aktin / aktin/debian-updateagent-pkg

Unix socket docker support

Ouverte
#17 0 commentaires 0 réactions 2 personnes assignées Réclamée par @akomii Voir sur GitHub
Langage dominant
Shell
Étoiles
0
Forks
0
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

If we decided to use unix socket in our project, docker containers would not be able to directly interact with the sockets. That is because unix sockets communicate using filesystem paths on the host, like _/var/run/my-socket.sock_. Current docker communication uses internal network, therefore should not be able to communicate to unix socket.

Therefore to support docker, I came up with two possible solutions.

# Solution 1: Docker mount
By mounting the filesystem path into the wildfly container, communication using unix socket directly is possible.

## Pros
- Direct Unix socket communication
- few changes to update agent needed

## Cons
- Container needs to know and access sockets' owning UID/GID on host (**vulnerability**: per default _root_ is the owner, allowing docker to interact with host using root-permissions)
- Unix sockets path _/var/run_ is a convention, not forced by OS. (Shouldn't be a problem on most debian-based OS's tough)
- data warehouse is responsible to provide its correct identification, or else update agent cannot identify correct container.

# Solution 2: Two layered update agent
Keep a _listening TCP socket_ to relay the communication to the unix socket on the host.

## Pros
- few code changes for docker dwh
- update agent manages client identification (does not rely on information from container)
- open for more network-based requests and clients

## Cons
- need to implement a listening TCP socket, making Unix socket approach redundant (Unix sockets need fewer code to implement listening but here we implement both)
- Update agent could be reached from other clients inside the network (**possible vulnerability**)
- more complex update agent internal communication

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Piste de recherche

Issue #17 names no files, tests, or entry points. First decide which of the two proposed Docker/unix-socket approaches is required, then inspect the update agent and container configuration; done means the chosen approach supports communication safely while addressing its stated UID/GID or network-access risks.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
docker, shell
Domaine
devops, infrastructure
Type d'issue
Fonctionnalité
Difficulté
5/5
Temps estimé
Plus d'une semaine
Activité
Calme
Clarté
À clarifier
Accessibilité débutants
30/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.