run root-less?

[miekg]

Can we run as non-root? Potentially letting systemd doing all the heavy lifting?

Of course being able to send arbitrary unit to systemd is indistinguishable from actually being root... But it might benefit some use cases.

It could very much turn out this is not possbile.

[miekg]

Chowning a file/directory in Linux needs the CAP_CHOWN capability, so not full root.

I still believe creating system units requires root, but what about user units? If that can be done then we would need a few code changes and only the CAP_CHOWN capability (provided we can create the directories)

Oh user services, require a user to login into the system, https://superuser.com/questions/853717/what-is-the-difference-between-systemds-user-and-system-services
(trying to dig up some more official docs)

[miekg]

Potentially we can run a user systemd regardless - would slightly be more involved, but not rocket science. This would imply we would run all pods using the same user - the user for which we started the systemd user process (i.e. systemk user). Then we're left with only the CAP_CHOWN capability.

Note this also means you can't bind to a low port, etc. etc. So you may not want to this a default, but it would be good to understand that this is very much a possibly in more constrained environments.

[miekg]

hmm, it looks like its just: su $USER systemd --user and changing systemk's init (or whatever) to use the user version (this is a boolean on the API, right now it just defaults to 'use the system one').
This can be a PreExecStart in the service.file that starts systemk, like here: https://github.com/miekg/debian/blob/master/systemk/debian/systemk.service
Together with the CAP_CHOWN and systemk's -d flag... that should be it

[miekg]

See #64 for how this would look, still requires capabilities, but those are dealt with outside of this code base (although we can provide an example unit file)

[miekg]

see #86 it cannot be done.

[erwbgy]

If the issue is with BindPaths not working, do any of the parameters mentioned in "Automatic creation of directories for a service" at https://www.redhat.com/sysadmin/systemd-secure-services help?

[miekg]

cc @nicollet

[miekg]

@erwbgy sadly no, not for this use case. Note that the example in that section also uses sudo