Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backend: Suport systemd socket activation #3696

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

PhracturedBlue
Copy link

systemd supports passing an already open TCP or unix socket to an application on startup (enabled via the LISTEN_FDs env variable). Podman supports passing this socket from the host to the container as of version 3.4 (Docker does not support socket activation for containers). Socket activation provides the benefit of only starting a service on demand (reducing overall boot time and potentially reducing memory usage), as well as improving security by allowing running containers with '--network=none' and still being able to be exposed.

This PR adds automatic socket-activation support. If the 'LISTEN_FDS' variable is set, socket activation will automatically be used, otherwise the behavior remains unchanged. Socket activation can work with unix domain sockets or TCP sockets, and will work with TLS if configured

Acceptance Criteria:

  • Features and enhancements must be fully implemented so that they can be released at any time without additional work
  • [?] Automated unit and/or acceptance tests are mandatory to ensure the changes work as expected and to reduce repetitive manual work
  • [N/A] Frontend components must be responsive to work and look properly on phones, tablets, and desktop computers; you must have tested them on all major browsers and different devices
  • Documentation and translation updates should be provided if needed
  • [N/A] In case you submit database-related changes, they must be tested and compatible with SQLite 3 and MariaDB 10.5.12+

I will post a separate PR for documentation updates. There is currently no test infrastructure for the server component that I see, so I'm not sure what to do about writing tests.

This patch does not support AutoTLS. In theory it should be possible to use autotls if 2 ports are socket-activated, but I don't see how AutoTLS can even work today as it opens 2 listeners on the same port, which I believe should fail.

@CLAassistant
Copy link

CLAassistant commented Sep 2, 2023

CLA assistant check
All committers have signed the CLA.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants