INFRA Signal 405
Systemd Dynamic Users (2020)
↗
Illustration only Photo by Alex Kotliarskyi on Unsplash
systemd can create temporary, runtime-only users for units, removing the need for permanent entries in /etc/passwd.
Service packages no longer have to ship or manage dedicated system users, which reduces install-time complexity and cleanup work. Persistent data can be kept in automatically owned StateDirectory locations, keeping permissions correct across restarts. Running ad-hoc commands with systemd-run also benefits from the same isolation, though it still requires root or an authenticated session.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
DynamicUser=yes causes systemd to generate a user that lives only while the unit is active and never appears in /etc/passwd.
StateDirectory and RuntimeDirectory properties give the dynamic user writable storage that survives the unit’s lifetime and is re-owned on the next start.
Using systemd-run with DynamicUser requires root or an authenticated connection to systemd, and the approach only works on hosts that use systemd.
THE CLUSTER