How to Use run0 in Linux: A Step-by-Step Guide

run0 is a modern alternative to sudo that runs commands as another user (usually root) without a persistent privilege-escalation daemon. It was introduced in systemd v256 and works by asking Polkit for temporary authorization, then spawning a new systemd scope. This guide shows you how to install, configure, and use run0 safely on your Linux system.

What You’ll Need

A Linux distribution with systemd v256 or newer (check with systemd --version).
Polkit (usually installed by default) and the run0 binary, which ships with systemd.
An active login session (run0 does not work over SSH without extra setup).
Basic comfort with the terminal.

Step-by-Step

Check your systemd version – Open a terminal and run systemd --version. If the version is below 256, run0 is not available. On older distributions, you can either update systemd (often risky) or stick with sudo.
Verify run0 is installed – Run which run0 or run0 --version. If not found, ensure systemd is fully installed (some minimal installs omit the binary). On Debian/Ubuntu, you may need to install the systemd package if it was stripped down.
Run a command as root – Simply type run0 followed by the command. For example, run0 whoami will output root. You will be prompted by Polkit to authenticate – enter your user password (not root’s password).
Start an interactive root shell – Run run0 with no command. You’ll get a root shell inside a new scope. Type exit to leave.
Run a command as another user – Use the --user= option: run0 --user=alice whoami. You’ll be asked for your own password, and the command runs as alice.
Change the working directory – By default, run0 starts in the current directory. To start in the target user’s home, use run0 --chdir=/home/alice or --chdir=~ (which expands to the target user’s home).
Pass environment variables – Use --setenv=VAR=value to set a variable for the command. For example, run0 --setenv=EDITOR=nano.
Use run0 with pipes and redirection – Since run0 does not read from stdin by default, you need the --pipe option to pipe data into it. For example: echo "data" | run0 --pipe tee /root/file.
Run graphical applications – To run a GUI app as root, use run0 --machine=host --user=root (or just run0 if you’re on the same seat). You may need to set XAUTHORITY or use --setenv=DISPLAY=:0.
Check what run0 does without running – Use run0 --dry-run to see the exact systemd-run command it would execute, helpful for debugging.

Common Mistakes

Typing the root password – run0 uses Polkit, so you must enter your own user password, not root’s. If you get a “not authorized” error, you’re likely typing the wrong password or your user lacks admin rights.
Expecting stdin to work – run0 closes stdin by default. Commands like run0 cat < file will fail. Use --pipe or redirect inside the command: run0 sh -c 'cat < /etc/shadow'.
Using run0 over SSH – run0 requires an active local session. Over SSH, Polkit often denies permission. Workaround: use machinectl shell or run run0 --machine=host with proper Polkit rules.
Assuming it’s a drop-in sudo replacement – run0 does not support all sudo flags. For example, -u is not the same; use --user=.
Forgetting to use --pipe for pipelines – Even echo hi | run0 cat will hang unless you add --pipe.

Tips

Use run0 --no-ask-password if you have already authenticated and want to skip the prompt (only works briefly).
Set an alias in your shell: alias sudo='run0' to get used to the syntax, but be aware of the differences.
To allow a non-admin user to run specific commands, edit Polkit rules in /etc/polkit-1/rules.d/ – but do this carefully.
Use run0 --scope to run a command in a transient scope, which gives better cgroup accounting – useful for monitoring.
For a root shell that keeps your environment, try run0 --preserve-env (though it may be less secure).

Troubleshooting

“Failed to activate service” or “Not authorized” – This usually means Polkit is not configured to allow your user. Check that you are in the wheel or sudo group (or equivalent). You can test with pkaction to see available actions. If needed, add a Polkit rule to allow your user to run org.freedesktop.systemd1.manage-units.
“Cannot allocate pty” – run0 needs a TTY. If you’re in a script or a non-interactive shell, run with --no-pty (though then you lose interactive features).
run0 hangs when piping – You forgot --pipe. Press Ctrl+C and retry with --pipe.
“Operation not permitted” when using --user – You may need to be root to switch to certain users, or the target user’s shell is restricted. Try run0 --user=alice --shell=/bin/bash.
No output at all – run0 may be waiting for a password prompt that isn’t visible. Run run0 --debug to see verbose logs.

Frequently Asked Questions

Is run0 a replacement for sudo?

It can be for many tasks, but it lacks some sudo features like persistent credential caching and editing the sudoers file. It’s designed to be more secure by not running a daemon.

Does run0 work on Ubuntu or Fedora?

Yes, as long as the systemd version is 256+. Ubuntu 24.10 and Fedora 40+ include it. Older LTS versions may not.

How do I run a command with run0 without being prompted for a password every time?

run0 does not cache credentials like sudo. You can use Polkit rules to allow specific commands without a password, but that’s a security trade-off. Alternatively, use --no-ask-password if you’ve recently authenticated.

Can I use run0 in a script?

Yes, but you need to handle the password prompt. You can use --no-ask-password if Polkit is set to allow, or use a Polkit agent. For non-interactive scripts, consider using systemd-run directly.

What’s the difference between run0 and sudo -i?

sudo -i gives a login shell as root, loading root’s environment. run0 by default keeps your current environment and working directory, unless you use --chdir or --setenv.

Is run0 more secure than sudo?

It reduces the attack surface by not having a long-running daemon with root privileges. However, it relies on Polkit, which has its own complexities. In practice, it’s a solid alternative, but “more secure” depends on your threat model.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →