bug#43540: closed ([PATCH] Instantiate nscd in each system container instead of using the container host's service.)

[GNU bug Tracking System]

Your message dated Thu, 01 Oct 2020 09:29:19 +0200
with message-id <871rii1k1c.fsf@gnu.org>
and subject line Re: [bug#43540] [PATCH] Instantiate nscd in each system 
container instead of using the container host's service.
has caused the debbugs.gnu.org bug report #43540,
regarding [PATCH] Instantiate nscd in each system container instead of using 
the container host's service.
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs@gnu.org.)


-- 
43540: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=43540
GNU Bug Tracking System
Contact help-debbugs@gnu.org with problems

--- Begin Message --- Subject: [PATCH] Instantiate nscd in each system container instead of using the container host's service. Date: Sun, 20 Sep 2020 18:05:02 -0400

Hello Guix,

Currently, Guix system containers hosted on machines that run nscd are configured to use that daemon's socket by bind-mounting /var/run/nscd into the container's filesystem. As discussed in bug#41575, there are certain nscd configurations that expose information from the host's /etc files into the container's processes, and aside from the security implications, this exposure can lead to anomalous behavior inside the containers, including failure to boot.

The following patch gives each container a private nscd instance. While Guix's default nscd configuration caches pretty aggressively (for hostnames, up to 32MB with a 12h TTL), the per-container nscd uses a smaller cache size of 256kB, which means that the overhead of this change should be modest even on systems with many containers.

This patch has been lightly tested by verifying the following:

- `make check` and `guix pull`

- successful boot and operation of a system container

- presence of nscd in the container

- correct cache sizes in nscd.conf

Per my employer's guidelines for OSS contributors, this patch contains:

- My corporate email address in the "From" line

- My employer listed as copyright holder (this has already been cleared with Ludo')

Thanks!

Jason

one-nscd-per-container.patch
Description: Source code patch

--- End Message ---

> --- Begin Message ---
>
>
>
> Subject: 
>
> Re: [bug#43540] [PATCH] Instantiate nscd in each system container instead of using the container host's service.
>
>
>
>
> Date: 
>
> Thu, 01 Oct 2020 09:29:19 +0200
>
>
>
>
> User-agent: 
>
> Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
>
>
>
>
> Hey Jason,
>
> > Hi Mathieu, thanks for the feedback. Please find the revised patch and log 
> > attached.
>
> Pushed with a slightly adjusted commit message as
> 5627bfe45ce46f498979b4ad2deab1fdfed22b6c.
>
> Thanks,
>
> Mathieu
>
>
> --- End Message ---