on demand sshd start about baseimage-docker HOT 5 CLOSED

I've tested this by running ssh-keygen in a loop, on a modern system this never takes over 200 milliseconds. I think the 'tens of seconds' remark in the documentation is either regarding to slow systems or older kernels where it was harder to get entropy.

from baseimage-docker.

Did you do your testing on a headless machine? Being able to gather entropy from a mouse and keyboard is obviously going to make this faster. Hardware PRNGs are going to make it faster.

Repeated testing I showed times between <100ms and >1100ms. Not tens of seconds by any means. Also I am pretty sure that this would only need to be done once per container, even if the service was started on demand... maybe if you were starting containers on demand this would be a big deal. What's this about regenerating the key every time? Won't you get bountiful warnings from your ssh client about unrecognized keys if you tried to do that?

If I generate both rsa and dsa format keys, I am still not seeing any results with those tens of seconds. Never more than one and a half seconds. This is on an (older?) x86 machine I use for most of my docker'ing.

Just curious why you wouldn't want ssh to be resident if it's listening. Does an idle sshd process listening on 22 consume lots of memory? On my system it doesn't seem to. Are you seeing any gains when you use the ipsvd? Where?

from baseimage-docker.

I don't see the point either, just trying to clear up an old issue.

What command did you use to generate the server key? I couldn't get it to go slow (> 200ms), even on my server, but my server is a VPS on a big Xeon machine so perhaps it's fast too.

from baseimage-docker.

for i in `seq 1 37`; do
  time (ssh-keygen -t rsa -f foo -P foofoofoo>/dev/null
    rm foo foo.pub; ssh-keygen -t dsa -f foo -P foofoofoo>/dev/null
    rm foo foo.pub
  )
done 2>&1 |grep real|sort

37 being the height of my terminal in rows and about as many results as I can display on one screen; a more rigorous test would do max/min/avg/med but I was aiming for just good enough to gauge ballpark numbers.

Yeah, I have no stake in this issue myself, no position either just trying to be generally helpful.

from baseimage-docker.

Now that SSH is disabled by default, I do not think this is useful.

from baseimage-docker.