It seems that only the nginx reloader is run via sudo - unless I'm missing something..