add --dropprivs if we were run as root