I am trying to run Node.js as an unprivileged user (
dmitry in this case). Hoping someone can confirm or, as necessary, please elaborate upon what I'm seeing below.:
Using Ubuntu 12.04 and upstart, I wrote a job script that calls the following:
exec sudo -u dmitry /usr/bin/node /home/dmitry/node/linkskeeper/app.js >> /var/log/linkskeeper.sys.log 2>&1
This statement lives in a file called
/etc/init/linkskeeper.conf and I invoke
$ sudo service linkskeeper start
When I examine the processes that this spawns, I see:
$ ps aux | grep node root 28349 0.0 0.2 40908 1672 ? Ss 16:51 0:00 sudo -u dmitry /usr/bin/node /home/dmitry/node/linkskeeper/app.js dmitry 28350 2.1 2.1 641784 13268 ? Sl 16:51 0:00 /usr/bin/node /home/dmitry/node/linkskeeper/app.js
It appears that the initial
exec call spawns pid
28349 as root, which in turn spawns
28350 with the unprivileged account. If this is the correct narrative, it makes sense to me. Interestingly, reference  below says this should not work on EC2, but it seems to work just fine.
Then I adjust the
exec command to:
exec su - dmitry -c '/usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log'
I get the following:
$ ps aux | grep node dmitry 28371 0.0 0.2 37952 1312 ? Ss 16:57 0:00 su - dmitry -c /usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log dmitry 28372 0.0 0.2 19516 1712 ? S 16:57 0:00 -su -c /usr/bin/node /home/dmitry/node/linkskeeper/app.js 2>&1 >> /home/dmitry/app.log dmitry 28375 3.2 2.6 639748 15916 ? Sl 16:57 0:00 /usr/bin/node /home/dmitry/node/linkskeeper/app.js
I don't understand what's going on here with pids
28375. They're all owned by
dmitry, and I don't understand the command listed for
28372, which begins with a dash.
I should note that the Node.js app seems to work fine with both invokations.