| 5 Mar 2025 |
 Sandro 🐧 | I don't think I want that tbh 😅 | 16:05:02 |
 Arian | yeh don’t :D | 16:11:07 |
| Arian | I’d suggest always putting a socket in /run/servicename.sock | 16:11:19 |
| Sandro 🐧 | How does it then work with permissions? | 16:17:48 |
| Sandro 🐧 | also on my system I have one socket there which is a symlink to somewhere else | 16:17:58 |
 @adam:robins.wtf | the socket unit can specify permissions, no? | 16:32:03 |
| Sandro 🐧 | yeah, sometimes, but often they are the equivalent of 777 | 16:35:08 |
| Arian | SockerUser and SocketMode.
But usually unix domain sockets use SO_PEERCRED to figure out the user of the caller and make decisions on that
| 21:14:21 |
| Sandro 🐧 | 🤔 hmmmm | 22:57:21 |
| Sandro 🐧 | Do you have an idea if common things like Gunicorn or such application servers use that? | 22:57:34 |
| Arian | No idea. | 23:09:07 |
| Arian | Why don't you just use SocketUser and SocketMode ? | 23:09:32 |
| Arian | If there isn't more than one user consuming the socket | 23:09:49 |
| Arian | But e.g. postgres uses it https://www.postgresql.org/docs/current/auth-peer.html | 23:15:07 |
| 6 Mar 2025 |
| Sandro 🐧 | I currently have SockerUser but I should probably set SocketMode as it has 666 right now | 00:39:30 |
|  Grimmauld (moving to @grimmauld:grapevine.grimmauld.de) changed their display name from Grimmauld to Grimmauld (any/all). | 15:37:32 |
| Arian | I wonder if we could use this for the Test Driver: https://github.com/systemd/systemd/blob/main/NEWS#L1179-L1196 | 18:35:26 |
| Arian | currently all our wait_for_unit stuff is kind ad-hoc but it’s built into systemd now | 18:35:38 |
| Arian | it will send messages about unit state back to the VMM over VSOCK | 18:35:52 |
 @elvishjerricco:matrix.org | well that sounds like a big improvement | 18:37:07 |
| Arian | https://www.freedesktop.org/software/systemd/man/latest/systemd.html#Readiness%20Protocol | 18:37:21 |
| @elvishjerricco:matrix.org | I didn't realize PID1 was conscientious about being hosted as a container or vm | 18:38:35 |
 Alyssa Ross | IIRC it basically has to be | 19:12:21 |
| Alyssa Ross | Even s6-linux-init is | 19:12:30 |
| Arian | It isn't really. It just checks if there is a socket passed in through a credential | 19:20:19 |
| @elvishjerricco:matrix.org | how do you pass a socket in through a credential? | 19:23:01 |
| Arian | https://www.freedesktop.org/software/systemd/man/latest/systemd.html#vmm.notify_socket | 19:23:49 |
| Arian | It's the socket address. Not socket. Sorry | 19:24:54 |
| Arian | So for VMs it's the vsock address. For containers it's a Unix domain socket path | 19:25:07 |
| @elvishjerricco:matrix.org | I guess I don't understand vsock things :P | 19:29:15 |
