From 09e68e2fa17a9f6e99060a8a71a18e409c97d6cc Mon Sep 17 00:00:00 2001 From: Daniil Anfimov Date: Fri, 23 Oct 2026 12:40:15 +0300 Subject: [PATCH] Start Celery worker through /bin/sh like Flower and scheduler On SELinux-enforcing hosts systemd refused to execute the celery binary from the venv in the user's home directory ('Failed to locate executable ... Permission denied', status 203/EXEC), which broke alts-celery on the s390x node. Start it via /bin/sh -c 'exec ...', the same way alts-flower and alts-scheduler start their home venv binaries, so no SELinux relabelling is needed. --- deployment/templates/alts-celery.service.j2 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/deployment/templates/alts-celery.service.j2 b/deployment/templates/alts-celery.service.j2 index 7d3e53c3..eac3a3e3 100644 --- a/deployment/templates/alts-celery.service.j2 +++ b/deployment/templates/alts-celery.service.j2 @@ -8,13 +8,15 @@ Group={{ test_system_user }} WorkingDirectory=/home/{{ test_system_user }}/alts Environment=CELERY_CONFIG_PATH={{ test_system_config_dir }}/celery.yaml ExecStartPre=-/usr/bin/find /tmp -maxdepth 1 -type d -name {{ worker_type }}_test_runner* -exec rm -rf {} + -ExecStart={{ celery_venv_dir }}/bin/celery -A alts.worker.app worker \ +# Start through /bin/sh like alts-scheduler: under SELinux, systemd may not +# execute binaries labelled as user home content directly +ExecStart=/bin/sh -c 'exec {{ celery_venv_dir }}/bin/celery -A alts.worker.app worker \ --pool={{ celery_pool_type }} \ --concurrency={{ celery_concurrency }} \ -O fair \ -Q {{ celery_queues|join(",") }} \ --loglevel={{ celery_loglevel }} \ - --logfile {{ celery_log_file }} + --logfile {{ celery_log_file }}' [Install] WantedBy=multi-user.target