[bug#54811] [PATCH 0/3] Support socket activation in 'guix publish' and 'guix-daemon'

[Ludovic Courtès]

Maxime Devos <maximedevos@telenet.be> skribis:

> Ludovic Courtès schreef op zo 10-04-2022 om 19:34 [+0200]:

[...]

>> One thing is sure: when ‘--advertise’ is used, we shouldn’t use socket
>> activation or nothing will be advertised.  Is that what you mean?
>
> No, how would socket activation prevent advertising?

As currently implemented in the Shepherd, socket activation means that
the process is started lazily, the first time a connection request is
made.  If the ‘guix publish’ process isn’t started, then DNS-SD
publication doesn’t happen.

> How would guile- avahi even know that we are doing socket activation?
>
> What I mean was:
>
>   * if guile-avahi sends messages to the network by itself,
>     then it cannot be run inside a networkless container,
>     otherwise only the container's loopback would receive them.
>
>   * if guile-avahi talks to some daemon via a unix domain socket,
>     then no problem

Guile-Avahi talks to avahi-daemon over a Unix-domain socket;
avahi-daemon then does the actual mDNS/DNS-SD publication.

>   * IIUC, previously, "guix publish" could not be run inside a network
>     container, because it tried to listen by itself (and listening
>     to a container's own loopback isn't useful).
>
>   * but in case of socket activation, this problem disappears

Well, shepherd, as an ordinary process in the container, would also try
to listen by itself.  But I think that’s fine; worst thing is nobody
ever connects to that socket, but that’s ok, no?

>   * bonus: except possibly for the secret key material, "guix publish"
>     does not have to be started  as root anymore even if uses a
>     reserved port such as port 80 (assuming socket activation is used).

But it does need to access the secret key…

Ludo’.