[anfimovdm]

Summary

alts-celery fails to start on the s390x node (SELinux enforcing):

alts-celery.service: Failed to locate executable /home/test-system/.venv-celery/bin/celery: Permission denied
alts-celery.service: Main process exited, code=exited, status=203/EXEC

This is the same failure fixed for Flower in efb35a3: systemd won't execute a binary from a venv in the user's home directory directly under SELinux. alts-scheduler and alts-flower already start through /bin/sh -c 'exec ...'; alts-celery was the remaining unit that didn't. It likely surfaced now because the update tag (85bbd04) re-runs the pip install, which rewrites bin/celery with the default home-directory label (not confirmed on the host).

Changes

• deployment/templates/alts-celery.service.j2: wrap ExecStart in /bin/sh -c 'exec ...'. With exec, celery replaces the shell and stays the unit's main process. ExecStartPre is unchanged.

Testing

• Rendered the template with the s390x node's values (docker-s390x-0 queue, /home/test-system/.venv-celery) and ran systemd-analyze verify on it: no errors.
• Not yet verified on the host. After merge, re-run celery_playbook.yml with --tags update on the s390x node and check systemctl status alts-celery.

🤖 Generated with Claude Code