feat: Add systemd socket activation for dstack-guest-agent

Replace systemd-socket-proxyd with native socket activation support.
This eliminates the proxy layer and allows the sockets to survive
service restarts, maintaining compatibility with containers that
mount /var/run/dstack.sock or /var/run/tappd.sock directly.

Changes:
- Add dstack-guest-agent.socket with both sockets (ordered)
- Remove dstack-socket.{socket,service} and tappd-socket.{socket,service}
- Add listenfd dependency for receiving sockets from systemd
- Add ActivatedUnixListener wrapper implementing rocket's Listener trait
- Modify run_internal/run_internal_v0 to use activated sockets when available
- Update dstack-guest-agent.service to require the socket unit

Author: kvinwang

Cargo.lock

@@ -105,6 +105,7 @@ tracing-subscriber = { version = "0.3.20", features = ["env-filter"] }
 safe-write = "0.1.2"
 nix = "0.29.0"
 sd-notify = "0.4.5"
+listenfd = "1.0"
 jemallocator = "0.5.4"
 
 # Serialization/Parsing

Cargo.toml

@@ -1,6 +1,7 @@
 [Unit]
 Description=dstack Guest Agent Service
-After=network.target tboot.service
+Requires=dstack-guest-agent.socket
+After=network.target tboot.service dstack-guest-agent.socket
 Before=docker.service
 
 [Service]

basefiles/dstack-guest-agent.service

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: 2025 Phala Network <dstack@phala.network>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+# Socket activation for dstack-guest-agent.
+# Provides backward compatibility for containers that mount sockets directly.
+# Socket order: dstack.sock (index 0), tappd.sock (index 1)
+
+[Unit]
+Description=dstack guest agent sockets
+
+[Socket]
+ListenStream=/var/run/dstack.sock
+ListenStream=/var/run/tappd.sock
+SocketMode=0777
+
+[Install]
+WantedBy=sockets.target

basefiles/dstack-guest-agent.socket

@@ -53,3 +53,4 @@ tempfile.workspace = true
 rand.workspace = true
 or-panic.workspace = true
 cc-eventlog.workspace = true
+listenfd.workspace = true

basefiles/dstack-socket.service

@@ -2,16 +2,17 @@
 //
 // SPDX-License-Identifier: Apache-2.0
 
-use std::{fs::Permissions, future::pending, os::unix::fs::PermissionsExt};
+use std::{future::pending, io, os::unix::net::UnixListener as StdUnixListener};
 
 use anyhow::{anyhow, Context, Result};
 use clap::Parser;
 use config::BindAddr;
 use guest_api_service::GuestApiHandler;
+use listenfd::ListenFd;
 use rocket::{
     fairing::AdHoc,
     figment::Figment,
-    listener::{Bind, DefaultListener},
+    listener::{unix::UnixStream, Bind, DefaultListener, Endpoint, Listener},
 };
 use rocket_vsock_listener::VsockListener;
 use rpc_service::{AppState, ExternalRpcHandler, InternalRpcHandler, InternalRpcHandlerV0};
@@ -26,6 +27,59 @@ mod http_routes;
 mod models;
 mod rpc_service;
 
+/// Socket indices for systemd socket activation.
+/// Order matches ListenStream declarations in dstack-guest-agent.socket.
+mod socket_index {
+    pub const DSTACK: usize = 0;
+    pub const TAPPD: usize = 1;
+}
+
+/// Systemd-activated sockets passed via LISTEN_FDS.
+struct ActivatedSockets {
+    dstack: Option<StdUnixListener>,
+    tappd: Option<StdUnixListener>,
+}
+
+impl ActivatedSockets {
+    fn from_env() -> Self {
+        let mut listenfd = ListenFd::from_env();
+        Self {
+            dstack: listenfd.take_unix_listener(socket_index::DSTACK).ok().flatten(),
+            tappd: listenfd.take_unix_listener(socket_index::TAPPD).ok().flatten(),
+        }
+    }
+}
+
+/// Wrapper for systemd-activated Unix socket that implements rocket's Listener trait.
+struct ActivatedUnixListener {
+    listener: tokio::net::UnixListener,
+}
+
+impl ActivatedUnixListener {
+    fn new(std_listener: StdUnixListener) -> io::Result<Self> {
+        std_listener.set_nonblocking(true)?;
+        let listener = tokio::net::UnixListener::from_std(std_listener)?;
+        Ok(Self { listener })
+    }
+}
+
+impl Listener for ActivatedUnixListener {
+    type Accept = UnixStream;
+    type Connection = UnixStream;
+
+    async fn accept(&self) -> io::Result<Self::Accept> {
+        Ok(self.listener.accept().await?.0)
+    }
+
+    async fn connect(&self, accept: Self::Accept) -> io::Result<Self::Connection> {
+        Ok(accept)
+    }
+
+    fn endpoint(&self) -> io::Result<Endpoint> {
+        self.listener.local_addr()?.try_into()
+    }
+}
+
 const CARGO_PKG_VERSION: &str = env!("CARGO_PKG_VERSION");
 const GIT_REV: &str = git_version::git_version!(
     args = ["--abbrev=20", "--always", "--dirty=-modified"],
@@ -52,6 +106,7 @@ struct Args {
 async fn run_internal_v0(
     state: AppState,
     figment: Figment,
+    activated_socket: Option<StdUnixListener>,
     sock_ready_tx: oneshot::Sender<()>,
 ) -> Result<()> {
     let rocket = rocket::custom(figment)
@@ -64,26 +119,36 @@ async fn run_internal_v0(
         .ignite()
         .await
         .map_err(|err| anyhow!("Failed to ignite rocket: {err}"))?;
-    let endpoint = DefaultListener::bind_endpoint(&ignite)
-        .map_err(|err| anyhow!("Failed to get endpoint: {err}"))?;
-    let listener = DefaultListener::bind(&ignite)
-        .await
-        .map_err(|err| anyhow!("Failed to bind on {endpoint}: {err}"))?;
-    if let Some(path) = endpoint.unix() {
-        // Allow any user to connect to the socket
-        fs_err::set_permissions(path, Permissions::from_mode(0o777))?;
+
+    if let Some(std_listener) = activated_socket {
+        // Use systemd-activated socket
+        info!("Using systemd-activated socket for tappd.sock");
+        let listener = ActivatedUnixListener::new(std_listener)?;
+        sock_ready_tx.send(()).ok();
+        ignite
+            .launch_on(listener)
+            .await
+            .map_err(|err: rocket::Error| anyhow!(err.to_string()))?;
+    } else {
+        // Fall back to binding our own socket
+        let endpoint = DefaultListener::bind_endpoint(&ignite)
+            .map_err(|err| anyhow!("Failed to get endpoint: {err}"))?;
+        let listener = DefaultListener::bind(&ignite)
+            .await
+            .map_err(|err| anyhow!("Failed to bind on {endpoint}: {err}"))?;
+        sock_ready_tx.send(()).ok();
+        ignite
+            .launch_on(listener)
+            .await
+            .map_err(|err| anyhow!(err.to_string()))?;
     }
-    sock_ready_tx.send(()).ok();
-    ignite
-        .launch_on(listener)
-        .await
-        .map_err(|err| anyhow!(err.to_string()))?;
     Ok(())
 }
 
