--- title: Systemd Dynamic Users (2020) | daily.dev description: systemd's Dynamic Users feature allows services to run under ephemeral Linux users created at runtime and destroyed when the unit stops, without ever touching... canonical: https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Systemd Dynamic Users (2020) | daily.dev og:description: systemd's Dynamic Users feature allows services to run under ephemeral Linux users created at runtime and destroyed when the unit stops, without ever touching... og:url: https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx og:image: https://api.daily.dev/og/posts/IEMJkjjqX.png og:image:alt: Systemd Dynamic Users (2020) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Systemd Dynamic Users (2020) **[Lobsters](https://daily.dev/sources/lobsters)** · 3 min read · 0 upvotes · 0 comments ## Summary systemd's Dynamic Users feature allows services to run under ephemeral Linux users created at runtime and destroyed when the unit stops, without ever touching /etc/passwd. This simplifies service packaging by eliminating the need to create/remove dedicated system users during install/uninstall. The post covers practical use cases including running simple web services, running Kodi on a Raspberry Pi, and sandboxing Steam by combining Dynamic Users with X11 group permissions and StateDirectory for persistent storage. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do systemd Dynamic Users work and how are they different from regular Linux users? systemd Dynamic Users are ephemeral Linux users created for the lifetime of a systemd unit and destroyed when the unit stops. Unlike regular users, they are never written to /etc/passwd — they exist only at runtime via the Name Service Switch. They are locked down by default but can be granted group memberships, capabilities, and access to persistent StateDirectories at /var/lib/private//. _Developers managing self-hosted Linux services track systemd patterns like this on daily.dev._ ### How do I use systemd StateDirectory to give a dynamic user persistent storage? Setting StateDirectory= in a systemd unit causes systemd to create /var/lib/private// and make it writable by the dynamic user for that run. The directory persists after the unit stops, and systemd automatically fixes ownership on the next run so the newly created dynamic user can write to it. This makes it suitable for storing service data or simulating a home directory. _Teams shipping Linux services without dedicated system users find related techniques on daily.dev._ ### How can I sandbox Steam on Linux using systemd without Docker? You can sandbox Steam with systemd-run by creating a dedicated X11 group (e.g. eth-x11), granting it display access via xhost, then running Steam as a dynamic user whose primary group is that X11 group. Add the user to audio, input, and video groups, set a StateDirectory for $HOME, and pass the $DISPLAY variable. Running systemd-run requires root or sudo unless you configure sudoers or setuid on the wrapper script. _Linux users sandboxing desktop apps without containers share approaches like this on daily.dev._ ## Similar posts on daily.dev - [How to deploy .NET applications with systemd and Podman](https://daily.dev/posts/how-to-deploy-net-applications-with-systemd-and-podman-ln7jgwgic) · Red Hat Developer · 21 upvotes · 0 comments - [Securing services with Rootless Containers](https://daily.dev/posts/securing-services-with-rootless-containers-1bbnsjvwj) · Hacker News · 0 upvotes · 0 comments - [Flatpak will depend on systemd – OSnews](https://daily.dev/posts/flatpak-will-depend-on-systemd-osnews-rlgqb4jlf) · Lobsters · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Systemd Dynamic Users (2020)","url":"https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx"},"datePublished":"2026-08-09T10:24:23.981Z","dateModified":"2026-08-09T10:24:50.258Z","description":"systemd's Dynamic Users feature allows services to run under ephemeral Linux users created at runtime and destroyed when the unit stops, without ever touching...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Systemd Dynamic Users (2020)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/systemd-dynamic-users-2020--iemjkjjqx#faq","mainEntity":[{"@type":"Question","name":"How do systemd Dynamic Users work and how are they different from regular Linux users?","acceptedAnswer":{"@type":"Answer","text":"systemd Dynamic Users are ephemeral Linux users created for the lifetime of a systemd unit and destroyed when the unit stops. Unlike regular users, they are never written to /etc/passwd — they exist only at runtime via the Name Service Switch. They are locked down by default but can be granted group memberships, capabilities, and access to persistent StateDirectories at /var/lib/private//. Developers managing self-hosted Linux services track systemd patterns like this on daily.dev."}},{"@type":"Question","name":"How do I use systemd StateDirectory to give a dynamic user persistent storage?","acceptedAnswer":{"@type":"Answer","text":"Setting StateDirectory= in a systemd unit causes systemd to create /var/lib/private// and make it writable by the dynamic user for that run. The directory persists after the unit stops, and systemd automatically fixes ownership on the next run so the newly created dynamic user can write to it. This makes it suitable for storing service data or simulating a home directory. Teams shipping Linux services without dedicated system users find related techniques on daily.dev."}},{"@type":"Question","name":"How can I sandbox Steam on Linux using systemd without Docker?","acceptedAnswer":{"@type":"Answer","text":"You can sandbox Steam with systemd-run by creating a dedicated X11 group (e.g. eth-x11), granting it display access via xhost, then running Steam as a dynamic user whose primary group is that X11 group. Add the user to audio, input, and video groups, set a StateDirectory for $HOME, and pass the $DISPLAY variable. Running systemd-run requires root or sudo unless you configure sudoers or setuid on the wrapper script. Linux users sandboxing desktop apps without containers share approaches like this on daily.dev."}}]} ```