Create root directory with ACL
Add delegate-process that doesn't redirect ports