Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to have a flexible setup (will need to run Redis, Celery, and uWSGI), but I'm wondering whether or not it's a bad idea to run Supervisor as root (the default), and if so, why it is bad.

share|improve this question

closed as not a real question by Michael Hampton, mdpc, Ward, Scott Pack, Brent Pabst Dec 10 '12 at 13:03

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

Supervisor is happy to run as root and change the user of the processes you run for you. However, supervisor may open network ports for HTTP and XML-RPC connections if you configure it to do so. Having those open makes supervisor theoretically more vulnerable to running as root than e.g. daemontools.

When deploying services (e.g. for a specific project, let's call it 'fancysite') I create a user corresponding to that service ('fancysite') which in turn runs supervisor and also all the specific daemons that make up 'fancysite' but aren't run with the regular init scripts from the system. E.g. I usually run nginx, PostgreSQL and others on system level with whatever the distribution provides and then install things that aren't supported by the distribution into the 'fancysite' user and start and manage them through supervisor.

share|improve this answer
Thanks Theuni - I'm confused about the last part of your sentence ... for a service combining all of its daemons.. Would you mind explaining what you mean? My prior assumption is that I should run Supervisor as www-data. – orokusaki Dec 6 '12 at 21:23
I hope my last edit cleared it up. :) – Theuni Dec 6 '12 at 21:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.