Works as Root
It works when you sudo. Why doesn't it work as the real service account?
Your goal is not simply to run one chmod and watch the error disappear. Your goal is to understand how Linux evaluates access for the identity actually doing the work — across every directory in a path, not just the final file — repair the one boundary that's really blocking watchtower, and prove the fix by testing as watchtower itself: showing it can read what it needs, and still cannot write to it or reach a secret it was never meant to see.
Linux doesn't just organize files into a tree — it also keeps track of WHO is trying to reach them, and what that identity is allowed to do, all the way along the path, not just at the final file.
A file existing is not the same question as who may open it
Picture one file, rules.yaml, with two different people trying to open it. Linux never just asks whether the file exists.
It also asks:
- Who is asking? — the identity of the process making the request
- What is that identity allowed to do? — read it, write it, or neither
A Linux machine has more than one kind of user:
- Human accounts —
alex,maya,deploy - Service accounts —
watchtower,nginx,postgres: an application running under its own restricted identity instead of borrowing someone else's
Giving every application unlimited access would make that second list reachable too. A dedicated, deliberately unprivileged account is what keeps a compromised or buggy service contained to the small list it actually needs.
watchtower is a monitoring service with its own dedicated Linux account.
Why not just run watchtower as your own user, or as root, and skip creating a separate account for it?