search

yuzutech / kroki

Creates diagrams from textual descriptions!
https://kroki.io
MIT License
2.87k stars 211 forks source link

allow binding to unix socket #1329

Closed nolange closed 1 year ago

nolange commented 2 years ago

Hello,

I am using podman with rootless containers, this brings some certain inefficiencies when it comes to network communication. What I would propose is to support creating a unix socket. Like

podman run -d --name kroki_unix --restart always \
  -e KROKI_LISTEN=unix:/run/container-sockets/kroki.sock \
  --restart=always \
  --network none \
  -v /tmp/container-sockets:/run/container-sockets \
  --security-opt label=disable --umask 0002 \
  docker.io/yuzutech/kroki

Then later the reverse proxy can pick up that socket (nginx: server unix:/tmp/container-sockets/kroki.sock;), and add SSL on top (or whatever).

Unix sockets should be fairly efficient and would avoid all network/subnet/ipdaddress drama.

(Another option would be socket activation, ie. getting a filedescriptot passed down).

ggrossetie commented 2 years ago

Since Vert.x seems to support listening on a socket: https://vertx.io/docs/apidocs/io/vertx/core/http/HttpServer.html#listen-io.vertx.core.net.SocketAddress- it's a reasonable request.

I believe it's pretty safe to assume that if the value starts with unix: then it's a socket address...?

nolange commented 2 years ago

Since Vert.x seems to support listening on a socket: https://vertx.io/docs/apidocs/io/vertx/core/http/HttpServer.html#listen-io.vertx.core.net.SocketAddress- it's a reasonable request.

Great

I believe it's pretty safe to assume that if the value starts with unix: then it's a socket address...?

Depends on the code doing the parsing. Its pretty common to use unix: for unix sockets, see the nginx server keyword. If you are worried about ambiguities (someone having a host named unix), then you can additonally support tcp: for AF_INET sockets (as that guy could then specify tcp:unix:8080).

ggrossetie commented 2 years ago

That's a good idea but I think we should wait until someone comes forward with a host named unix. It seems like a bad idea to name your host with a protocol name unix, http, file...

If you want to implement this feature, feel free to open a pull request. I would gladly merge it!