Allow user other than root to restart supervisorctl process?

Question

I have supervisord run a program as user stavros, and I would like to give the same user permission to restart it using supervisorctl. Unfortunately, I can only do it with sudo, otherwise I get a permission denied error in socket.py. How can I give myself permission to restart supervisord processes?

Answer 1

Personally, I think it is a bad idea to run supervisord as root, but if you want to do this, while allowing a full restart by other users, here is how I would do it.

1/ Create a supervisor group on your system which will have restart rights on supervisord

2/ Put the relevant users in group supervisor

3/ In the supervisord configuration, use the following lines in the [unix_http_server] section:

chmod=0770                 ; socket file mode (default 0700)
chown=root:supervisor      ; socket file uid:gid owner

It will guarantee that the admin socket is accessible from the selected users.

4/ Add supervisord in the init mechanism of your system in respawn mode (init, systemd, upstart, etc ...). It depends on your system. Respawn mode means the process will be automatically relaunched if it crashes or stops.

5/ From one of the selected users, you should be able to use supervisorctl to run commands, including a complete shutdown which will trigger a full restart of supervisord.