The service does not connect to the linux server directly. The server runs an agent that connects to the service. You do not run the agent as root. You can give

The service does not connect to the linux server directly. The server runs an agent that connects to the service. You do not run the agent as root. You can give the agent sudoers access but only if you want to do deployments where sudo is required. Most apps do not require sudo so you don't have to give the agent sudo access. You also do not give distelli access to your code or package . Your code is uploaded to your S3 bucket directly from your laptop or dev machine and the service merely gets a bucket name and s3 key which it passes to the agent.