Email or username:

Password:

Forgot your password?
Lennart's posts Post Back to profile
Top-level
Lennart Poettering

the network. AF_VSOCK is an address family that is supported on many hypervisors (including kvm/qemu), that allows talking to VMs without bothering with a real network. It's modeled after IP but can be vastly simpler since there's no routing or anything. The aforementioned generator just binds ssh to AV_VSOCK port 22, via socket activation (this is hence more or less "free"), and only if sshd is actually installed. Moreover, if a container mgr mounts /run/host/unix-export/ into the container…

9 January at 10:09 | Open on mastodon.social
3 comments
Lennart Poettering

… the generator will bind an AF_UNIX socket into it also providing ssh. The idea is that that dir is mounted both into the container and into the host, so that the AF_UNIX is accessible from both. The other side of the equation is that a tiny plugin for the ssh client which allows connecting to AF_VSOCK/AF_UNIX sockets. In effect: without any further manual configuration full OS containers and VMs are now accessible from the host without any networking. Just run "ssh vsock/4711" or …

9 January at 10:12 | Open on mastodon.social
Lennart Poettering

"ssh unix/run/systemd/nspawn/unix-export/foo/ssh" to connect to a VM or container, without any need to configure or wait for a networking. It really *just* works.

Additional AF_VSOCK/AF_UNIX sockets to listen on can also be configured via kernel cmdline, and system credentials.

Oh and to make things complete we'll always listen on a locally accessible AF_UNIX socket too, to accodomodate for usecase such as @siosm's: tim.siosm.fr/blog/2023/12/19/s in a uniform, systematic way, that always works.

"ssh unix/run/systemd/nspawn/unix-export/foo/ssh" to connect to a VM or container, without any need to configure or wait for a networking. It really *just* works.

Additional AF_VSOCK/AF_UNIX sockets to listen on can also be configured via kernel cmdline, and system credentials.

Oh and to make things complete we'll always listen on a locally accessible AF_UNIX socket too, to accodomodate for usecase such as @siosm's: tim.siosm.fr/blog/2023/12/19/s in a uniform, systematic...

9 January at 10:16 | Open on mastodon.social
Lennart Poettering

@siosm anyway, the PR is here: github.com/systemd/systemd/pul

The PR is almost ready, I just need to add some test cases.

Enjoy.

9 January at 10:18 | Open on mastodon.social
Go Up