@zaporter-work I was not able to confirm that the username attribute does anything. My assumption is that it would allow us to run the process as a user?

On my pi I added a process with this config:

{
      "env": {
        "SVC_API_KEY": "VALUE"
      },
      "username": "pi",
      "id": "process-2",
      "name": "python",
      "args": [
        "username.py"
      ],
      "cwd": "/home/pi",
      "log": true,
      "one_shot": false
    }

and this little python program:

import os
import getpass
import time

while True:
  print(1)
  print(time.sleep(1))
  raise ValueError(getpass.getuser())

I can't see anytihng printed at all and what gets raised always indicates that the process runs as root.

Does username do somethign else?

Thank you so much for testing this!

I have just confirmed that with the newest RDK, this now works.

A slightly easier way to test that this works is via the whoami command:

  "processes": [
    {
      "username": "pi",
      "id": "process-1",
      "name": "whoami",
      "log": true
    }
  ],

@zaporter-work could you confirm for me how the config for a machine reaches the machine? That's all e2e encrypted right? I think we should probably mention that here.

Talked offline -- this is not e2e encrypted. The config is encrypted in transit, but is not encrypted at rest (on the robot or in our db).

That implies that you should exercise some caution when putting api keys in here as you are trusting the security of the viam database and viam employees.

Seems better down here +1