* bug#41575: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch [not found] ` <87y2ld9ym2.fsf@gnu.org> @ 2020-09-14 1:05 ` conjaroy 2020-09-14 7:26 ` Ludovic Courtès [not found] ` <87tuw0ddn3.fsf@rdklein.fr> 1 sibling, 1 reply; 3+ messages in thread From: conjaroy @ 2020-09-14 1:05 UTC (permalink / raw) To: Ludovic Courtès; +Cc: 43371, edk, 41575 [-- Attachment #1: Type: text/plain, Size: 2223 bytes --] Hello Ludo', A separate nscd per container also seems like a reasonable option. However, for the sake of machines hosting many long-lived containers, perhaps we should consider reducing the cache size: currently it's 32MB for each name service type, with an expiration of 12-24 hours: https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/services/base.scm?id=1042d269a723360a02b19a2baafef1e24a3bfc73#n1115 Cheers, Jason On Sun, Sep 13, 2020 at 5:05 PM Ludovic Courtès <ludo@gnu.org> wrote: > Hi, > > edk@beaver-labs.com skribis: > > > doc/guix.texi: (Name Service Switch) add a workaround for bug #41575 > > --- > > doc/guix.texi | 16 +++++++++++++++- > > 1 file changed, 15 insertions(+), 1 deletion(-) > > > > diff --git a/doc/guix.texi b/doc/guix.texi > > index a6e14ea177..a9472e680e 100644 > > --- a/doc/guix.texi > > +++ b/doc/guix.texi > > @@ -1706,6 +1706,20 @@ this binary incompatibility problem because those > @code{libnss_*.so} > > files are loaded in the @command{nscd} process, not in applications > > themselves. > > > > +For applications running in containers (@pxref{Invokin guix container}), > > +however, @code{nscd} may leak information from the host to the > container. > > +If there is a configuration mismatch between the two ---e.g., the host > > +has no @code{sshd} user while the container needs one--- then it may be > > I find the example is hard to understand. How about: “applications in > the container could end up looking users in the host”? > > > +worthwhile to limit which kind of information the host's @code{nscd} > > +daemon may give to the container by adding the following to > > +@code{/etc/nscd.conf}. > > + > > +@example > > + enable-cache passwd no > > + enable-cache group no > > + enable-cache netgroup no > > +@end example > > Actually, perhaps the better fix is to never use the host’s nscd? We > could change ‘containerized-operating-system’ accordingly. > > That would allow guest OSes to work correctly regardless of the host’s > nscd config, which seems like an improvement. > > Thoughts? > > Ludo’. > [-- Attachment #2: Type: text/html, Size: 3017 bytes --] ^ permalink raw reply [flat|nested] 3+ messages in thread
* bug#41575: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch 2020-09-14 1:05 ` bug#41575: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch conjaroy @ 2020-09-14 7:26 ` Ludovic Courtès 0 siblings, 0 replies; 3+ messages in thread From: Ludovic Courtès @ 2020-09-14 7:26 UTC (permalink / raw) To: conjaroy; +Cc: 43371, edk, 41575 Hi, conjaroy <conjaroy@gmail.com> skribis: > A separate nscd per container also seems like a reasonable option. However, > for the sake of machines hosting many long-lived containers, perhaps we > should consider reducing the cache size: currently it's 32MB for each name > service type, with an expiration of 12-24 hours: > > https://git.savannah.gnu.org/cgit/guix.git/tree/gnu/services/base.scm?id=1042d269a723360a02b19a2baafef1e24a3bfc73#n1115 Good point. In that case, we can have ‘containerized-operating-system’ provide its own NSS configuration with a reduced cache size (or without cache since there’s caching happening on the host for host name lookups, for instance). WDYT? Would you like to give it a try? Thanks, Ludo’. ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <87tuw0ddn3.fsf@rdklein.fr>]
* bug#41575: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch [not found] ` <87tuw0ddn3.fsf@rdklein.fr> @ 2020-10-05 8:36 ` Ludovic Courtès 0 siblings, 0 replies; 3+ messages in thread From: Ludovic Courtès @ 2020-10-05 8:36 UTC (permalink / raw) To: Edouard Klein; +Cc: 41575, 43371-done, conjaroy Hi, Edouard Klein <edou@rdklein.fr> skribis: >> Actually, perhaps the better fix is to never use the host’s nscd? We >> could change ‘containerized-operating-system’ accordingly. >> > > I think this would be best, but I did not know where to make this > change, so I just edited the doc instead. I don't know if containers > need the host's nscd to avoid the libc issues mentionned in the doc, but > if they dont, then prevening them from accessing the host's nscd seems > logical and would solve the problem. And we wouldn't need to amend the > doc at all. This has now been done by Jason in 5627bfe45ce46f498979b4ad2deab1fdfed22b6c. Closing! Ludo’. ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-10-05 8:39 UTC | newest] Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- [not found] <87lfhet1d2.fsf@rdklein.fr> [not found] ` <87y2ld9ym2.fsf@gnu.org> 2020-09-14 1:05 ` bug#41575: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch conjaroy 2020-09-14 7:26 ` Ludovic Courtès [not found] ` <87tuw0ddn3.fsf@rdklein.fr> 2020-10-05 8:36 ` Ludovic Courtès
Code repositories for project(s) associated with this public inbox https://git.savannah.gnu.org/cgit/guix.git This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).