Juan DenisandClaude Fable 5 315d443305 fix(agent): run packaged DEB/RPM agent as an unprivileged service account ...

The packaged systemd units ran the agent as User=root with a self-contradictory
ProtectSystem=strict, while the script installer (install.sh) runs a dedicated,
hardened serverkit-agent account. Align the packages with install.sh:

- User/Group=serverkit-agent; NoNewPrivileges=yes, ProtectSystem=strict,
  ProtectHome=yes, PrivateTmp=yes, ReadWritePaths for config/log/data.
- Create the account (deb postinst / rpm %pre), add it to the docker group,
  create+chown the data dirs, and re-chown the config dir on (re)install so an
  existing root-owned agent.key becomes readable after upgrade.
- ExecStartPre=+chown fixes credential ownership at start regardless of how the
  operator ran `register`; install docs now use `sudo -u serverkit-agent`.

Tradeoff: packaged agents match install.sh's capability set (Docker + metrics +
file access) and no longer do systemd/package management or self-update by
default (both need root). Disabling self-update also routes updates through the
OS package manager's signed path.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-12 01:34:02 -04:00

..

build.sh

fix(agent): run packaged DEB/RPM agent as an unprivileged service account

2026-06-12 01:34:02 -04:00