What causes "The notification server should not be run as root." in phacility/phabricator?

Run aphlict as a dedicated non-root user: sudo -u aphlict bin/aphlict start

phacility/phabricator · error · PhutilArgumentUsageException

The notification server should not be run as root.

Error message

The notification server should not be run as root.

What it means

Thrown by willLaunch() when posix_getuid() == 0, i.e. `aphlict` is being started as root. Phabricator deliberately refuses to run the Node.js notification server as root because it needs no privileges and a compromised listener running as root is a serious escalation risk.

Source

Thrown at src/applications/aphlict/management/PhabricatorAphlictManagementWorkflow.php:362

        exit(1);
      }
    }
  }

  final protected function willLaunch() {
    $console = PhutilConsole::getConsole();

    $pid = $this->getPID();
    if ($pid) {
      throw new PhutilArgumentUsageException(
        pht(
          'Unable to start notifications server because it is already '.
          'running. Use `%s` to restart it.',
          'aphlict restart'));
    }

    if (posix_getuid() == 0) {
      throw new PhutilArgumentUsageException(
        pht('The notification server should not be run as root.'));
    }

    // Make sure we can write to the PID file.
    if (!$this->debug) {
      Filesystem::writeFile($this->getPIDPath(), '');
    }

    // First, start the server in configuration test mode with --test. This
    // will let us error explicitly if there are missing modules, before we
    // fork and lose access to the console.
    $test_argv = $this->getServerArgv();
    $test_argv[] = '--test=true';


    execx('%C', $this->getStartCommand($test_argv));
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

Run aphlict as a dedicated non-root user: sudo -u aphlict bin/aphlict start
In systemd, set User=aphlict (and Group=) on the unit so the launch is already unprivileged
Ensure the directories from pidfile/logs config are owned by that user first (see errors 69/72)

Example fix

# before
$ sudo bin/aphlict start   # -> should not be run as root
# after
$ sudo -u aphlict bin/aphlict start
# systemd unit: [Service]
# User=aphlict
# Group=aphlict
# ExecStart=/path/to/phabricator/bin/aphlict start

Defensive patterns

Strategy: validation

Validate before calling

if (posix_getuid() === 0) {
  fwrite(STDERR, "Refusing to run as root; re-run as the service user.\n");
  exit(1);
}

Prevention

Drop privileges in the service unit (User=/Group=) so this can never trigger
Never prefix aphlict commands with sudo; use sudo -u <user> if elevation is needed

When it happens

Trigger: Invoking bin/aphlict via sudo or from a root shell/cron entry; an init script that does not drop privileges before exec.

Common situations: Operators habitually prefix admin commands with sudo; Docker containers that default to root; upstart/sysvinit scripts without setuid/su.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/470badb4526460f3. Report an issue: GitHub.