Message-ID: <d8868273-9797-ea1f-4a2d-ddfe1ce43ffc@iki.fi>
Date: Tue, 6 Jun 2023 19:24:11 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: Let's make PostgreSQL multi-threaded
Content-Language: en-US
To: chap@anastigmatix.net, Konstantin Knizhnik <knizhnik@garret.ru>
Cc: pgsql-hackers@lists.postgresql.org
References: <31cc6df9-53fe-3cd9-af5b-ac0d801163f4@iki.fi>
 <4178104.1685978307@sss.pgh.pa.us>
 <CADUqk8UyyiLsVSFB+6LYwvRos123-333YT5d3eZ-eUBvXVyDBQ@mail.gmail.com>
 <4658520e-5cd0-6242-e54c-c3af0a85890a@garret.ru>
 <6c99fe026eea03fd8aac91aac7143301@anastigmatix.net>
From: Heikki Linnakangas <hlinnaka@iki.fi>
In-Reply-To: <6c99fe026eea03fd8aac91aac7143301@anastigmatix.net>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/d8868273-9797-ea1f-4a2d-ddfe1ce43ffc%40iki.fi>
Precedence: bulk

On 06/06/2023 11:48, chap@anastigmatix.net wrote:
> And the devs of Java, in their immeasurable wisdom, have announced
> a "JDK Enhancement Proposal" (that's just what these things are
> called, don't blame Orwell), JEP 411[2][3], in which all of the
> Security Manager features that PL/Java relies on for bounds on
> 'trusted' behavior are deprecated for eventual removal with no
> functional replacement. I'd be even more leery of using one big
> shared JVM for everybody's work after that happens.

Ouch.

> Might the work toward allowing a run-time choice between a
> process or threaded model also make possible some
> intermediate models as well? A backend process for
> connections to a particular database, or with particular
> authentication credentials? Go through the authentication
> handshake and then sendfd the connected socket to the
> appropriate process. (Has every supported platform got
> something like sendfd?)

I'm afraid having multiple processes and JVMs doesn't help that. If you 
can escape the one JVM in one backend process, it's game over. Backend 
processes are not a security barrier, and you have the same problems 
with the current multi-process architecture, too.

https://github.com/greenplum-db/plcontainer is one approach. It launches 
a separate process for the PL, separate from the backend process, and 
sandboxes that.

-- 
Heikki Linnakangas
Neon (https://neon.tech)