this post was submitted on 15 Jul 2025
34 points (94.7% liked)

Selfhosted

50252 readers
917 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
CannaVet@lemmy.world
Loki@lemmy.world
HybridSarcasm@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
34
Dedicated service user or not ? (jlai.lu)
submitted 3 weeks ago by mat@jlai.lu to c/selfhosted@lemmy.world
18 comments fedilink hide all child comments
 

Hi all !

As of today, I am running my services with rootless podman pods and containers. Each functional stack gets its dedicated user (user cloud runs a pod with nextcloud-fpm, nginx, postgresql...) with user mapping. Now, my thought were that if an attack can escape a container, it should be contained to a specific user.

Is it really meaningful ? With service users' home setup in /var/lib, it makes a lot of small stuff annoying and I wonder if the current setup is really worth it ?

you are viewing a single comment's thread
view the rest of the comments
[–] johntash@eviltoast.org 7 points 3 weeks ago (2 children)

What kind of annoying things are you dealing with?

You don't have to put the user home in /var/lib either if that helps at all.

If you're already running rootless, I'd keep doing that unless there's a really good reason not to.

[–] mat@jlai.lu 2 points 3 weeks ago (1 children)

What kind of annoying things are you dealing with?

Troubleshooting with a machinectl session, switching between services, backing up... It is small annoyances but if I can avoid them i'd like it.

You don't have to put the user home in /var/lib either if that helps at all.

I half regret doing it.

If you're already running rootless, I'd keep doing that unless there's a really good reason not to.

The plan is about switching to a single user, I will stick to rootless podman this is for sure. It is more about dedicated users or a single one.

[–] qqq@lemmy.world 2 points 3 weeks ago

I don't want to tell you one way or the other because it's kinda dubious anyway, but if all services run as the same user the need for root is kinda moot when it comes to crossing between services or expanding the scope of an attack. Of course it is better than all things running as root, but if I popped a machine as some "low privilege" user that still had access to all running services I'm not sure I'd care so much about escalating to root.

[–] sugar_in_your_tea@sh.itjust.works 1 points 3 weeks ago

You shouldn't have any user home for your services, you shouldn't even allow them to login at all. They should only have group access to resources they need, and containers should restrict what directories they have access to.