3 ms·
> In order to provide isolation, I run each service as its own unix user account. systemd's DynamicUser feature could save some time here. It can allocate a ui
by matthews2 3y ago
> In order to provide isolation, I run each service as its own unix user account.
systemd's DynamicUser feature could save some time here. It can allocate a uid, then create directories for logs/state with the correct permissions.
https://0pointer.net/blog/dynamic-users-with-systemd.html https://0pointer.net/blog/dynamic-users-with-systemd.html
- cardamomo 3y agoThanks for sharing this! My server setup is similar to the one described in this article, minus isolating apps with separate users. I'll give dynamic users a go next time I tweak the setup.
- CHSbeachbum420 3y agoPretty standard to use separate service principals for each service/app. Should also use separate servers
- riskable 3y ago> service principals Kerberos much? =)
- chlorion 3y agoIt's really easy to create new "system" users with systemd-sysusers too, if you need the uid to be persistent! You just drop a small text file (often a single line) into /etc/sysusers.d/ with the information about the user, like username, home directory and whatever, and then invoke the sysusers command or service!