search

hashicorp / go-plugin

Golang plugin system over RPC.
Mozilla Public License 2.0
5.25k stars 450 forks source link

Add TempDir option to UnixSocketConfig #282

Closed tomhjp closed 1 year ago

tomhjp commented 1 year ago

When running plugins in containers with systemd's PrivateTmp=true setting, the containers are not sub-processes so they are not part of the plugin client's file system namespace - as such /tmp is different for the 2 sides of the connection and they can't establish communication.

As a workaround, TMPDIR can be set to something that is the same on both sides like /home/user/tmp, but that punctures the PrivateTmp setting for all other uses of /tmp as well. This lets us choose a single exception.

tomhjp commented 1 year ago

That's a fair comment, the field names were pretty confusing with this addition. TempDir is a new field, and we already tracked directory (now renamed to socketDir to try to improve disambiguation). TempDir is the dir that socketDir will be created in. socketDir is the dir that unix sockets will be created in. We have two layers because we want to both be able to:

  1. Specify a base directory that is visible to both the host and plugin
  2. And use a unique directory per-plugin so that plugins' unix sockets can be made not visible to each other.

I tried to improve the comments and field names a bit in bf6a95e, but lmk if I didn't succeed.

tomhjp commented 1 year ago

Thanks!