Notices by Petr Menšík :fedora: (pemensik@fosstodon.org)

@dalias @leftpaddotpy I am not sure, why would you want to lock a process into separate namespace with a VPN. In most cases I *want* site-enabling VPN to modify *global* system configuration. I just want to choose which parts this VPN can provide, for example limiting it to only selected domains. It would be nice to have simpler ways to bind a service to just one network interface, but I don't need it often.

@dalias @leftpaddotpy that depends. If systemd is preventing some features like dnssec or single label queries, then I want working resolvers instead. Statically configured servers won't know site-specific domains. Sure, you want to override DNS servers network has provided *sometime*. But you would want privacy VPN on such networks anyway, if you need to use that network at all. I get broken experience even on trusted networks with resolved.

@leftpaddotpy @dalias oh, systemd-resolved handling of /etc/resolv.conf is great example how to do it wrong way. Yes, there was maybe resolvconf only, hackish command. But because no other service claimed to be best #DNS cache everyone should use. I am quite confident resolved is broken. It supports only itself, unlike other solutions. Okay, it has decent dbus API. But also unfixed issues. Systemd has excellent integration skills, but fails to export it for use by 3rd party services.