User=nobody is discouraged by systemd as inherently unsafe

Please answer all the questions with enough information. All issues not following this template will be closed immediately.
If you are not sure if your question is truely a bug in V2Ray, please discuss it here first.

1. What version of V2Ray are you using (If you deploy different version on server and client, please explicitly point out)?

OS: Arch Linux
$ pacman -Q systemd v2ray
systemd 246.6-1
v2ray 4.32.1

2. What's your scenario of using V2Ray? E.g., Watching YouTube videos in Chrome via Socks/VMess proxy.

General testing.

3. What did you see? (Please describe in detail, such as timeout, fake TLS certificate etc)

Starting the systemd service throws a warning, stating that User=nobody is unsafe.

4. What's your expectation?

Running the systemd service as reasonably safe and secure as possible.

5. Please attach your configuration file (Mask IP addresses before submit this issue).

Server configuration:

{
    "inbounds": [
        {
            "port": 10086, // Server Listening Port
            "protocol": "vmess",
            "settings": {
                "clients": [
                    {
                        "id": "b831381d-6324-4d53-ad4f-8cda48b30811"
                    }
                ]
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "freedom"
        }
    ]
}

Client configuration:

{
    "inbounds": [
        {
            "port": 1080, // SOCKS Proxy Port. Configure the browser proxy to use this port.
            "listen": "127.0.0.1",
            "protocol": "socks",
            "settings": {
                "udp": true
            }
        }
    ],
    "outbounds": [
        {
            "protocol": "vmess",
            "settings": {
                "vnext": [
                    {
                        "address": "server", // Server address: Change to your server hostname or ip address.
                        "port": 10086, // Server Listening Port
                        "users": [
                            {
                                "id": "b831381d-6324-4d53-ad4f-8cda48b30811"
                            }
                        ]
                    }
                ]
            }
        },
        {
            "protocol": "freedom",
            "tag": "direct"
        }
    ],
    "routing": {
        "domainStrategy": "IPOnDemand",
        "rules": [
            {
                "type": "field",
                "ip": [
                    "geoip:private"
                ],
                "outboundTag": "direct"
            }
        ]
    }
}

6. Please attach error logs, especially the bottom lines if the file is large. Error log file is usually at /var/log/v2ray/error.log on Linux.

Server error log:

N/A

Client error log:

N/A

7. Please attach access log. Access log is usually at '/var/log/v2ray/access.log' on Linux.

N/A

8. Other configurations (such as Nginx) and logs.

9. If V2Ray doesn't run, please attach output from --test.

The command is usually /usr/bin/v2ray/v2ray --test --config /etc/v2ray/config.json, but may vary according to your scenario.

10. If V2Ray service doesn't run, please attach journal log.

Usual command is journalctl -u v2ray.

Please review your issue before submitting.

Systemd recently started to discourage the use of User=nobody. I have succesfully used a dynamic user configuration in the v2ray.service unit (see below), but that might not be the best way to deal with this. Lots of OS'es have an older systemd version and it's hard to determine/maintain when all the needed systemd options are supported. IMHO it would be easier to create a dedicated unprivileged user (e.g. v2ray) via systemd-sysusers.

[Unit]
Description=V2Ray Service
Documentation=https://www.v2fly.org/
After=network.target nss-lookup.target

[Service]
#User=nobody
DynamicUser=true
CacheDirectory=v2ray
LogsDirectory=v2ray
RuntimeDirectory=v2ray
StateDirectory=v2ray
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
NoNewPrivileges=true
ExecStart=/usr/bin/v2ray -config /etc/v2ray/config.json
Restart=on-failure
RestartPreventExitStatus=23

[Install]
WantedBy=multi-user.target

[kslr]

Thank you for your message, we can modify the Arch first.

@felixonmars What do you think?

[felixonmars]

We'll probably go with the systemd-sysusers route. Sorry for the delay on this :(

[unknowndevQwQ]

Example v2ray.conf
u v2ray - "V2Ray Daemon User"

[github-actions]

This issue is stale because it has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days

[unknowndevQwQ]

Wait, No one did anything for this?

[sunshineplan]

刚更新完Debian bullseye后，忽然发现syslog内有一行：
/etc/systemd/system/v2ray.service:7: Special user nobody configured, this is not safe!

[github-actions]

This issue is stale because it has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days

[mmsaffari]

Hello,
To work around this warning, I did this:

1. If you have logging enabled in your config, disable it (i.e., remove the logging part from your config.json.
2. Using a text editor like nano or vi, edit the service file at /etc/systemd/system/v2ray.service.
3. Using a # change User=nobody to #User=nobody
4. Add a new like below #User=nobody containing DynamicUser=yes, save the file, and exit the editor.
5. Use systemctl daemon-reload to make the systemd read the new service file.
6. Use systemctl restart v2ray to restart the service using the new configuration.

[BeautyyuYanli]

relate to #2287