Enable debugpy to work with domain sockets

[tinglongliao-db]

If I understand correctly, the current version of debugpy only supports listening on network sockets. However, due to security limitations in our use case, we are unable to use network sockets. Could you add support for communication with debugpy via Unix domain sockets, or is this feature already available?

[karthiknadig]

This is not available yet. I agree with adding another option for communication.

But my recommendation would be to use NamedPipes on windows, and fifo on linux/mac. Not UDS. UDS is not supported on WSL2, only in WSL1. So it blocks us from using it on WSL. Firewall can block UDS as well. So, I recommend fifo.

[holmanb]

If I understand correctly, the current version of debugpy only supports listening on network sockets. However, due to security limitations in our use case, we are unable to use network sockets. Could you add support for communication with debugpy via Unix domain sockets, or is this feature already available?

This would be useful for me as well. My use case is for debugging Python code in container and virtual machine environments that lack network access. My container use cases could be satisfied by either fifo or Unix domain sockets mounted into the container from the host, but for virtual machines I think that vsock is probably required (which should work for Windows and Linux).

Perhaps we could just implement multiple protocols to support all of the above listed use cases and then allow the user to specify a URI that tells debugpy which protocol to use:

--listen unix://path/to/sock
--listen vsock://<cid>:<port>
--listen file://path/to/named_pipe_or_fifo  # debugpy could identify which platform it is on to discern whether to use named pipe or fifo

[giuliano-97]

@judej
hi, is there any update or roadmap on this?

[rchiodo]

Sorry, this isn't currently planned. We'd accept pull requests though. I think the proposal by @holmanb is a good one.

[rameshvarun]

I have a POC of this working. My intended use case was a docker compose stack of many containers, each of which I'd like to be individually attachable. Though after implementing this, I wonder if it's easier to just assign a bunch of ports and deal with the conflicts with other services. I'll try to make an MR from what I implemented.