su-exec Documentation

A key advantage of su-exec is how it handles process hierarchies. Traditional tools like su execute the target command as a child of a shell, which can cause issues with signal propagation and TTY ownership. su-exec executes the command directly as the primary process (PID 1 in many container contexts).

Comparison Example:

Using su (where the shell becomes the parent of the command):

$ docker run -it --rm alpine:edge su postgres -c 'ps aux'
PID   USER     TIME   COMMAND
    1 postgres   0:00 ash -c ps aux
   12 postgres   0:00 ps aux

Using su-exec (where the command is executed directly):

$ docker run -it --rm -v $PWD/su-exec:/sbin/su-exec:ro alpine:edge su-exec postgres ps aux
PID   USER     TIME   COMMAND
    1 postgres   0:00 ps aux

Use su-exec to switch the current user and group ID, set groups, and execute a program. Unlike su or sudo, su-exec executes the target program directly rather than as a child process. This prevents TTY and signal handling issues common in containerized environments.

Requirements:

• su-exec must be run by the root user, as non-root users lack the permissions to change UID/GID.

Command Syntax:

su-exec user-spec command [ arguments... ]

user-spec Formats:

• Username: e.g., nobody
• Username and Group Name: Separated by a colon, e.g., nobody:ftp
• Numeric IDs: Use numeric UID/GID values directly.

$ su-exec apache:1000 /usr/sbin/httpd -f /opt/www/httpd.conf