Why is AmbientCapabilities=CAP_SYS_ADMIN required?

[septatrix]

This pretty much gives quarkus superuser privileges and is unacceptable for services reachable via the network

[Eng-Fouad]

This pretty much gives quarkus superuser privileges and is unacceptable for services reachable via the network

An alternative is to use:

NotifyAccess=all

Otherwise, the app which is run by non-root user cannot send notificaton to systemd.

[gsmet]

I'm not very familiar with systemd but the alternative you mention looks less scary?

[septatrix]

I'm not very familiar with systemd but the alternative you mention looks less scary?

Yes, using NotifyAccess is way better

[gsmet]

Maybe you can create a small PR if you checked all is fine with this setup?

[septatrix]

Looking at the man page I think it might be necessary to add the --block switch to the subprocess as otherwise the process may exit before systemd had a chance to check to which service it belongs