aktin / aktin/debian-updateagent-pkg

Unix socket docker support

Aperta
#17 0 commenti 0 reazioni 2 assegnatari Rivendicata da @akomii Vedi su GitHub
Lingua principale
Shell
Stelle
0
Fork
0
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

If we decided to use unix socket in our project, docker containers would not be able to directly interact with the sockets. That is because unix sockets communicate using filesystem paths on the host, like _/var/run/my-socket.sock_. Current docker communication uses internal network, therefore should not be able to communicate to unix socket.

Therefore to support docker, I came up with two possible solutions.

# Solution 1: Docker mount
By mounting the filesystem path into the wildfly container, communication using unix socket directly is possible.

## Pros
- Direct Unix socket communication
- few changes to update agent needed

## Cons
- Container needs to know and access sockets' owning UID/GID on host (**vulnerability**: per default _root_ is the owner, allowing docker to interact with host using root-permissions)
- Unix sockets path _/var/run_ is a convention, not forced by OS. (Shouldn't be a problem on most debian-based OS's tough)
- data warehouse is responsible to provide its correct identification, or else update agent cannot identify correct container.

# Solution 2: Two layered update agent
Keep a _listening TCP socket_ to relay the communication to the unix socket on the host.

## Pros
- few code changes for docker dwh
- update agent manages client identification (does not rely on information from container)
- open for more network-based requests and clients

## Cons
- need to implement a listening TCP socket, making Unix socket approach redundant (Unix sockets need fewer code to implement listening but here we implement both)
- Update agent could be reached from other clients inside the network (**possible vulnerability**)
- more complex update agent internal communication

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Issue #17 names no files, tests, or entry points. First decide which of the two proposed Docker/unix-socket approaches is required, then inspect the update agent and container configuration; done means the chosen approach supports communication safely while addressing its stated UID/GID or network-access risks.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
docker, shell
Ambito
devops, infrastructure
Tipo di issue
Funzionalità
Difficoltà
5/5
Tempo stimato
Più di una settimana
Stato di attività
Tranquilla
Chiarezza
Da chiarire
Idoneità per principianti
30/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.