Gitlab-runner running NOT by root

GitLab CI/CD
1

IT is moving us to a new datacenter…I am losing my root/sudo privileges.

In the current datacenter, I on my own can install/update/stop/start gitlab-runner in a specific box assigned to me; I can also register runners.

The installation and service is the typical one; here is ps output of the running process:

ps -aef | grep runner
root        8168       1  0 Jun01 ?        01:31:13 /usr/bin/gitlab-runner run --working-directory /home/gitlab-runner --config /etc/gitlab-runner/config.toml --service gitlab-runner --user gitlab-runner

In the new datacenter, IT does not want non-IT folks having any privileges; also, they want us to have a specific (non-local) user id per service. So, I have officially requested an additional user id, say jogger, for the purposes of running gitlab-runner, and being able to register runners.

As per the documentation, IT installed gitlab-runner and configured the service to be run by user jogger and using working directory and config.toml out of such user’s home directory, too, for read/write privileges. Here is ps output of the running process in the new datacenter:

ps -aef | grep runner
jogger   55920       1  0 Jun29 ?        00:05:07 /usr/bin/gitlab-runner run --config /home/jogger/.gitlab-runner/config.toml --working-directory /home/jogger --service gitlab-runner --user jogger

When triggering my very first pipeline in this installation, I immediately get the following error:

Preparing the "shell" executor
00:00
Using Shell (bash) executor...
Preparing environment
00:03
Password: su: Authentication failure
ERROR: Job failed: prepare environment: exit status 1. Check https://docs.gitlab.com/runner/shells/#shell-profile-loading for more information

Clearly, my non-privilege account jogger does not have the ability to do su without having to type a password.

Why the need to su?
Which user account is doing the su-ing?
Which user account is it su-ing to?

and…How to fix it?

Here is my config.toml

concurrent = 5
check_interval = 4
shutdown_timeout = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = ". . . "
  url = "https://gitlab.my-company.com"
  id = 116393
  token = "glrt-something-something"
  token_obtained_at = 2026-07-21T18:18:31Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "shell"
  limit = 5
  [runners.cache]
    MaxUploadedArchiveSize = 0
    [runners.cache.s3]
      AssumeRoleMaxConcurrency = 0
    [runners.cache.gcs]
    [runners.cache.azure]
2

I’m not entirely sure, but it seems like the gitlab-runner service itself is run as jogger and then additionally gets the option --user jogger. That argument tells the runner it should execute jobs as that user and to do that, uses su internally? As would be the case for when the runner is run as root.

So maybe, if the service itself is run as jogger simply removing the --user flag might fix it.