关于Snap以非root用户运行服务及Gitea配置方法的咨询

API 探路者

2026-4-21

Snap以非root用户运行服务及Gitea配置方法的咨询

Hey there! I've dealt with this exact scenario before when setting up Gitea via Snap, so let me walk you through the steps to get it running as a non-root user:

Create a dedicated system user for Gitea
First, we'll make a locked-down system user that Gitea can run under. This user won't have a login shell, which is more secure:
```
sudo adduser --system --group --disabled-login --home /var/snap/gitea/common gitea
```
The home directory points to Snap's Gitea common folder, where all your Gitea data lives.
Fix directory permissions
The existing Gitea data folder is owned by root right now, so we need to transfer ownership to our new user:
```
sudo chown -R gitea:gitea /var/snap/gitea/common
```
Override the systemd service to run as non-root
Snap manages Gitea via a systemd service, but we can safely modify it without breaking future Snap updates using an override file. Run this command to open the override editor:
```
sudo systemctl edit snap.gitea.gitea.service
```
Paste these lines into the editor, save, and exit:
```
[Service]
User=gitea
Group=gitea
```
Update Gitea's internal config
Open Gitea's app.ini file to make sure it knows to use our new user:
```
sudo nano /var/snap/gitea/common/conf/app.ini
```
Find the RUN_USER line (usually under the [server] section) and set it to:
```
RUN_USER = gitea
```
Save and exit the editor.
Handle low port access (if needed)
If you're using ports below 1024 (like 80 or 443) for Gitea, non-root users can't bind these by default. Fix this by adding the necessary capability to the Gitea binary:
```
sudo setcap 'cap_net_bind_service=+ep' /snap/gitea/current/gitea
```
Restart the service and verify
Finally, restart Gitea to apply all changes:
```
sudo systemctl restart snap.gitea.gitea.service
```
Check that it's running as the gitea user with this command:
```
ps aux | grep gitea
```
You should see the gitea process listed under the gitea user instead of root.