I want to have a flexible setup (will need to run Redis, Celery, and uWSGI), but I'm wondering whether or not it's a bad idea to run Supervisor as root (the default), and if so, why it is bad.
Tell me more
×
Server Fault is a question and answer site for
professional system and network administrators. It's 100% free, no registration required.
|
|
|||
|
|
closed as not a real question by Michael Hampton, mdpc, Ward, Scott Pack, Brent Pabst Dec 10 '12 at 13:03
It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, see the FAQ.
|
Supervisor is happy to run as root and change the user of the processes you run for you. However, supervisor may open network ports for HTTP and XML-RPC connections if you configure it to do so. Having those open makes supervisor theoretically more vulnerable to running as root than e.g. daemontools. When deploying services (e.g. for a specific project, let's call it 'fancysite') I create a user corresponding to that service ('fancysite') which in turn runs supervisor and also all the specific daemons that make up 'fancysite' but aren't run with the regular init scripts from the system. E.g. I usually run nginx, PostgreSQL and others on system level with whatever the distribution provides and then install things that aren't supported by the distribution into the 'fancysite' user and start and manage them through supervisor. |
|||||
|
