Re: rootless chronyd

--00000000000046069a063b11d6d1
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

The only thing I need is the `chronyc sources` command.

`The check for root can be disabled by the -U option`
I know wanting to do it as a container has nothing to do with this
mailetter, but can you elaborate about what you mean?


=E2=80=AB=D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=9A =D7=99=D7=95=D7=9D =D7=92=D7=
=B3, 29 =D7=91=D7=99=D7=95=D7=9C=D7=99 2025 =D7=91-16:11 =D7=9E=D7=90=D7=AA=
 =E2=80=AAMiroslav Lichvar=E2=80=AC=E2=80=8F <=E2=80=AA
[email protected]=E2=80=AC=E2=80=8F>:=E2=80=AC

> On Tue, Jul 29, 2025 at 04:02:15PM +0300, Remush wrote:
> > I attempted to create a Docker Image with the Chronyd installed, yet th=
e
> > container is rootless, meaning my uid is not root, however my gid is 0
> > (root).
> >
> > Now it seems that running the container I receive many permission denie=
d
> on
> > /run/chrony and more,
> >
> > My question is, Is there any way to make the service run not with root?
>
> Yes, chronyd can be started without root in some configurations where
> it doesn't need to access any RTC, PPS, PHC devices, but it may need
> some capabilities like CAP_SYS_TIME and CAP_NET_BIND_SERVICE (if it
> should run as a server).
>
> The check for root can be disabled by the -U option. The /run/chrony
> directory needs to exist before starting chronyd (only root can
> normally write in /run).
>
> There is an example systemd service that starts chronyd without root:
>
> https://gitlab.com/chrony/chrony/-/blob/master/examples/chronyd-restricte=
d.service
>
> --
> Miroslav Lichvar
>
>
> --
> To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org
> with "unsubscribe" in the subject.
> For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org
> with "help" in the subject.
> Trouble?  Email [email protected]
>
>

--00000000000046069a063b11d6d1
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"rtl"><div dir=3D"ltr">The only thing I need is the `chronyc sou=
rces` command.<br><br>`The check for root can be disabled by the -U option`=
<br></div><div dir=3D"ltr">I know wanting to do it as a container has nothi=
ng to do with this mailetter, but can you elaborate about what you mean?<br=
><br></div></div><br><div class=3D"gmail_quote gmail_quote_container"><div =
dir=3D"rtl" class=3D"gmail_attr">=E2=80=AB=D7=91=D7=AA=D7=90=D7=A8=D7=99=D7=
=9A =D7=99=D7=95=D7=9D =D7=92=D7=B3, 29 =D7=91=D7=99=D7=95=D7=9C=D7=99 2025=
 =D7=91-16:11 =D7=9E=D7=90=D7=AA =E2=80=AAMiroslav Lichvar=E2=80=AC=E2=80=
=8F &lt;=E2=80=AA<a href=3D"mailto:[email protected]">[email protected]=
</a>=E2=80=AC=E2=80=8F&gt;:=E2=80=AC<br></div><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">On Tue, Jul 29, 2025 at 04:02:15PM +0300, Remush wrote=
:<br>
&gt; I attempted to create a Docker Image with the Chronyd installed, yet t=
he<br>
&gt; container is rootless, meaning my uid is not root, however my gid is 0=
<br>
&gt; (root).<br>
&gt; <br>
&gt; Now it seems that running the container I receive many permission deni=
ed on<br>
&gt; /run/chrony and more,<br>
&gt; <br>
&gt; My question is, Is there any way to make the service run not with root=
?<br>
<br>
Yes, chronyd can be started without root in some configurations where<br>
it doesn&#39;t need to access any RTC, PPS, PHC devices, but it may need<br=
>
some capabilities like CAP_SYS_TIME and CAP_NET_BIND_SERVICE (if it<br>
should run as a server).<br>
<br>
The check for root can be disabled by the -U option. The /run/chrony<br>
directory needs to exist before starting chronyd (only root can<br>
normally write in /run).<br>
<br>
There is an example systemd service that starts chronyd without root:<br>
<a href=3D"https://gitlab.com/chrony/chrony/-/blob/master/examples/chronyd-=
restricted.service" rel=3D"noreferrer" target=3D"_blank">https://gitlab.com=
/chrony/chrony/-/blob/master/examples/chronyd-restricted.service</a><br>
<br>
-- <br>
Miroslav Lichvar<br>
<br>
<br>
-- <br>
To unsubscribe email <a href=3D"mailto:[email protected]=
y.org" target=3D"_blank">chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org</a> <br>
with &quot;unsubscribe&quot; in the subject.<br>
For help email <a href=3D"mailto:chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org"=
 target=3D"_blank">chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org</a> <br>
with &quot;help&quot; in the subject.<br>
Trouble?=C2=A0 Email <a href=3D"mailto:[email protected]" tar=
get=3D"_blank">[email protected]</a>.<br>
<br>
</blockquote></div>

--00000000000046069a063b11d6d1--

-- 
To unsubscribe email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "unsubscribe" in the subject.
For help email chrony-users-request-kWFZVVI9zxvPqho9SqqRMmD2FQJk+8+b@public.gmane.org 
with "help" in the subject.
Trouble?  Email [email protected]