Add socket activation support by preloading libsdsock with LD_PRELOAD

[eriksjolund]

Status: experimental

Is it possible to use socket activation even when the executable in the container image does not support socket activation?

Yes, sometimes.
If the executable in the container is dynamically linked, it might be possible to preload the library libsdsock
to add support for socket activation.

The container unit needs to set the environment variables LD_PRELOAD and LIBSDSOCK_MAP

Environment=LD_PRELOAD=/usr/local/lib/libsdsock.so
Environment=LIBSDSOCK_MAP=tcp://0.0.0.0:8080=myweb.socket

Also modify the container image so that it has the systemd libraries (RPM package: systemd-libs) and the file /usr/local/lib/libsdsock.so installed.

I documented it as a step-by-step example

example: pasta + custom network + socket activation + libsdsock - source address preserved

[afbjorklund]

You could also use systemd-socket-proxy, for the good ole inetd feeling

https://www.freedesktop.org/software/systemd/man/latest/systemd-socket-proxyd.html

[eriksjolund]

True, but if you use systemd-socket-proxy, then the network server will not see the correct source IP address (i.e. the IP address of the client).

I think the main advantage of using libsdsock with LD_PRELOAD is that the source address is preserved. There might also be a performance advantage compared to using PublishPort but I haven't done any benchmarks. The traffic sent over the socket-activated socket is sent directly to the network server (not via pasta).

Currently pasta does not support preserving the source IP address when a custom network is used.

For example a quadlet setup like this does not support preserving the source address:

file: ~/.config/containers/systemd/mynet.network

[Network]
Internal=true

file: ~/.config/containers/systemd/myweb.container

[Container]
Image=localhost/myweb
Network=mynet.network
PublishPort=8080:8080

[Install]
WantedBy=default.target

Changing such a setup to use libsdsock with LD_PRELOAD instead would fix the source address problem.