Running as an unprivileged OCI container?

[mt-johan]

Hi!

Thank you for a great project!

I'd like to run ntpd-rs in a rootless unprivileged OCI container as NTP server side-car that I can hammer freely with requests.

(E.g. docker-ntp, but ntpd-rs with instead of chrony.)

As such, I don't want ntpd-rs to try to modify that container host's system time (and denying the SYS_TIME privilege).

To achieve this I tried to set

[[source]]
...
count = 4
...
[synchronization]
minimum-agreeing-sources = 1024

in ntp.toml which starts of as expected, but then errors out with

2025-03-19T13:59:01.109298Z  INFO ntpd::daemon::config: using config file at default location `"/etc/ntpd-rs/ntp.toml"`
2025-03-19T13:59:01.110612Z  WARN ntpd::daemon::config: Fewer sources configured than are required to agree on the current time. Daemon will not change system time.
2025-03-19T13:59:01.111000Z ERROR ntpd::daemon::system: Could not control clock: Insufficient permissions to interact with the clock.

Is there any way I can make ntpd-rs ignore the lack of control if it wont be used anyway?

/J

[davidv1992]

It is not possible to make ntpd-rs ignore the fact that it can't steer if you provide it with sources. Honestly I am not sure how this is handled with chrony in the example you provide.

What you can do is make it provide the system time as a time source to the network. This requires manually configuring a stratum and reference ID, and is not really recommended unless you have some other source synchronizing the system clock.

[mt-johan]

Thank you David.

It seems like chrony is using a virtual "NTP clock" that maintains an offset to the actual system time:

NTP clock: software clock (virtual) based on the system clock and internal to chronyd. It keeps the best estimate of the true time according to the configured time sources, which is served to NTP clients ...

Is this something that ntpd-rs could support in the future or does it conflict too much with current design and/or project goals?

[davidv1992]

We could support it in the future, but it would currently not be a priority for us.

[mt-johan]

Roger that. Thanks David. 👍