[confignet] Add Unix domain socket lifecycle management to AddrConfig

[jakubsomonday]

Component(s)

config/confignet

Is your feature request related to a problem? Please describe.

When using Unix domain sockets with the Collector (via confignet.AddrConfig.Listen()), operators face three recurring pain points:

1. Stale socket files block restarts. If a Collector process is killed ungracefully (OOM, SIGKILL, node eviction), the socket file remains on the filesystem. The next process fails to bind with "address already in use." This is especially common in Kubernetes DaemonSet deployments with host-mounted volumes (see #14274, which was filed against contrib but describes the same root cause).
2. Socket file permissions are not configurable. Socket files inherit the process umask, which is often too restrictive for multi-service setups. Operators must use external tooling (systemd ExecStartPost, init scripts) to chmod the socket after the Collector starts.
3. Socket files are not cleaned up on close. When Listen() returns a net.Listener for a Unix socket, calling Close() does not remove the socket file, leaving stale files behind for the next restart.

Describe the solution you'd like

Add two new fields to confignet.AddrConfig and enhance Listen():

• socket_permissions (os.FileMode) — File mode applied to the socket file after binding. Only valid for Unix transports. When zero (default), inherits the process umask.
• socket_clean_on_start (bool) — Remove a pre-existing socket file before binding. Only applies to filesystem-based Unix sockets (not abstract sockets with @ prefix). Default: false.

Listen() would also wrap the returned listener so that Close() removes the socket file automatically.

Describe alternatives you've considered

• External wrapper scripts (e.g., ExecStartPre=rm -f /path/to/socket) — Works but pushes responsibility outside the Collector and is error-prone.
• Handling this in confighttp/configgrpc — These layers now delegate to confignet.AddrConfig.Listen() (since #14248), so solving it in confignet benefits all consumers automatically.

Additional context

No response

Tip

_{React with 👍 to help prioritize this issue. Please use comments to provide useful context, avoiding +1 or me too, to help us triage it. Learn more here.}

[dmathieu]

Those two options sound weird.

I think it would be nice to look into what other projects do, as this is hardly a problem we're the first ones to face.

Kubernetes seems to remove all sockets at start, no specific option required.
https://github.com/kubernetes/kubernetes/blob/master/pkg/kubelet/cm/devicemanager/manager.go#L192
Which would point to the question of whether we need additional options at all. Couldn't we delete the socket as boot if they exist?

[jakubsomonday]

Hey @dmathieu - for deleting socket, I don't have strong preference, we can make it unconditional.

File permissions on the other hand are crucial for me, I'm using it in my daemonset layer and I need to open them for writing from other pods

[dmathieu]

Again, AFAIK, no other daemon project does this. How come the collector is different? Do you have example showing how other projects handle file permissions?

[jakubsomonday]

https://github.com/DataDog/datadog-agent/blob/main/pkg/trace/api/loader/listeners.go#L35
https://github.com/DataDog/datadog-agent/blob/main/comp/dogstatsd/listeners/uds_common.go#L132

As I'm replacing datadog-agent, they're the easiest to take inspiration - they also do not expose config, just set it to 0722 (write-only) in case of traces or statsd.
If we hardcode 0722, then we can make it configless - the receiver is expected to get written to from outside. From my side adding config was more of "defensive" approach

[axw]

Stale socket files block restarts. If a Collector process is killed ungracefully (OOM, SIGKILL, node eviction), the socket file remains on the filesystem. The next process fails to bind with "address already in use." This is especially common in Kubernetes DaemonSet deployments with host-mounted volumes (see #14274, which was filed against contrib but describes the same root cause).

Regarding removing sockets: maybe abstract sockets would be a suitable solution? They are automatically removed when all open referenced are closed, which includes process exit. You can create abstract sockets by putting "@" at the beginning of the path.

Regarding permissions: there seems to be some overlap here with #15212, which is the Windows equivalent.

[swiatekm]

It's worth noting that hardcoding the permissions and removing the files on startup makes existing socket management techniques impossible. If a user solves this problem by preparing the socket file with the right permissions, then this change would make it impossible for them to continue doing that. As such, I think some amount of configurability is unavoidable here. It's valid to want your sockets to not be world-writable - we don't just expose receiver listeners on these, but also extensions with potentially sensitive information exposed.