sendmail integration not sending mails when using relay

[onli]

On a linux system, I have a working sendmail system. It relays messages via sendgrid, and this works:

echo "This is a test email" | sendmail -f broker@my.hostname my@email.address

This works under root, and it works under broker. The mail arrives in my inbox.

Now I enable portier to use sendmail, by uncomenting this line in the config.toml:

sendmail_command = "/usr/sbin/sendmail"

The results vary depending under which user the broker now runs. Under broker and dynamic user, I get this:

Mar 08 00:56:13 user portier-broker[2733945]: ERROR  Could not send mail: internal client error: Program mode requires special privileges, e.g., root or TrustedUser.
Mar 08 00:56:13 user portier-broker[2733945]: ERROR  [REF:yjfzmr] Failed to send mail

(note though that the same user was able send mails on the terminal.)

Under root I get this:

Mar 08 00:58:26 user portier-broker[2734685]: ERROR  Could not send mail: internal client error:
Mar 08 00:58:26 user portier-broker[2734685]: ERROR  [REF:g6c76b] Failed to send mail

Might this be a systemd issue? I used the provided systemd service file.

[onli]

Might this be a systemd issue? I used the provided systemd service file.

Yes, it's a systemd issue. When removing these restrictions, portier works now with sendmail:

TemporaryFileSystem=/run
RemoveIPC=yes
CapabilityBoundingSet=
PrivateTmp=yes
PrivateDevices=yes
PrivateUsers=yes
ProtectSystem=strict
ProtectHome=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictAddressFamilies=AF_INET AF_INET6
LockPersonality=yes
NoNewPrivileges=yes
MemoryDenyWriteExecute=yes
RestrictRealtime=yes
RestrictNamespaces=yes
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

We should pinpoint and document which restriction exactly blocks sendmail from working