---
title: "Run each service as its own user · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/running-the-service/service-user
updated: 2026-10-20
licence: "All rights reserved"
---

# Run each service as its own user

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Running the service](https://agentwranglers.se/playbook/operations/running-the-service)
- Rule: Run every service as a dedicated user with no login, that owns only its own data and can read only what it needs.
- How: Create one system user per service, never root and never the web server's user. Make its data folder readable only by that user, for example with mode 700. The [security testing playbook](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys) covers keys and database accounts.
- Check: `ps -o user= -p "$(systemctl show -p MainPID --value shop)"` prints the service user, not root. `sudo -u nobody ls /var/lib/shop` fails with permission denied.

Example:

```sh
useradd --system --no-create-home --shell /usr/sbin/nologin shop
install -d -o shop -g shop -m 700 /var/lib/shop
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/running-the-service/service-user`.

- Next: [Lock the service in a sandbox](https://agentwranglers.se/playbook/operations/running-the-service/service-sandbox)
- [Running the service](https://agentwranglers.se/playbook/operations/running-the-service)