 async fn run_internal(
     state: AppState,
     figment: Figment,
+    activated_socket: Option<StdUnixListener>,
     sock_ready_tx: oneshot::Sender<()>,
 ) -> Result<()> {
     let rocket = rocket::custom(figment)
@@ -93,20 +158,29 @@ async fn run_internal(
         .ignite()
         .await
         .map_err(|err| anyhow!("Failed to ignite rocket: {err}"))?;
-    let endpoint = DefaultListener::bind_endpoint(&ignite)
-        .map_err(|err| anyhow!("Failed to get endpoint: {err}"))?;
-    let listener = DefaultListener::bind(&ignite)
-        .await
-        .map_err(|err| anyhow!("Failed to bind on {endpoint}: {err}"))?;
-    if let Some(path) = endpoint.unix() {
-        // Allow any user to connect to the socket
-        fs_err::set_permissions(path, Permissions::from_mode(0o777))?;
+
+    if let Some(std_listener) = activated_socket {
+        // Use systemd-activated socket
+        info!("Using systemd-activated socket for dstack.sock");
+        let listener = ActivatedUnixListener::new(std_listener)?;
+        sock_ready_tx.send(()).ok();
+        ignite
+            .launch_on(listener)
+            .await
+            .map_err(|err: rocket::Error| anyhow!(err.to_string()))?;
+    } else {
+        // Fall back to binding our own socket
+        let endpoint = DefaultListener::bind_endpoint(&ignite)
+            .map_err(|err| anyhow!("Failed to get endpoint: {err}"))?;
+        let listener = DefaultListener::bind(&ignite)
+            .await
+            .map_err(|err| anyhow!("Failed to bind on {endpoint}: {err}"))?;
+        sock_ready_tx.send(()).ok();
+        ignite
+            .launch_on(listener)
+            .await
+            .map_err(|err| anyhow!(err.to_string()))?;
     }
-    sock_ready_tx.send(()).ok();
-    ignite
-        .launch_on(listener)
-        .await
-        .map_err(|err| anyhow!(err.to_string()))?;
     Ok(())
 }
 
@@ -219,11 +293,18 @@ async fn main() -> Result<()> {
         .extract()
         .context("Failed to extract bind address")?;
     let guest_api_figment = figment.select("guest-api");
+
+    // Get systemd-activated sockets if available
+    let activated = ActivatedSockets::from_env();
+    if activated.dstack.is_some() || activated.tappd.is_some() {
+        info!("Systemd socket activation detected");
+    }
+
     let (tappd_ready_tx, tappd_ready_rx) = oneshot::channel();
     let (sock_ready_tx, sock_ready_rx) = oneshot::channel();
     tokio::select!(
-        res = run_internal_v0(state.clone(), internal_v0_figment, tappd_ready_tx) => res?,
-        res = run_internal(state.clone(), internal_figment, sock_ready_tx) => res?,
+        res = run_internal_v0(state.clone(), internal_v0_figment, activated.tappd, tappd_ready_tx) => res?,
+        res = run_internal(state.clone(), internal_figment, activated.dstack, sock_ready_tx) => res?,
         res = run_external(state.clone(), external_figment) => res?,
         res = run_guest_api(state.clone(), guest_api_figment) => res?,
         _ = async {