3 ms·

I don’t trust them enough to run as root.

• udev4096 1y ago
  But you have to. Nginx, caddy, traefik, etc cannot run without root or even if you can, it would be way more limiting
  • QuantumNomad_ 1y ago
    Only for binding to ports under 1024 really, like 80 (http) and 443 (https). Once it has bound to the ports it can drop down to running as a low-privilege user (usually named www or httpd or similar). On Linux you can allow your program to bind to those ports even without running the program itself as root. https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 https://superuser.com/questions/710253/allow-non-root-proces...
    • dorianniemiec 1y ago
      When installed for example with the installer script, Ferron would run on a specialized user for running the web server. Ferron itself would also have "CAP_NET_BIND_SERVICE" capability set on its binary, so that it doesn't have to run as root.
  • adastra22 1y ago
    1) That isn’t true. 2) Even if it were, I’m not going to do so while evaluating an unknown program.
• deleted 1y ago
  [deleted]