[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug#43540] [PATCH] Instantiate nscd in each system container instead of

From: Jason Conroy
Subject: [bug#43540] [PATCH] Instantiate nscd in each system container instead of using the container host's service.
Date: Sun, 20 Sep 2020 18:05:02 -0400

Hello Guix,

Currently, Guix system containers hosted on machines that run nscd are configured to use that daemon's socket by bind-mounting /var/run/nscd into the container's filesystem. As discussed in bug#41575, there are certain nscd configurations that expose information from the host's /etc files into the container's processes, and aside from the security implications, this exposure can lead to anomalous behavior inside the containers, including failure to boot.

The following patch gives each container a private nscd instance. While Guix's default nscd configuration caches pretty aggressively (for hostnames, up to 32MB with a 12h TTL), the per-container nscd uses a smaller cache size of 256kB, which means that the overhead of this change should be modest even on systems with many containers.

This patch has been lightly tested by verifying the following:

- `make check` and `guix pull`
- successful boot and operation of a system container
- presence of nscd in the container
- correct cache sizes in nscd.conf

Per my employer's guidelines for OSS contributors, this patch contains:

- My corporate email address in the "From" line
- My employer listed as copyright holder (this has already been cleared with Ludo')



Attachment: one-nscd-per-container.patch
Description: Source code patch

reply via email to

[Prev in Thread] Current Thread [Next in Thread]