Python, venv and services

Applies to Debian 12/13, Ubuntu 22.04/24.04, AlmaLinux 9 and Rocky Linux 9. In the end your Python program runs in its own environment as a service, with logs in the journal.

1. Install Python

Python 3 is already on every system. Usually only venv and pip are missing.

Debian and Ubuntu:

apt install -y python3 python3-venv python3-pip

AlmaLinux and Rocky Linux:

dnf install -y python3 python3-pip

Which version you have:

If your program needs a newer version on AlmaLinux or Rocky, install it alongside. python3 stays 3.9 because the system relies on it:

dnf install -y python3.12 python3.12-pip

Then use python3.12 instead of python3 everywhere below.

python3 --version

2. User and folder

useradd --system --create-home --home-dir /opt/pybot --shell /usr/sbin/nologin pybot

Put your code in /opt/pybot/app, via Git or SFTP, and give it to the user:

chown -R pybot:pybot /opt/pybot

3. Virtual environment and pip

A virtual environment (venv) is a folder with its own Python and packages just for this program. Programs don't get in each other's way, and you don't need root for pip.

sudo -u pybot python3 -m venv /opt/pybot/venv
sudo -u pybot /opt/pybot/venv/bin/pip install --upgrade pip
sudo -u pybot /opt/pybot/venv/bin/pip install -r /opt/pybot/app/requirements.txt

Without a requirements.txt, install packages one by one, e.g. …/pip install discord.py.

To work by hand, activate the environment:

source /opt/pybot/venv/bin/activate
python --version
deactivate

4. Secrets in an env file

Tokens and passwords don't belong in your code:

install -d -m 0750 /etc/pybot
nano /etc/pybot/pybot.env

DISCORD_TOKEN=your-token

chmod 600 /etc/pybot/pybot.env

In your code:

import os
token = os.environ["DISCORD_TOKEN"]

5. systemd service

nano /etc/systemd/system/pybot.service

[Unit]
Description=Python bot
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=pybot
WorkingDirectory=/opt/pybot/app
EnvironmentFile=/etc/pybot/pybot.env
Environment=PYTHONUNBUFFERED=1
ExecStart=/opt/pybot/venv/bin/python main.py
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target

Replace main.py with your entry file. PYTHONUNBUFFERED=1 makes print() output reach the journal right away instead of later.

systemctl daemon-reload
systemctl enable --now pybot

Run a script on a schedule

For a script that doesn't run permanently but, say, hourly, use a timer instead of Restart. In the service, set Type=oneshot and drop the Restart lines and the [Install] section, then:

nano /etc/systemd/system/pybot.timer

[Unit]
Description=Python script hourly

[Timer]
OnCalendar=hourly
Persistent=true

[Install]
WantedBy=timers.target

systemctl daemon-reload
systemctl enable --now pybot.timer
systemctl list-timers pybot.timer

Check that it runs

systemctl status pybot
journalctl -u pybot -f

active (running) and your output in the journal. Ctrl+C only stops the display.

Updating

cd /opt/pybot/app
sudo -u pybot git pull
sudo -u pybot /opt/pybot/venv/bin/pip install -r requirements.txt
systemctl restart pybot

After upgrading the distribution to a new Python version (e.g. Debian 12 to 13), recreate the venv: delete the folder and repeat step 3.

Common errors

What next

• Secure your server.
• Several services with a database: Docker.
• Help: ticket.