Co-bundling Jetty ?

[Cantor, Scott]

On 9/12/13 9:25 AM, "Marvin S. Addison" <marvin.addison at gmail.com> wrote:
>
>Can you say a bit more about why you think setuid is mandatory? That
>doesn't follow from anything in the discussion that I can tell. The
>desire for privileged ports comes to mind as a reason to setuid root,
>but most Java webapp deployments I'm familiar with don't do that for
>security reasons.

If you don't trust it as a web server, then that means you're running
Apache or something else in front of it, or using firewall tricks or a
load balancer to forward traffic, either of which (to me) defeats the
primary purpose of bundling.

The people who will benefit most from bundling are the same people who
won't know how to work around it running on port 8080 and will almost
never be load balancing it. The support burden of it not being a plug and
play package would be very large and be entirely about Jetty support,
which is not a burden I'm prepared to take on. It's hard to see how we
could avoid that support role if we're shipping the container ourselves.

-- Scott