sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

trim: drop nss-mdns (+ orphaned avahi) — media-independent mDNS resolver

Browse Source 
Investigating avahi/samba/rabbitmq in the image: ldd on libavformat.so confirms
samba (libsmbclient), librabbitmq, librist, libsrt and libzmq are all DT_NEEDED
by FFmpeg's libavformat-free — removing any breaks libavformat and thus future
HTML5 media in the kiosk, so they stay. avahi is the exception: it's absent from
libavformat's links and 'rpm -e --test avahi' shows its only reverse-dep is
nss-mdns (the mDNS/.local NSS resolver).

The fleet resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead
weight and a network-listening service unwanted on a locked-down kiosk. Remove
nss-mdns; dnf's clean_requirements_on_remove reaps avahi/avahi-glib/avahi-libs as
orphans. Belt-and-braces alongside install_weak_deps=False (which already drops
nss-mdns if it came in as a Recommends).
This commit is contained in:
Audiobuzz
2026-07-03 05:55:00 +00:00
parent f59eb7942a
commit 5cc72ccac3
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
diskless.pkr.hcl
+11
View File
@@ -941,6 +941,17 @@ build {
# hard-needs it) and mask as a backstop against future weak-dep reinstalls. # hard-needs it) and mask as a backstop against future weak-dep reinstalls.
"dnf remove -y firewalld 2>/dev/null || true", "dnf remove -y firewalld 2>/dev/null || true",
"systemctl mask firewalld.service 2>/dev/null || true", "systemctl mask firewalld.service 2>/dev/null || true",
# nss-mdns: the mDNS/.local NSS resolver, and the ONLY reverse-dep of avahi
# (confirmed 2026-07-03: `rpm -e --test avahi` → "avahi is needed by nss-mdns",
# and avahi is absent from `ldd libavformat` so it's unrelated to Chromium's
# media stack — unlike samba/librabbitmq/librist/libsrt/libzmq, which ARE
# libavformat DT_NEEDED and must stay for future HTML5 media). This fleet
# resolves via DHCP/DNS (boot.fleet.lab), never .local, so mDNS is dead weight
# AND a network-listening service unwanted on a locked-down kiosk. Removing
# nss-mdns lets dnf's clean_requirements_on_remove reap avahi/avahi-glib/
# avahi-libs as orphans. (install_weak_deps=False may already drop nss-mdns if
# it's a Recommends; this is the belt-and-braces for the hard-dep case.)
"dnf remove -y nss-mdns 2>/dev/null || true",
# (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF # (No Go toolchain to remove — fleet-hostapi + fleet-enrol are built OUT OF
# the VM on the CI runner and file-provisioned in as static binaries.) # the VM on the CI runner and file-provisioned in as static binaries.)
# The build-time STIG reports must not ship inside the read-only rootfs. # The build-time STIG reports must not ship inside the read-only rootfs.