diff --git a/ansible/roles/rabbitmq/templates/rabbitmq.json.j2 b/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
index 1f0d48a671..264c96fde0 100644
--- a/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
+++ b/ansible/roles/rabbitmq/templates/rabbitmq.json.j2
@@ -1,5 +1,5 @@
 {
-    "command": "/usr/sbin/rabbitmq-server",
+    "command": "sudo -H -u rabbitmq /usr/sbin/rabbitmq-server",
     "config_files": [
         {
             "source": "{{ container_config_directory }}/rabbitmq-env.conf",
diff --git a/docker/ceilometer/ceilometer-api/extend_start.sh b/docker/ceilometer/ceilometer-api/extend_start.sh
index afe612ae69..5e38e555d1 100644
--- a/docker/ceilometer/ceilometer-api/extend_start.sh
+++ b/docker/ceilometer/ceilometer-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "ceilometer-manage db_sync" ceilometer
+    sudo -H -u ceilometer ceilometer-manage db_sync
     exit 0
 fi
diff --git a/docker/cinder/cinder-api/extend_start.sh b/docker/cinder/cinder-api/extend_start.sh
index 9cf68ae868..e9a38ac0f5 100644
--- a/docker/cinder/cinder-api/extend_start.sh
+++ b/docker/cinder/cinder-api/extend_start.sh
@@ -4,6 +4,6 @@ set -o errexit
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "cinder-manage db sync" cinder
+    sudo -H -u cinder cinder-manage db sync
     exit 0
 fi
diff --git a/docker/designate/designate-api/extend_start.sh b/docker/designate/designate-api/extend_start.sh
index 8fda9197b3..f851d894ae 100644
--- a/docker/designate/designate-api/extend_start.sh
+++ b/docker/designate/designate-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "designate-manage db_sync" designate
+    sudo -H -u designate designate-manage db_sync
     exit 0
 fi
diff --git a/docker/glance/glance-api/extend_start.sh b/docker/glance/glance-api/extend_start.sh
index eebee43e49..fd70962ebd 100644
--- a/docker/glance/glance-api/extend_start.sh
+++ b/docker/glance/glance-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "glance-manage db_sync" glance
+    sudo -H -u glance glance-manage db_sync
     exit 0
 fi
diff --git a/docker/gnocchi/gnocchi-api/extend_start.sh b/docker/gnocchi/gnocchi-api/extend_start.sh
index 8ca5d73881..344c3063f2 100644
--- a/docker/gnocchi/gnocchi-api/extend_start.sh
+++ b/docker/gnocchi/gnocchi-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "gnocchi-manage db_sync" gnocchi
+    sudo -H -u gnocchi gnocchi-manage db_sync
     exit 0
 fi
diff --git a/docker/heat/heat-api/extend_start.sh b/docker/heat/heat-api/extend_start.sh
index 17bd742e34..f04438a789 100644
--- a/docker/heat/heat-api/extend_start.sh
+++ b/docker/heat/heat-api/extend_start.sh
@@ -3,7 +3,7 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "heat-manage db_sync" heat
+    sudo -H -u heat heat-manage db_sync
     openstack domain create heat_user_domain
     openstack user create --domain heat_user_domain heat_domain_admin --password ${HEAT_DOMAIN_ADMIN_PASSWORD}
     openstack role add --domain heat_user_domain --user heat_domain_admin admin
diff --git a/docker/ironic/ironic-api/extend_start.sh b/docker/ironic/ironic-api/extend_start.sh
index bbbe5c7e1f..b7ef2b242b 100644
--- a/docker/ironic/ironic-api/extend_start.sh
+++ b/docker/ironic/ironic-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "ironic-dbsync upgrade" ironic
+    sudo -H -u ironic ironic-dbsync upgrade
     exit 0
 fi
diff --git a/docker/keystone/extend_start.sh b/docker/keystone/extend_start.sh
index 9bd9d53708..b1a6d334b2 100644
--- a/docker/keystone/extend_start.sh
+++ b/docker/keystone/extend_start.sh
@@ -9,7 +9,7 @@ fi
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "keystone-manage db_sync" keystone
+    sudo -H -u keystone keystone-manage db_sync
     # Start the api to set initial endpoint and users with the admin_token
     $CMD
     sleep 5
diff --git a/docker/magnum/magnum-api/extend_start.sh b/docker/magnum/magnum-api/extend_start.sh
index fae3941851..c193a0a9a0 100644
--- a/docker/magnum/magnum-api/extend_start.sh
+++ b/docker/magnum/magnum-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "magnum-manage db_sync" magnum
+    sudo -H -u magnum magnum-manage db_sync
     exit 0
 fi
diff --git a/docker/murano/murano-api/extend_start.sh b/docker/murano/murano-api/extend_start.sh
index 578cc72cbe..4ca50b6c92 100644
--- a/docker/murano/murano-api/extend_start.sh
+++ b/docker/murano/murano-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "murano-db-manage --config-file /etc/murano/murano.conf upgrade" murano
+    sudo -H -u murano murano-db-manage --config-file /etc/murano/murano.conf upgrade
     exit 0
 fi
diff --git a/docker/neutron/neutron-server/extend_start.sh b/docker/neutron/neutron-server/extend_start.sh
index c832d586d4..d60829f10c 100644
--- a/docker/neutron/neutron-server/extend_start.sh
+++ b/docker/neutron/neutron-server/extend_start.sh
@@ -3,7 +3,7 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/bash -c "neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron
+    sudo -H -u neutron neutron-db-manage --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head
     exit 0
 fi
 
diff --git a/docker/nova/nova-api/extend_start.sh b/docker/nova/nova-api/extend_start.sh
index 2aaad1e8b4..9b0e9d7462 100644
--- a/docker/nova/nova-api/extend_start.sh
+++ b/docker/nova/nova-api/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "nova-manage db sync" nova
+    sudo -H -u nova nova-manage db sync
     exit 0
 fi
diff --git a/docker/zaqar/extend_start.sh b/docker/zaqar/extend_start.sh
index d71b02aab6..ec128144a4 100644
--- a/docker/zaqar/extend_start.sh
+++ b/docker/zaqar/extend_start.sh
@@ -3,6 +3,6 @@
 # Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
 # of the KOLLA_BOOTSTRAP variable being set, including empty.
 if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
-    su -s /bin/sh -c "zaqar-manage db_sync" cinder
+    sudo -H -u zaqar zaqar-manage db_sync
     exit 0
 fi