nginx usually needs to start as root, in order to bind low-numbered ports, but the worker processes run as non-root. Sandstorm works exactly the same way. ngi

nginx usually needs to start as root, in order to bind low-numbered ports, but the worker processes run as non-root. Sandstorm works exactly the same way. nginx can run as completely non-root, if you are OK with high-numbered ports. Sandstorm can too, if you are OK with high-numbered ports and if unprivileged user namespaces are enabled. (It sounds like you actually use UID separation for security on a desktop. That's cool, although keep in mind that if everything is talking to the same X server, then UID separation probably doesn't help much. If you're serious about this approach you should probably be using QubesOS.)