{"record":{"id":"470badb4526460f3","repo":"phacility/phabricator","slug":"the-notification-server-should-not-be-run-as-root","errorCode":null,"errorMessage":"The notification server should not be run as root.","messagePattern":"The notification server should not be run as root\\.","errorType":"exception","errorClass":"PhutilArgumentUsageException","httpStatus":null,"severity":"error","filePath":"src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php","lineNumber":362,"sourceCode":"        exit(1);\n      }\n    }\n  }\n\n  final protected function willLaunch() {\n    $console = PhutilConsole::getConsole();\n\n    $pid = $this->getPID();\n    if ($pid) {\n      throw new PhutilArgumentUsageException(\n        pht(\n          'Unable to start notifications server because it is already '.\n          'running. Use `%s` to restart it.',\n          'aphlict restart'));\n    }\n\n    if (posix_getuid() == 0) {\n      throw new PhutilArgumentUsageException(\n        pht('The notification server should not be run as root.'));\n    }\n\n    // Make sure we can write to the PID file.\n    if (!$this->debug) {\n      Filesystem::writeFile($this->getPIDPath(), '');\n    }\n\n    // First, start the server in configuration test mode with --test. This\n    // will let us error explicitly if there are missing modules, before we\n    // fork and lose access to the console.\n    $test_argv = $this->getServerArgv();\n    $test_argv[] = '--test=true';\n\n\n    execx('%C', $this->getStartCommand($test_argv));\n  }\n","sourceCodeStart":344,"sourceCodeEnd":380,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php#L344-L380","documentation":"Thrown by willLaunch() when posix_getuid() == 0, i.e. `aphlict` is being started as root. Phabricator deliberately refuses to run the Node.js notification server as root because it needs no privileges and a compromised listener running as root is a serious escalation risk.","triggerScenarios":"Invoking bin/aphlict via sudo or from a root shell/cron entry; an init script that does not drop privileges before exec.","commonSituations":"Operators habitually prefix admin commands with sudo; Docker containers that default to root; upstart/sysvinit scripts without setuid/su.","solutions":["Run aphlict as a dedicated non-root user: sudo -u aphlict bin/aphlict start","In systemd, set User=aphlict (and Group=) on the unit so the launch is already unprivileged","Ensure the directories from pidfile/logs config are owned by that user first (see errors 69/72)"],"exampleFix":"# before\n$ sudo bin/aphlict start   # -> should not be run as root\n# after\n$ sudo -u aphlict bin/aphlict start\n# systemd unit: [Service]\n# User=aphlict\n# Group=aphlict\n# ExecStart=/path/to/phabricator/bin/aphlict start","handlingStrategy":"validation","validationCode":"if (posix_getuid() === 0) {\n  fwrite(STDERR, \"Refusing to run as root; re-run as the service user.\\n\");\n  exit(1);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Drop privileges in the service unit (User=/Group=) so this can never trigger","Never prefix aphlict commands with sudo; use sudo -u <user> if elevation is needed"],"tags":["aphlict","privileges","process-management","phabricator"],"backgroundTag":"running-as-root","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}