chef runs as root, ftw