specify shell in runuser command to work even if $KAFKA_USER uses nologin