ACAP requires root privileges

[Mo3he]

Hi, I am trying to prepare my ACAP for the removal of root privileges but I am not sure how to go about it.
Its a simple ACAP that runs a binary on the camera, using root it works fine but with dynamic user or sdk it throws permission errors as below.
safesocket.Listen: listen unix /var/run/tailscale/tailscaled.sock: bind: permission denied
Tailscale_VPN[10009]: failed to connect to local tailscaled; it doesn't appear to be running (sudo systemctl start tailscaled ?)
here is a link to the acap, https://github.com/Mo3he/Axis_Cam_Tailscale
Any help you can give me would be greatly appreciated.
I have gone through all of the ACAP examples but cannot find a single one that needs root but doesnt use the root user.

How would you for example update the container example which requires root to work without root?
https://github.com/AxisCommunications/acap-native-sdk-examples/tree/main/container-example

[daniel-falk]

@Mo3he Unfortunately there are not a lot of information in the examples regarding running the ACAP as low-privileged. I'm very glad that you have created and is maintaining the VPN application, if you want to I can give you free access to our ACAP derooting course - send me an email at daniel.falk.1@fixedit.ai in that case. We have a lot of information there on how to debug it and examples on both static and dynamic users. I am however afraid that you will not be able to deroot the application since the VPN requires privileges that is not accepted then. The option then is only to use the 2024 LTS which will be supported until 2029. The particular error your posted seems to be that the VPN tries to listen to a port number below 1024 which is not allowed by non-privileged applications. But it looks like you will face issues with the file system too, and probably the use of iptables. In the future, I hope that dynamic users will get more options to enable specific linux capabilities, but as of today that us not supported.