install needed packages
add key capabilities
use only one 'run' directory, provide socket path