title: Start Unicorn Without sudo
body: <p>I'm trying to start my unicorn process without using sudo.  I've written a script that has been symlinked to <code>/etc/init.d/unicorn_arcsite.sh</code>.</p>
  
  <p>If I run <code>service unicorn_arcsite start</code> my script says it starts fine, but my server does not handle http requests.  Looking at the unicorn log I see this:</p>
  
  <pre><code>E, [2013-09-24T13:21:39.111308 #16879] ERROR -- : reaped #&lt;Process::Status: pid 26117 exit 1&gt; worker=7
  E, [2013-09-24T13:21:39.112981 #26120] ERROR -- : Operation not permitted (Errno::EPERM)
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/worker.rb:83:in `initgroups'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/worker.rb:83:in `user'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/http_server.rb:592:in `init_worker_process'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/http_server.rb:615:in `worker_loop'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/http_server.rb:500:in `spawn_missing_workers'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/http_server.rb:511:in `maintain_worker_count'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/lib/unicorn/http_server.rb:277:in `join'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/gems/unicorn-4.6.2/bin/unicorn:126:in `&lt;top (required)&gt;'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/bin/unicorn:23:in `load'
  /home/deployer/.rvm/gems/ruby-2.0.0-p195@arcsite_mysql/bin/unicorn:23:in `&lt;main&gt;'
  </code></pre>
  
  <p>Running <code>sudo service unicorn_arcsite start</code> works fine.</p>
  
  <p>I'm running on top of nginx, and nginx and unicorn communicate over a socket at <code>/tmp/unicorn.arcsite.sock</code>.  </p>
  
  <p><strong>Permissions</strong></p>
  
  <pre><code>deployer@arcsite:~/apps/arcsite/current$ service unicorn_arcsite start
  /home/deployer/apps/arcsite/current: 
  Starting - OK
  
  deployer@arcsite:~/apps/arcsite/current$ ls -ld /tmp/unicorn.arcsite.sock 
  srwxrwxrwx 1 deployer sudo 0 Sep 24 13:50 /tmp/unicorn.arcsite.sock
  
  deployer@arcsite:~/apps/arcsite/current$ ls -l tmp/pids/unicorn.pid 
  -rw-r--r-- 1 deployer sudo 6 Sep 24 13:50 tmp/pids/unicorn.pid
  
  deployer@arcsite:~/apps/arcsite/current$ id
  uid=1000(deployer) gid=27(sudo) groups=27(sudo)
  </code></pre>
  
  <p><strong>Files</strong></p>
  
  <p><code>unicorn.rb</code></p>
  
  <pre><code># RAILS_ROOT/config/unicorn.rb
  # Search for "# SET ME!" and replace these with your own settings!.
  
  # Set environment to development unless something else is specified
  env = ENV["RAILS_ENV"] || "development"
  ROOT = "&lt;app_root&gt;"
  
  
  ENV['BUNDLE_GEMFILE'] = File.expand_path('../Gemfile', File.dirname(__FILE__))
  require 'bundler/setup'
  
  pid "#{ROOT}/tmp/pids/unicorn.pid"
  
  # See http://unicorn.bogomips.org/Unicorn/Configurator.html for complete
  # documentation.
  worker_processes 10 # SET ME!
  
  # listen on both a Unix domain socket and a TCP port,
  # we use a shorter backlog for quicker failover when busy
  listen "/tmp/unicorn.arcsite.sock", :backlog =&gt; 1024 # SET ME!
  
  # Preload our app for more speed
  preload_app true
  
  GC.respond_to?(:copy_on_write_friendly=) and
      GC.copy_on_write_friendly = true
  
  # nuke workers after 30 seconds instead of 60 seconds (the default)
  timeout 30
  
  # Production specific settings
  if env == "production"
    # Help ensure your application will always spawn in the symlinked
    # "current" directory that Capistrano sets up.
    working_directory ROOT
  
    # feel free to point this anywhere accessible on the filesystem
    user 'deployer', 'staff'
    shared_path = "&lt;shared_path&gt;"
  
    stderr_path "#{shared_path}/log/unicorn.log"
    stdout_path "#{shared_path}/log/unicorn.log"
  end
  
  before_fork do |server, worker|
    # the following is highly recomended for Rails + "preload_app true"
    # as there's no need for the master process to hold a connection
    if defined?(ActiveRecord::Base)
      ActiveRecord::Base.connection.disconnect!
    end
  
    # Before forking, kill the master process that belongs to the .oldbin PID.
    # This enables 0 downtime deploys.
    old_pid = "#{ROOT}/tmp/pids/unicorn.pid.oldbin"
    if File.exists?(old_pid) &amp;&amp; server.pid != old_pid
      begin
        Process.kill("QUIT", File.read(old_pid).to_i)
      rescue Errno::ENOENT, Errno::ESRCH
        # someone else did our job for us
      end
    end
  end
  
  after_fork do |server, worker|
    # the following is *required* for Rails + "preload_app true",
    if defined?(ActiveRecord::Base)
      ActiveRecord::Base.establish_connection
    end
  
    # if preload_app is true, then you may also want to check and
    # restart any other shared sockets/descriptors such as Memcached,
    # and Redis.  TokyoCabinet file handles are safe to reuse
    # between any number of forked children (assuming your kernel
    # correctly implements pread()/pwrite() system calls)
  end
  </code></pre>