support socket activation about bubblewrap HOT 4 OPEN

I don't think that is necessary. Bwrap passes on fds that it doesn't use by default.

from bubblewrap.

I think this could have been a false alarm after all, since this morning I used a very simple http server in python to really check whether the socket was being properly passed into the sandbox and I got it working by passing the newly added --no-desktop parameter to flatpak from the service file.

See the code I used for testing this here: https://github.com/mariospr/systemd-socketactivation/tree/flatpak

This said, we still have problems when trying to socket-activate a KA Lite server running inside a flatpak, but latest investigations suggest this might be caused due to how KA Lite uses internally a module call cherrypy to setup the server. Still investigating, though...

from bubblewrap.

Bwrap passes on fds that it doesn't use by default.

Should it, though ? Isn't that a good way of unintentionally leaking things into the sandbox ?

from bubblewrap.

Well we could add a flag to block leakage, but I think the default is to leak.
One of the sd_notify or socket activation relies on the parent PID of a process to tell the process
whether it cares about the leaked file descriptor, When running in a pid namespace, you might need to change LISTEN_PID to 1?

from bubblewrap.