[Python] Why is Gunicorn creating its socket with the wrong group even though the parent...

I'm running Gunicorn under Supervisor as a non-root user (webapps) and trying to create a Unix domain socket at /run/webapps/gunicorn.sock. I want the socket to be group-owned by webapp_sockets so that nginx (running as www-data and added to webapp_sockets) can access it.

I've set up the socket directory like this:

sudo chown webapps:webapp_sockets /run/webapps
sudo chmod 2770 /run/webapps


The directory looks like this:

drwxrws--- webapps webapp_sockets /run/webapps


Gunicorn is started under Supervisor as:

user=webapps


In gunicorn.conf.py:

bind = 'unix:/run/webapps/gunicorn.sock'
pidfile = '/run/webapps/gunicorn.pid'
user = 'webapps'
# umask = 0o007


After a clean start (and deletion of the old .sock), the socket is created like this:

sudo ls -l /run/webapps
total 8
-rw-r--r-- 1 webapps webapp_sockets 7 Apr 22 11:32 celerybeat.pid
-rw-r--r-- 1 webapps webapp_sockets 7 Apr 22 13:46 gunicorn.pid
srwxrwx--- 1 webapps webapps 0 Apr 22 13:46 gunicorn.sock


Even though the directory is setgid (2770), the user webapps is a member of webapp_sockets and the .pid files created in the same dir do have the correct group.

I've also tried specifying the group = 'webapp_sockets' in gunicorn.conf.py however I get the following error:

Exception in worker process
Traceback (most recent call last):
File "/webapps/proj/venv/lib/python3.10/site-packages/gunicorn/arbiter.py", line 589, in spawn_worker
worker.init_process()
File "/webapps/proj/venv/lib/python3.10/site-packages/gunicorn/workers/base.py", line 97, in init_process
util.set_owner_process(self.cfg.uid, self.cfg.gid,
File "/webapps/proj/venv/lib/python3.10/site-packages/gunicorn/util.py", line 146, in set_owner_process
os.setgid(gid)
PermissionError: [Errno 1] Operation not permitted


Currently using Gunicorn 20.1.0

Continue reading...