51 ms·
It is interesting that after 6 years from the article publication its key concept of persistent sockets and services starting on demand is not there yet. For e
by fpoling 11y ago
It is interesting that after 6 years from the article publication its key concept of persistent sockets and services starting on demand is not there yet.
For example, on the latest Fedora sshd/nginx/php-fpm still bind their listening sockets themselves rather than receiving it from a process manager. Similarly, if one wants to implement a socket activation in Go, it is not a one-liner that just works, but it requires a third-party library to read the socket passed over stdin.
As a result if for performance/security reasons one needs to customize few service socket parameters, then at best one need to look at application-specific configuration language for socket customization and hope that the developers have not forgotten to expose the socket option that is needed. At worst one uses LD_PRELOAD and similar atrocities to customize the sockets.
- Mic92 11y agoI would not consult an external library in Go to implement this simple function: https://github.com/Mic92/whois42d/blob/master/server.go#L93 https://github.com/Mic92/whois42d/blob/master/server.go#L93
- bencord0 11y agoI think we all got distracted by docker in 2013. nspawn containers can be socket activated, but doing the same in docker is still tricky. Also, we're all collectively still thinking of containers in terms of tiny-VMs instead of highly customized, tcp processing daemons, aka. websites.
- fpoling 11y agoThe trickery with docker is that it does not support passing sockets over its HTTP based client-server protocol. But one can still receive a socket from a named pipe.
- cyphar 11y agoYou can't pass socket fds over TCP, nor should you want to. That particular unixism only works for AF_UNIX sockets.
- pquerna 11y agosshd and apache2 for example both support systemd socket activation -- whether distributions actually do that is up to the distros. CoreOS for example runs sshd via socket activation.
- anonbanker 11y agoDidn't CoreOS recently dump systemd?
- fpoling 11y agoOn CoreOS the integration is buggy. One cannot start a long running process from sshd as when one logs out, all processes started from sshd are killed. One can workaround that using systemd-run utility to start long-running operation, but that is a privileged operation. Besides, it violates one of the premises of socket activation that it should be completely transparent.