I have a Django application "djngxgun" that uses Nginx and Gunicorn. I just installed Supervisor so that I can use it to manage my Gunicorn processes. The problem is that Supervisor isn't starting Gunicorn after I reboot the server. When I start Gunicorn via Supervisor ("sudo supervisorctl start djngxgun"), I see the following error repeated in my Gunicorn error.log file:

2014-02-28 15:36:47 [4753] [INFO] Starting gunicorn 18.0
Traceback (most recent call last):
  File "/home/djngxgun/venv/djngxgun/bin/gunicorn", line 9, in <module>
    load_entry_point('gunicorn==18.0', 'console_scripts', 'gunicorn')()
  File "/home/djngxgun/venv/djngxgun/local/lib/python2.7/site-packages/gunicorn/app/wsgiapp.py", line 71, in run
    WSGIApplication("%(prog)s [OPTIONS] [APP_MODULE]").run()
  File "/home/djngxgun/venv/djngxgun/local/lib/python2.7/site-packages/gunicorn/app/base.py", line 143, in run
  File "/home/djngxgun/venv/djngxgun/local/lib/python2.7/site-packages/gunicorn/arbiter.py", line 172, in run
  File "/home/djngxgun/venv/djngxgun/local/lib/python2.7/site-packages/gunicorn/arbiter.py", line 124, in start
  File "/home/djngxgun/venv/djngxgun/local/lib/python2.7/site-packages/gunicorn/pidfile.py", line 38, in create
    fd, fname = tempfile.mkstemp(dir=fdir)
  File "/usr/lib/python2.7/tempfile.py", line 300, in mkstemp
    return _mkstemp_inner(dir, prefix, suffix, flags)
  File "/usr/lib/python2.7/tempfile.py", line 235, in _mkstemp_inner
    fd = _os.open(file, flags, 0600)
OSError: [Errno 13] Permission denied: '/var/run/tmpcda84p'

It looks like the problem is that the djngxgun account needs to create a temporary file in /var/run but that directory's permissions are preventing it:

drwxr-xr-x 14 root root 640 Feb 28 15:36 /run

If I manually change /run (/var/run is a symlink to /run) so that it's group owner is "adm" and it's group-writable and djngxgun is added to the adm group like this,

drwxrwxr-x 14 root adm 640 Feb 28 15:36 /run

... I can start Gunicorn via Supervisor without any problem. However, if I reboot my server, the group ownership and permissions revert back to the original settings which causes the error to reoccur. As you would expect, if I just run the startup script by hand ("sudo /www/djngxgun/bin/start-gunicorn &"), Gunicorn starts without any problem.

Am I configuring Gunicorn and/or Supervisor incorrectly? I don't see how I can get around needing to write to /var/run if I use Supervisor but I can't if it's owned by root. I don't think I want to be running my application via the root user. I didn't see any Gunicorn or Supervisor settings that would resolve this issue. Is there another way to do this?


This is my Gunicorn startup script:


source `which virtualenvwrapper.sh`
workon $NAME

echo "Starting $NAME as `whoami`"
exec gunicorn $DJANGO_WSGI_MODULE:application \
  --name $NAME \
  --workers $NUM_WORKERS \
  --user=$USER \
  --group=$GROUP \
  --bind= \
  --pid /var/run/gunicorn.pid \
  --access-logfile /var/log/gunicorn/access.log \
  --error-logfile /var/log/gunicorn/error.log \

This is my Supervisor config file "/etc/supervisor/conf.d/djngxgun.conf"

command = /www/djngxgun/bin/start-gunicorn
stdout_logfile = /var/log/gunicorn/supervisor.log
redirect_stderr = true

You shouldn't be running your gunicorn server as root, just think if someone found an exploit in your code can do anything to the server.

Put the pidfile in /tmp or /var/tmp and run as a non privileged user.


I figured it out. The solution is to set "user = root" in the project's Supervisor configuration file. The documentation says, "If supervisord runs as root, this UNIX user account will be used as the account which runs the program." Thus, setting user this way is equivalent to my running the script manually using "sudo."

  • 2
    I can not downvote, but you should NOT use user=root if you care about security. – Herbert May 10 '18 at 18:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.