@Override
  public void prepareContainer(ContainerRuntimeContext ctx)
      throws ContainerExecutionException {

    @SuppressWarnings("unchecked")
    List<String> localDirs =
        ctx.getExecutionAttribute(CONTAINER_LOCAL_DIRS);
    @SuppressWarnings("unchecked")
    Map<org.apache.hadoop.fs.Path, List<String>> resources =
        ctx.getExecutionAttribute(LOCALIZED_RESOURCES);
    @SuppressWarnings("unchecked")
    List<String> commands =
        ctx.getExecutionAttribute(CONTAINER_RUN_CMDS);
    Map<String, String> env =
        ctx.getContainer().getLaunchContext().getEnvironment();
    String username =
        ctx.getExecutionAttribute(USER);

    if(!isSandboxContainerWhitelisted(username, commands)) {
      String tmpDirBase = configuration.get("hadoop.tmp.dir");
      if (tmpDirBase == null) {
        throw new ContainerExecutionException("hadoop.tmp.dir not set!");
      }

      try {
        String containerID = ctx.getExecutionAttribute(CONTAINER_ID_STR);
        initializePolicyDir();

        List<String> groupPolicyFiles =
            getGroupPolicyFiles(configuration, ctx.getExecutionAttribute(USER));
        Path policyFilePath = Files.createFile(
            Paths.get(policyFileDir.toString(),
            containerID + "-" + NMContainerPolicyUtils.POLICY_FILE),
            POLICY_ATTR);

        try(OutputStream policyOutputStream =
                Files.newOutputStream(policyFilePath)) {

          containerPolicies.put(containerID, policyFilePath);

          NMContainerPolicyUtils.generatePolicyFile(policyOutputStream,
              localDirs, groupPolicyFiles, resources, configuration);
          NMContainerPolicyUtils.appendSecurityFlags(
              commands, env, policyFilePath, sandboxMode);
        }
      } catch (IOException e) {
        throw new ContainerExecutionException(e);
      }
    }
  }
@Test
  public void testEnabledSandboxWithWhitelist()
      throws ContainerExecutionException{
    String[] inputCommand = {
        "$JAVA_HOME/bin/java jar -Djava.security.manager MyJob.jar"
    };
    List<String> commands = Arrays.asList(inputCommand);

    conf.set(YarnConfiguration.YARN_CONTAINER_SANDBOX_WHITELIST_GROUP,
        WHITELIST_GROUP);

    runtimeContextBuilder.setExecutionAttribute(USER, WHITELIST_USER);
    runtimeContextBuilder.setExecutionAttribute(CONTAINER_RUN_CMDS, commands);
    runtime.prepareContainer(runtimeContextBuilder.build());

    Assert.assertTrue("Command should be modified to include " +
            "policy file in whitelisted Sandbox mode",
        commands.get(0).contains(SECURITY_FLAG)
        && commands.get(0).contains(POLICY_FLAG));
  }