Question
How do I run an arbitrary service as an arbitrary user at boot with a logind session (specifically including all of the goodies under /run/user/uid
) created for this user and without having to explicitly log in as this user?
Background
I am in the process of converting a docker-compose deployment for use with rootless podman + systemd services. I have figured out most of the podman stuff but am specifically struggling with getting it to run via systemd.
In my previous deployment I had created a user account for each service and configured the containers to run as this user. This was very handy from a filesystem control and maintenance standpoint and is really the primary property I wish to preserve.
To that end, I found this askubuntu question which gets me the ability to embed the user directly into my systemd job and have it execute as said user. Perfect.
Now comes the wrench: Fedora moved to cgroups v2 which is now handled by systemd and is, in fact, the reason for this effort in the first place. As a result, podman requires the ability to talk to systemd which, in turn, basically requires the login session set up by logind (if I am understanding this link correctly). I am no systemd expert so please correct me on any of this.
I did find another question about waiting for a user session which comes close to what I am after but seems to indicate this isn't possible. My case is different in two primary respects:
- I do not want to wait for any session (eg. this should run on boot with no interaction).
- My solution needs to be robust enough to suffer manual intervention bringing the service up and down.
So, as stated above, I am really looking for any way to get a systemd service to run as a particular user with enough of a login environment for the service application to connect to systemd (or, at least, the cgroups v2 portion of it).
Finally, below is a sample systemd unit file for one of the services which works as expected until it needs to connect to systemd. Additionally, the podman invocation works completely when executed manually as my logged in user.
[Unit]
Description=Emby Podman Container
[Service]
User=emby
Group=emby
Restart=on-failure
ExecStartPre=/usr/bin/rm -f /%t/%n-pid /home/emby/%n-cid
ExecStart=/usr/bin/podman run --conmon-pidfile /%t/%n-pid --cidfile /home/emby/%n-cid -d --name=emby --cgroup-manager=systemd -e TZ="$TZ" -p 8096:8096 -p 8920:8920 -v /opt/docker/storage/emby:/config -v /media/media/:/media emby/embyserver
ExecStop=/usr/bin/sh -c "/usr/bin/podman rm -f `cat /home/emby/%n-cid`"
KillMode=none
Type=forking
PIDFile=/%t/%n-pid
[Install]
WantedBy=multi-user.target