3 ms·

See this comment: https://news.ycombinator.com/item?id=35862698 https://news.ycombinator.com/item?id=35862698 If you implement socket activation and use an emp

by brasic 3y ago

See this comment: https://news.ycombinator.com/item?id=35862698 https://news.ycombinator.com/item?id=35862698 If you implement socket activation and use an empty network namespace your service can be totally disconnected from any network and still handle requests (because the socket FD it listens on was inherited from systemd). This makes exfiltration much more difficult.

PrimeMcFly 3y ago
Is there any way to do that for systems without systemd, like Devuan?
- KirillPanov 3y ago
  Sure, s6 has the same feature. Systemd just made up a fancy name ("socket activation") for it which is why people mistakenly assume you need systemd for it. https://skarnet.org/software/s6/s6-fdholderd.html https://skarnet.org/software/s6/s6-fdholderd.html https://wiki.gentoo.org/wiki/S6/File_descriptor_holder https://wiki.gentoo.org/wiki/S6/File_descriptor_holder http://www.skarnet.org/software/s6/socket-activation.html http://www.skarnet.org/software/s6/socket-activation.html
  - PrimeMcFly 3y ago
    Thanks!