Agent WranglersRunning the service Required
Run each service as its own user
Run every service as a dedicated user with no login, that owns only its own data and can read only what it needs.
How to do it
Create one system user per service, never root and never the web server's user. Make its data folder readable only by that user, for example with mode 700. The security testing playbook covers keys and database accounts.
Example
useradd --system --no-create-home --shell /usr/sbin/nologin shop
install -d -o shop -g shop -m 700 /var/lib/shopHow to check
ps -o user= -C node shows the service user, and another local user cannot read the data folder.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/running-the-service/service-user.