How to use an Elixir release without epmd

Mix release supports the environment variable RELEASE_DISTRIBUTION=none so using that when generating the release should disable distribution features. I don’t know if it avoids starting epmd but at least you shouldn’t be able to connect to the release.

I’m not a 100 % sure on these details so test before going into prod. Hoping someone wiser can chime in too.

Source: mix release — Mix v1.20.2

@Nicd just to be clear: This also means that it is entirely impossible to connect to the running system, right? So no introspection of the running system, even when connected directly to the machine the node runs on?

I think so, because AFAIK that connecting like remsh uses the distribution system. But you should try it and report.

As soon as I have time on my hands again thanks for clarifying

The article is a bit old but perhaps still valid?

Look into blocking the EPMD port at the interface (with iptables or equivalent new hotness); that way you can still SSH into the box and attach an IEx session like usual.

First, you can have epmd and the node itself bind to 127.0.0.1 so it is inaccessible outside of the host.

Next, there is GitHub - tsloughter/epmdless: Distributed Erlang without the EPMD · GitHub which can be used to simplify running a node that you can get a remote connection to still locally but does not have epmd running.

Finally, OTP 23.1 will make this even simpler, removing the need for epmdless entirely in the case that you are fine with a static port being used for the Erlang node.

This looks great. Thanks for sharing!

And also thanks to all the others for chiming in. I’m planning on trying all solutions suggested here and to report back when that happened. Thanks for all the contributions!

Ah @al2o3cr think this is a misunderstanding: The release is running on a host where multiple users can connect to via ssh. iptables would not help me in the scenario, if I’m not mistaken, since everyone who can ssh into that server would be able to circumvent the firewall.

1. RELEASE_MODE=none still starts epmd, unfortunately.
2. As stated before, iptables won’t help due to the shared hosting environment.
3. While epmdless is indeed working as advertised it has the same problem as 2. Other users could still connect to the running application just by inspecting the started process and reading the cookie from there (at least that’s my understanding)

@tristan is my understanding of epmdless correct here, or am I still missing something?

Thanks!

If a moderator strolls by: could you please fix the topic of this post to contain epmd instead of emdp?