Skip to content

Understand and document why devfile ffi gem does not work in gitlab monolith

From #392492 (comment 1288375977)

For some reason, running the Gem (which was implemented as FFI) outside of gitlab monolith(running ruby directly). But running it from inside gitlab monolith just times out. What is even more interesting/mysterious is that the function call works corrects(throws an error correctly) if we send in an invalid devfile. We think the devfile library must be doing some call(probably HTTP?) which are somehow restricted when called from gitlab monolith through FFI.

We converted the gem to build a go binary instead and we are able to successfully call the functions from gitlab monolith.

If this is the case, then we should understand and document exactly what external network calls the library is making, and why.

This will be important for people running their own gitlab instances, where network administrators concerned about security may want to lock down and control all external network calls which are made from the gitlab monolith.

Also, in the test environment, I believe we block all DNS/network access that is not explicitly allow-listed, so if this gem does do network access, any tests (e.g. E2E/request/integration) using this gem will possibly need to consider adding configuration to account for this.

See: https://docs.gitlab.com/ee/development/testing_guide/best_practices.html#dns and the associated MR for pointers to the relevant code.

Edited by Vishal Tak