Syncthing service running as root

[onlynow2]

I observed file permission errors after setting up syncthing LXC container with the script.
I'm running the CT as unpriviledged and some filepaths mounted from the host into the container. UID mapping is done for proper file permissions with other container accesing the data.

After some investigation I found the syncthing process running as root.
Therfore it's quite challenging, as all the files from syncthing get created as root.
Is it possible to run syncthing as a different user, so that also the UID and GID of this user can be changed to avoid problems with mount points and file permissions?

[tteck]

https://docs.syncthing.net/advanced/folder-sync-ownership

[tteck]

/etc/systemd/system/multi-user.target.wants/[email protected]

[Unit]
Description=Syncthing - Open Source Continuous File Synchronization for %I
Documentation=man:syncthing(1)
After=network.target
StartLimitIntervalSec=60
StartLimitBurst=4

[Service]
User=%i
ExecStart=/usr/bin/syncthing serve --no-browser --no-restart --logflags=0
Restart=on-failure
RestartSec=1
SuccessExitStatus=3 4
RestartForceExitStatus=3 4

# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true

# Elevated permissions to sync ownership (disabled by default),
# see https://docs.syncthing.net/advanced/folder-sync-ownership
#AmbientCapabilities=CAP_CHOWN CAP_FOWNER

[Install]
WantedBy=multi-user.target

[onlynow2]

Thanks for pointing me in the right direction.

[stuartisaac]

For anyone else running across this (and who's new to Syncthing like I am), I figured I'd add some more steps here.

1. Uncomment the AmbientCapabilities line in the service file (or add that line with an override via systemctl edit servicefile) and restart the container.
2. Enable the Sync Ownership option in the sync folder advanced properties on sending/receiving devices.