Using DNS Proxy with socket activation

[Barnoux]

Hello,

While dnsproxy can create sockets by itself, there are security and performance advantages of using a service manager, such as systemd, for creating the sockets. dnsproxy does not need to create listening sockets as long as dnsproxy inherits those sockets from its parent process. This technique is commonly named socket activation.

In my use case i use Podman to start ADGuardHome inside a container with the systemd service (it is called a quadlet).

Using socket activation can allows us to run ADGuardHome with fewer privileges because ADGuardHome would not need the privilege to create a socket. For example if Podman is running ADGuardHome as a filtering DNS, then it is possible to enable the Podman option to not use --network=host which improves security.

Using socket activation improves network performance ( i did some benchmark with dnsperf) when dnsproxy is run by rootless Podman in a systemd service. When using rootless Podman, network traffic is normally passed through Slirp4netns or Pasta. This comes with a performance penalty. Fortunately, communication over the socket-activated socket does not pass through Slirp4netns or Pasta so it has a sliglty less performance characteristics as the normal network on the host.

What do you think ?