId, container) != null) {
    NMAuditLogger.logFailure(user, AuditConstants.START_CONTAINER,
      "ContainerManagerImpl", "Container already running on this node!",
      applicationID, containerId);
    throw RPCUtil.getRemoteException("Container " + containerIdStr
        + " already is running on this node!!");
  }

  // Create the application
  Application application =
      new ApplicationImpl(dispatcher, this.aclsManager, user, applicationID,
        credentials, context);
  if (null == context.getApplications().putIfAbsent(applicationID,
    application)) {
    LOG.info("Creating a new application reference for app " + applicationID);

    dispatcher.getEventHandler().handle(
      new ApplicationInitEvent(applicationID, container.getLaunchContext()
        .getApplicationACLs()));
  }

  dispatcher.getEventHandler().handle(
    new ApplicationContainerInitEvent(container));

  this.context.getContainerTokenSecretManager().startContainerSuccessful(
    containerTokenIdentifier);
  NMAuditLogger.logSuccess(user, AuditConstants.START_CONTAINER,
    "ContainerManageImpl", applicationID, containerId);
  // TODO launchedContainer misplaced -> doesn't necessarily mean a container
  // launch. A finished Application will not launch containers.
  metrics.launchedContainer();
  metrics.allocateContainer(containerTokenIdentifier.getResource()); 
}