News for hackers. Stuff that matters.

A comment on BPF port-based firewall for systemd services. Parent comment

Re:BPF port-based firewall for systemd services by ldng on Friday August 30, 2019 @07:33PM (#20843671)
Really, what is the goal and when the feature creep ends ? At Kubernetes certification ?

As much as I loved the unit conf + socket activation concept at first and supported SystemD. It's become and unruly teenager. It has severely hindered my productivity on several occasion but I'm stuck with it on Debian. One more glitch and I'll probably start hating it's guts badly...

[ Parent | on HN ]
Re:BPF port-based firewall for systemd services by tomatocracy on Friday August 30, 2019 @07:45PM (#20843737)
I agree (and I'd say the low point was when I upgraded a laptop to buster and silently ended up with systemd-resolved ignoring my local LAN DNS to try to forward everything to 8.8.8.8 so couldn't resolve local hostnames).

However, you're not stuck with systemd on Debian. Install sysvinit-core and remove systemd-sysv, and install libpam-elogind and elogind instead of libpam-systemd if you need it. You'll very likely still end up with some of the libraries installed - it's not the end of the world and you can install Devuan if you really don't want that, but systemd won't be running as PID 1 and you don't get rubbish like journald or resolved.

[ Parent | on HN ]
Re:BPF port-based firewall for systemd services by ldng on Saturday August 31, 2019 @04:22AM (#20845200)
On my personal machine I might end up doing just that. But that can not always be changed in working environment.

Edit : Also been bitten by the DNS mingling.

[ Parent | on HN ]