Hacker News new | ask | show | jobs
by rendaw 423 days ago
I never understood the use case for socket activation - is someone really running a web server that mixed workloads, long periods with no network traffic you'd rather prioritize something else, and a web server that's so resource intensive when not handling events it makes sense to stop it? Maybe desktop computers?

The security aspect is something new to me and I'm not sure if that applies to inetd/systemd socket services or if it's specifically a container thing.

Does anyone have more info on use cases for this?
3 comments
ratorx 423 days ago
> the security aspect

It’s not a systemd-specific thing, but systemd makes it relatively easy to drop privileges (like network in this case), whilst also allowing socket-activated services to be configured easily. You can probably achieve the same thing with inetd + network namespaces (I think this is what systemd uses under the hood)

link
eriksjolund 423 days ago
You can use the podman option `--network=none` together with the systemd directive `RestrictAddressFamilies=`

I wrote a demo: https://www.redhat.com/en/blog/podman-systemd-limit-access

Podman will then not have the privilege to pull the container image, but a web server container can still serve the internet with socket activation.

link
rendaw 423 days ago
What's the use case for that? Multitenant server web hosting where customers provide containers and you want to lock them down I guess? Mostly SaaS/PaaS?
link
eriksjolund 423 days ago
I did it out of pure interest, just to explore ways of locking down a web server.
link
rendaw 422 days ago
Oh, fair enough! It is very cool, FWIW.
link
piaste 423 days ago
A public facing web server, I doubt it. But for a private one it can make a lot of sense - you are probably only using N services at a time, where N is the number of users.

As for what can be so resource intensive that it's worth to wait for startup time instead of running everything at the same time - a bunch of specialized LLMs is the obvious example. Or maybe you're a hobbyist cramming a hundred services into a tiny computer.

link
jbverschoor 423 days ago
On-demand applications. But the it should shut itself down after a while too.

It’s more useful for applications that keep open a connection for a while instead of stateless request/response architecture

link