aktin / aktin/debian-updateagent-pkg
Unix socket docker support
- Lenguaje dominante
- Shell
- Estrellas
- 0
- Forks
- 0
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
If we decided to use unix socket in our project, docker containers would not be able to directly interact with the sockets. That is because unix sockets communicate using filesystem paths on the host, like _/var/run/my-socket.sock_. Current docker communication uses internal network, therefore should not be able to communicate to unix socket.
Therefore to support docker, I came up with two possible solutions.
# Solution 1: Docker mount
By mounting the filesystem path into the wildfly container, communication using unix socket directly is possible.
## Pros
- Direct Unix socket communication
- few changes to update agent needed
## Cons
- Container needs to know and access sockets' owning UID/GID on host (**vulnerability**: per default _root_ is the owner, allowing docker to interact with host using root-permissions)
- Unix sockets path _/var/run_ is a convention, not forced by OS. (Shouldn't be a problem on most debian-based OS's tough)
- data warehouse is responsible to provide its correct identification, or else update agent cannot identify correct container.
# Solution 2: Two layered update agent
Keep a _listening TCP socket_ to relay the communication to the unix socket on the host.
## Pros
- few code changes for docker dwh
- update agent manages client identification (does not rely on information from container)
- open for more network-based requests and clients
## Cons
- need to implement a listening TCP socket, making Unix socket approach redundant (Unix sockets need fewer code to implement listening but here we implement both)
- Update agent could be reached from other clients inside the network (**possible vulnerability**)
- more complex update agent internal communication
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Línea de trabajo
Issue #17 names no files, tests, or entry points. First decide which of the two proposed Docker/unix-socket approaches is required, then inspect the update agent and container configuration; done means the chosen approach supports communication safely while addressing its stated UID/GID or network-access risks.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- docker, shell
- Área
- devops, infrastructure
- Tipo de issue
- Nueva funcionalidad
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Estado de actividad
- Tranquilo
- Claridad
- Necesita aclaración
- Aptitud para principiantes
- 30/100