Bind and drop privileges

[mitchellh]

Since Consul is meant to be able to act like a DNS server, it is preferable for it to be THE DNS server, running on port 53. Binding to this port requires root, but it is not ideal for consul itself to actually run as root.

Consul should take a -user flag so it can setuid to that user after binding ports.

[armon]

@mitchellh This is special. Apparently linux only applies setuid to the current thread... https://groups.google.com/forum/?fromgroups=#!topic/golang-nuts/BZWXqv3YSg4

Not sure of a sane way to do this, since the runtime has at least like 9 threads...

[andrewwatson]

Maybe it's best to just run bind on 53 and have it forward *.consul to consul instead. It would simplify things a bit and also provides a little insulation / scalability.

[armon]

@andrewwatson Great point. bind can also be used as a recursor instead of consul

[mitchellh]

Agreed that that is the best course of action. CLOSING!

[shibumi]

I strongly advise not to use setuid for this. It will give the process too much permissions. You should stick to a saner solution like giving the process the kernel capability CAP_NET_BIND_SERVICE. This will only allow binding on port 1023, nothing else. You can easily set this capability via systemd service files.