Clarify the correct use of unsafe about foundationdb-rs

[harrisonturton]

I dig some more digging, and found some more information:

Due to limitations in the C API, the Client and it's associated Network can only be initialized and run once per the life of a process. Generally the foundationdb::init function will be enough to initialize the Client. See foundationdb::default_api and foundationdb::builder for more configuration options of the Fdb Client.

From here.

Is this why we must drop it explicitly? Something to do with "it's associated Network can only be initialised and run once per the life of a process."

[PierreZ]

👋

I love that this crate exists. Thanks for all your hard work heart

First of all, thank you for the kind words ❤️

Which leaves me with two questions:

1. Doesn't Rust call `drop` automatically when `network` goes out of scope - why must I call it manually?

2. What happens if my code panics before calling `drop`?

I think @Speedy37 will have a far better answer than me, as we worked heavily on making boot safe (5d4954a, 8725b6e, 7b5d67e, c53f7f6) but had to revert in the end.

If you could help me understand this better, I'm happy to raise a PR updating the documentation with a deeper description of the motivations and usage recommendations.

That would be awesome to clarify that indeed.

[Speedy37]

I tried multiple times to make boot safe but always found a way to break it.

Trying to boot multiples times is already checked and would result in a panic (no undefined behavior here).
The unsafe part is due to undefined behavior occurring if fdb_stop_network() is not called before main exits

You must call this function and wait for fdb_run_network() to return before allowing your program to exit, or else the behavior is undefined.

See Clikengo/foundationdb-rs#202 for details

ie.

• forget(network)
• process::exit triggered by another thread
• ...