vc: run in fork mode (privsep)