Demo: Rootless Podman + MariaDB + socket activation

[eriksjolund]

I made a small demo about running MariaDB with rootless Podman and socket activation
https://github.com/eriksjolund/mariadb-podman-socket-activation

I tested adding --network none for both TCP and UNIX sockets
and it still worked to connect with the MariaDB client from the host.

Templated systemd user services work really well with UNIX sockets because you can
"auto-generate" a new path for a UNIX socket with the configuration

ListenStream=%h/mariadb-socket.%i

(%h expands to the home directory path. %i expands to the instance name)

When using TCP sockets, I guess you need to provide one systemd override configuration file
per instance, to be able to give each instance its own TCP port number.

[rhatdan]

Interested in recording it and publishing it?

[eriksjolund]

I could make a tweet. I'll just polish the text content somewhat first.

Another thing, I tested some more and it seems --security-opt label=disable is needed for UNIX sockets but not for TCP sockets. Is that result according to expectations?

[rhatdan]

Yes SELinux blocks interprocess communications, but does not block network communications. since it can not tell the difference between the container connecting to another host or to the same host.

[eriksjolund]

Thanks, for explaining.

[eriksjolund]

Tweet: https://twitter.com/eriksjolundcomp/status/1491162016429768704