How to run a socket-activated Nginx container with rootless Podman?

[eriksjolund]

How to run a socket-activated Nginx container with rootless Podman?

I'm not sure this is even possible.

A question is whether Nginx supports socket activation.

"nginx includes an undocumented, internal socket-passing mechanism based on the NGINX environmental variable."

quote from
https://freedesktop.org/wiki/Software/systemd/DaemonSocketActivation/

See also:
https://trac.nginx.org/nginx/ticket/237

(If I find out the answer to my question, I'll fill it in later)

[eriksjolund]

I got a minimal demo working:

https://github.com/eriksjolund/podman-nginx-socket-activation

The demo shows that it is possible to run a socket-activated nginx container with rootless Podman.

Note
The Containerfile in the demo builds nginx with many features disabled. Hopefully the demo could be modified to instead use an official nginx container image.

Update 22 October 2022:

The container image docker.io/library/nginx now supports socket activation!
(nginx still has no support for the systemd environment variables LISTEN_FDS, LISTEN_FDNAMES, LISTEN_PID but the environment variable NGINX lets you combine a systemd socket unit with nginx)

[emansom]

Great stuff! 👍🏻

Have you tried flipping it around?

As Podman supports systemd as init within the container, I presume it would be possible to self-contain this.
Yielding similar benefits on resource saving, without requiring host modification.

[emansom]

(or bypassing the systemd-socket-proxyd and utilizing the same fd=3 hack, both methods should work when all systemd units are contained within the container.)

[eriksjolund]

Thanks, now I understand what you mean. That architecture provides on-demand start of nginx but it misses some other advantages.
When the socket originates from systemd on the host you also get

• Native network performance over the socket-activated socket
• Possibility to restrict the network in the container
• Possibility to restrict the network in the container, Podman and OCI runtime
• The source IP address is preserved

[emansom]

Made a crude diagram to eleborate:

sequenceDiagram
    participant host
    participant container
    participant systemd
    participant proxyd
    participant nginx
    host->>container: TCP :8080
    container->>systemd: .socket unit
    systemd->>proxyd: socket activation
    proxyd->>+nginx: activate NGINX
    nginx-->>-proxyd: exit-idle-time

Loading

[emansom]

Network restriction within the container can be handled by configuring nftables within the container. That should work fine thanks to netns isolation. For extra paranoid level security, there's udica 😃

For source IP preservation, there's X-Forwarded-For.

[eriksjolund]

For rootless Podman there is also slirp4netns that the traffic passes through. A good thing of letting systemd on the host create the listening socket is that the communication passing through the socket does not need to pass through slirp4netns.