run root-less? about systemk HOT 8 CLOSED

Chowning a file/directory in Linux needs the CAP_CHOWN capability, so not full root.

I still believe creating system units requires root, but what about user units? If that can be done then we would need a few code changes and only the CAP_CHOWN capability (provided we can create the directories)

Oh user services, require a user to login into the system, https://superuser.com/questions/853717/what-is-the-difference-between-systemds-user-and-system-services
(trying to dig up some more official docs)

from systemk.

Potentially we can run a user systemd regardless - would slightly be more involved, but not rocket science. This would imply we would run all pods using the same user - the user for which we started the systemd user process (i.e. systemk user). Then we're left with only the CAP_CHOWN capability.

Note this also means you can't bind to a low port, etc. etc. So you may not want to this a default, but it would be good to understand that this is very much a possibly in more constrained environments.

from systemk.

hmm, it looks like its just: su $USER systemd --user and changing systemk's init (or whatever) to use the user version (this is a boolean on the API, right now it just defaults to 'use the system one').
This can be a PreExecStart in the service.file that starts systemk, like here: https://github.com/miekg/debian/blob/master/systemk/debian/systemk.service
Together with the CAP_CHOWN and systemk's -d flag... that should be it

from systemk.

See #64 for how this would look, still requires capabilities, but those are dealt with outside of this code base (although we can provide an example unit file)

from systemk.

see #86 it cannot be done.

from systemk.

If the issue is with BindPaths not working, do any of the parameters mentioned in "Automatic creation of directories for a service" at https://www.redhat.com/sysadmin/systemd-secure-services help?

from systemk.

cc @nicollet

from systemk.

@erwbgy sadly no, not for this use case. Note that the example in that section also uses sudo

from systemk.