GNU bug report logs - #54811
[PATCH 0/3] Support socket activation in 'guix publish' and 'guix-daemon'

Previous Next

Full log

View this message in rfc822 format

From: Ludovic Courtès <ludo <at> gnu.org>
To: Maxime Devos <maximedevos <at> telenet.be>
Cc: 54811 <at> debbugs.gnu.org
Subject: [bug#54811] [PATCH 0/3] Support socket activation in 'guix publish' and 'guix-daemon'
Date: Mon, 11 Apr 2022 11:48:51 +0200

Maxime Devos <maximedevos <at> telenet.be> skribis:

> Ludovic Courtès schreef op zo 10-04-2022 om 19:34 [+0200]:

[...]

>> One thing is sure: when ‘--advertise’ is used, we shouldn’t use socket
>> activation or nothing will be advertised.  Is that what you mean?
>
> No, how would socket activation prevent advertising?

As currently implemented in the Shepherd, socket activation means that
the process is started lazily, the first time a connection request is
made.  If the ‘guix publish’ process isn’t started, then DNS-SD
publication doesn’t happen.

> How would guile- avahi even know that we are doing socket activation?
>
> What I mean was:
>
>   * if guile-avahi sends messages to the network by itself,
>     then it cannot be run inside a networkless container,
>     otherwise only the container's loopback would receive them.
>
>   * if guile-avahi talks to some daemon via a unix domain socket,
>     then no problem

Guile-Avahi talks to avahi-daemon over a Unix-domain socket;
avahi-daemon then does the actual mDNS/DNS-SD publication.

>   * IIUC, previously, "guix publish" could not be run inside a network
>     container, because it tried to listen by itself (and listening
>     to a container's own loopback isn't useful).
>
>   * but in case of socket activation, this problem disappears

Well, shepherd, as an ordinary process in the container, would also try
to listen by itself.  But I think that’s fine; worst thing is nobody
ever connects to that socket, but that’s ok, no?

>   * bonus: except possibly for the secret key material, "guix publish"
>     does not have to be started  as root anymore even if uses a
>     reserved port such as port 80 (assuming socket activation is used).

But it does need to access the secret key…

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.