Workload accounts
The workload_accounts role creates separate locked service identities for AI
Production, AI Testing and CPU-based video encoding. Each identity receives a
stable UID/GID, a non-overlapping subordinate ID range, a private data root, an
administrator-managed rootless Quadlet directory and a persistent systemd user
manager.
Configuration remains owned by root and is readable by the corresponding service group. Workload data and the rootless Podman store belong to the service account. The role verifies that all three Podman stores are rootless and use distinct graph roots.
The two AI accounts receive render as an explicit supplementary-group
baseline; the encoding account receives no GPU group. Hardware discovery and
effective device-access checks belong to amd_gpu_access. This role does not
define containers, networks, schedules or resource limits.