any Go based supervisor alternative?

[ChrisLu]

I am tasked to start a go service in a python shop. However, for production environments, we have to use python based supervisord to manage the Go process if it ever goes down.

The Go deployment is extremely easy. But the python setup is just painful to automate (compared with Go code).

How do you manage the Go service on production and restart the Go service if it goes down?

Chris

[Caleb Spare]

runit

I don't have any particular need for my supervisor to be written in Go.

> --
> You received this message because you are subscribed to the Google Groups
> "golang-nuts" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to golang-nuts...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Matt Silverlock]

Existing, stable tools for process management are the way to go here. Supervisor, Upstart, systemd; use what fits into your system and what you're comfortable with using.

(I use Supervisor, but will likely migrate to systemd when Ubuntu/Debian do).

[Justin Israel]

I currently use supervisor as well to manage both Go and Python services,  and it works perfectly.

[Naoki INADA]

Circus (http://circus.readthedocs.org/ ) is an alternative supervisor.

It can manage socket. Graceful restarting is very easy when using circus.

example:

https://gist.github.com/methane/7397627#file-circus-ini

https://gist.github.com/methane/7397627#file-echo-server-go

[Daniel Theophanes]

godoc.org/bitbucket.org/kardianos/service

[Mathieu CARBONNEAUX]

https://github.com/ochinchina/supervisord is a go version of supervisord....

[ben...@gmail.com]

Part of my day job is working on Canonical's "Pebble" (https://github.com/canonical/pebble), a simple service manager written in Go. Unique features: layered configuration, and an HTTP-over-unix-socket API. It's GPLv3 licensed.

-Ben

[Robert Engels]

I would manage this externally. As complex as Kubernetes or as simple as initd.  

On Nov 23, 2022, at 1:01 PM, Mathieu CARBONNEAUX <mcarbo...@gmail.com> wrote:

https://github.com/ochinchina/supervisord is a go version of supervisord....

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/c9c2c380-ea48-4d0b-87d7-311c1e855379n%40googlegroups.com.

[Robert Engels]

I took a look at Pebble. I don’t see anything related to auth and credentials and it seems like a huge back door security hole. 

Did I miss something?

On Nov 23, 2022, at 3:20 PM, ben...@gmail.com <ben...@gmail.com> wrote:



--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/b29d35cb-0d95-4a0e-a869-842d56dead8bn%40googlegroups.com.

[Ben Hoyt]

I presume you're referring to API access? I wasn't around when the initial API and access control stuff was designed (it's inherited from snapd), but here's my understanding of how it works. The bulk of the API is exposed using HTTP-over-unix-socket, so is only accessible if you have permission to access the unix socket file. The access control handling code is at https://github.com/canonical/pebble/blob/727a82ae61756dca123d4e3a4b5d99b78f6e4bd8/internal/daemon/daemon.go#L153

There are a couple of API endpoints exposed via ordinary HTTP-over-TCP if you specify the "-http" command line arg, but those are very narrow, basically the "health" endpoint which returns true/false. See the two "GuestOK: true" endpoints here: https://github.com/canonical/pebble/blob/727a82ae61756dca123d4e3a4b5d99b78f6e4bd8/internal/daemon/api.go#L27

We use Pebble mostly in a Kubernetes context with a sidecar container in the pod talking to Pebble in another container in the same pod. This is done via the unix socket file in the Pebble container which is mounted in the sidecar container. People outside the pod can only access the GuestOK health endpoint (we use this for Kubernetes probes).

Thanks for taking a look. We may well be missing something!

-Ben

[robert engels]

It seems if you do it that way - you get all or nothing. Meaning if you have access to the socket - you can issue any command that is registered, and also start/stop any service with no further access controls.

Still, I looked at the code you referenced, and if you look at the caller here https://github.com/canonical/pebble/blob/727a82ae61756dca123d4e3a4b5d99b78f6e4bd8/internal/daemon/daemon.go#L221

It appears the user will always be nil - as userFromRequest() always returns nil - and no user authorization or access checking will be attempted. Unless I am missing something? Maybe the github source browser isn’t cross referencing as I would expect.

I would be very careful using a service orchestration system that hasn’t had a full security audit - there are almost backdoors lurking that can be exposed.

-- 
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/CAL9jXCEYnaZtuZFJC%3Da0mUXo6dU3ze6j89MEKGHWuvk3HEhC6g%40mail.gmail.com.