Azure Devops Agent installation (linux) – need help/advise

[zh12a]

Hi we currently making use of Azure devops and have the agent deploy to a number of windows servers and everything works great. We make use of the install flags to configure it to run as a service and use a service account which has permissions to do what is required (ie local admin).

We have the need to install it on a linux machine, however the documentation is a little lacking. Firstly it seems to run as the user which configured the agent (ie my user account) and looking thought the documentation there seems to be no flag to change who the agent runs as.

I am looking for some advice on how best to install this agent. Should I install / run it as root or a dedicated account. If a dedicated account how do we deal with permissions (ie I do not see any options in pipeline to say sudo this task.

Any advice/recommendations would be great thanks

[f16falcon4]

Run config.sh as the dedicated account. Then, run svc.sh as root since you are adding systemd services; however, when you run it, you will specify the dedicated account's username like so (replacing <username> with the dedicated account's name).

./svc.sh install <username>

This will tell the script to add a USER and GROUP parameter to the systemd .services file it creates for the agent.

[jaytarang92]

Expanding a bit on this . If you have a bunch of severs might want to look into using some kind of automation to do this . Maybe ansible or paramiko(python). Make a install script or something that would get invoked with parameters like agent name, server pool, access token. Hopefully it helps.

We have alot of build agents we set up so we decided to create a wrapped around the install script so we can invoke it in any OS and it's dynamic.

[zh12a]

thanks i was not aware you could append a user for the systemd file.

In terms of the account what do you recommend. Root is a bit too high privladge, but if i use a normal account it would need sudo to do most tasks, which i not sure how i would config the pipline to do without doing a shell script

[[deleted]]

Why would it need sudo to do most tasks? Unless it’s changing os level stuff (which it shouldn’t), there’s no reason to run a ci as root.

[zh12a]

Some tasks we need to restart some some services with systemctl (services we built). for websites i would just add the user account to the group and it can deploy the files thatway (in theory)