refactoring to run as non-privileged user