-
Notifications
You must be signed in to change notification settings - Fork 937
Systemd init and orchestrator user #653
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This looks good! Thank you for not breaking behavior and for providing a command line option to build the proper init setup.
I'll experiment with this a bit.
A couple of things here:
So it's nice to see support for systemd and also to move away from running as root. Given orchestrator's default port bindings are above port 1024 this change shouldn't make any big change. However, it may mean that scripts expected to run as root may no longer work or require the use of sudo or equivalent if root functionality is required. I guess people who have already written such scripts to deploy with orchestrator will need to be aware of this change as it might cause surprises during MySQL failover handling which would not be good. Maybe if orchestrator should/could log if it's not running as root to make this a bit more noticeable. An extra log line won't cause any harm. |
This build fails on one of my boxes: Which means we depend on a specific version of So I'm inclined to look into |
@mateusduboli which version of |
0868672
to
1c79cc4
Compare
So @shlomi-noach, the problem was it needed package prefixes for user and groups. |
Extremely sorry for dropping this. Looking into. |
@sjmudd I don't see that there's a generic way to do that. Solutions I see use Post-install scripts to copy either
Oh yes, I agree. It's great that this PR moves away from |
I'm pivoting at #915 |
Nice work on systemd :) Is it just me or you need to add : |
Same problem |
@Honiix could you please open a PR? |
Target issue: #229
Using systemd unit files allows us to do nifty things like auto restarts and managing logs via syslog and other features. So we found interesting to move with that.
Target issue: #117
Running as a privileged user has various security concerns with possible leaks and vulnerabilities when running in the wild, so this additions use
fpm
to create default "orchestrator" user and group on debs and rpm files.Disclaimer
On this PR I'm actually covering 2 issues, which is not ideal, but since I'm relying on changes made on one commit, I'm actually creating them as a single PR, which can be split later on.