Skip to content

feat(http_server source): add unix domain socket support - #25960

Open
GobinathAL wants to merge 1 commit into
vectordotdev:masterfrom
GobinathAL:master
Open

feat(http_server source): add unix domain socket support#25960
GobinathAL wants to merge 1 commit into
vectordotdev:masterfrom
GobinathAL:master

Conversation

@GobinathAL

Copy link
Copy Markdown

Adds support for listening on Unix Domain Sockets (UDS) in the http_server source by introducing a socket_path config parameter, along with permissions/ownership settings.

Summary

Adds support for listening on Unix Domain Sockets (UDS) as an alternative to TCP in the http_server source. This enables receiving HTTP requests over local Unix sockets with fine-grained file permissions (socket_file_mode) and ownership (socket_file_uid, socket_file_gid) controls.

Resolves #22158.

Vector configuration

sources:
  my_http_uds_source:
    type: http_server
    socket_path: /var/run/vector-http.sock
    socket_file_mode: 432 # octal 0660
    socket_file_uid: 1000
    socket_file_gid: 1000

How did you test this PR?

  • Added unit tests in src/sources/http_server.rs covering configuration deserialization, mutual exclusivity validation between TCP address and UDS socket_path, socket file creation, event reception over UDS, and socket cleanup on shutdown.
  • Manually verified end-to-end HTTP payload reception via curl --unix-socket against a running containerized Vector instance.
  • Verified code formatting with cargo fmt -- --check.

Is this a breaking change?

  • Yes
  • No

Does this PR include user facing changes?

  • Yes. Please add a changelog fragment based on our guidelines.
  • No. A maintainer will apply the no-changelog label to this PR.

References

Adds support for listening on Unix Domain Sockets (UDS) in the http_server source by introducing a `socket_path` config parameter, along with permissions/ownership settings.
@GobinathAL
GobinathAL requested a review from a team as a code owner July 28, 2026 17:19
@github-actions

github-actions Bot commented Jul 28, 2026

Copy link
Copy Markdown
Contributor

All contributors have signed the CLA ✍️ ✅
Posted by the CLA Assistant Lite bot.

@github-actions github-actions Bot added the domain: sources Anything related to the Vector's sources label Jul 28, 2026
@datadog-vectordotdev

datadog-vectordotdev Bot commented Jul 28, 2026

Copy link
Copy Markdown

Pipelines

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8d9fa8f | Docs | Datadog PR Page | Give us feedback!

@GobinathAL

Copy link
Copy Markdown
Author

I have read the CLA Document and I hereby sign the CLA

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d9fa8f3d1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

};

#[cfg(unix)]
use crate::sources::util::{change_socket_ownership, change_socket_permissions};

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate Unix helpers behind the net-unix feature

When building on Unix with an HTTP-prelude user such as sources-prometheus-remote-write or sources-prometheus-pushgateway, sources-utils-http compiles this file but those features do not enable sources-utils-net-unix in Cargo.toml. The helpers imported here are only re-exported from sources::util when sources-socket or sources-utils-net-unix is enabled, so those feature builds fail with unresolved imports even though they do not use UDS. Gate the new UDS code/imports on the same feature or move the dependency to the shared HTTP feature.

Useful? React with 👍 / 👎.

Comment on lines +874 to +877
let source = SimpleHttpConfig {
socket_path: Some(socket_path.clone()),
socket_file_mode: Some(0o660),
..Default::default()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clear the default address in the UDS test

This Unix test constructs a UDS config with ..Default::default(), but Default still sets address: Some(0.0.0.0:8080). Since build() calls validate_address() and rejects configs with both address and socket_path, the test panics before the Unix socket is bound; set address: None for this UDS configuration.

Useful? React with 👍 / 👎.

Comment on lines +843 to +844
#[test]
fn unix_socket_config_validation() {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Gate the validation test to Unix

On non-Unix targets this unconditional test fails in the first “valid config” case, because validate_address() deliberately returns an error whenever socket_path is configured on a non-Unix platform. Either add #[cfg(unix)] to this test or split out a non-Unix expectation so Windows CI does not fail on the new UDS-only assertion.

Useful? React with 👍 / 👎.

Comment on lines +325 to +328
let make_svc = make_service_fn(move |_conn: &tokio::net::UnixStream| {
let svc = ServiceBuilder::new()
.layer(build_http_trace_layer(span.clone()))
.service(warp::service(routes.clone()));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Honor keepalive limits for Unix sockets

For UDS listeners this service builder omits the MaxConnectionAgeLayer that the TCP branch applies just above, so keepalive.max_connection_age_secs (defaulting to 300 seconds) is ignored for HTTP/1.x clients connected over socket_path. A long-lived UDS client can therefore keep a connection open indefinitely despite the configured keepalive limit; apply the same layer here or explicitly reject/document the setting for UDS.

Useful? React with 👍 / 👎.

Comment on lines +453 to +454
let address = match (&self.address, &self.socket_path) {
(None, None) => Some(default_address()),

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject configs without a listener

If a user omits both address and socket_path, this now silently falls back to 0.0.0.0:8080; before this change address was a required field, so the same typo/missing listener was rejected instead of opening a public TCP listener on the default port. Treat the (None, None) case as a validation error, or keep the default only for generated/example configs.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: sources Anything related to the Vector's sources

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Allow listening on unix sockets for http_server sources

1 participant