Skip to content

docs: the TCP-hop sections name themselves as TCP mode #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sammuli merged 1 commit into from
Oct 13, 2026
Merged

docs: the TCP-hop sections name themselves as TCP mode #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,7 @@ existing HTTPS port, TLS and SciTokens.
│ HTTPS
▼
XRootD :443 ── XrdHttpMdsip holds one mdsip socket per session
│ mdsip over TCP
│ mdsip over TCP or a Unix socket
▼
mdsip server (sandboxed) does the actual work
```
Expand Down Expand Up @@ -376,8 +376,9 @@ origin: rootless podman maps container uid 0 to the invoking user, so sharing
the account makes container-root the owner of the issuer keys.
[`deploy/fdp-mdsip.container`](deploy/fdp-mdsip.container) is the quadlet unit
for that; `docs/security.md` has the account setup and one consequence worth
knowing — the two containers can no longer share a podman network, so the relay
must reach mdsip via `host.containers.internal`.
knowing — the two containers can no longer share a podman network, so in TCP mode the
relay must reach mdsip via `host.containers.internal`; production avoids the hop
entirely with `socket=` (above).

`tests/security/verify_sandbox.sh` asserts each control by attacking it through
ordinary TDI, the same channel a client has. It first confirms the client
Expand Down
6 changes: 5 additions & 1 deletion docs/deployment-notes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,9 @@ only ever choose which origin a session starts on.

### Getting the relay to the sandbox: the hop that needs thought

This is the TCP mode, used when `MDSIP_SOCKET` is blank; production uses the
Unix socket described under the directive below and publishes nothing.

The origin container publishes ports (`-p 8000:8000 -p 8443:8443`) rather than
using host networking, so it is on a podman bridge. Two consequences:

Expand Down Expand Up @@ -263,7 +266,8 @@ an unprivileged subuid, which is a better mapping than the rootless default.
### What has to change on the origin

1. **Two bind mounts** into the origin container: the `.so`, and a config
fragment.
fragment. Socket mode adds a third, the socket directory, mounted into both
containers.
2. **`Xrootd.ConfigFile`** in the Pelican config pointing at that fragment.
Pelican allows one, so if it is already in use the fragment has to merge with
what is there.
Expand Down
Loading