Summary

Extend RUN_AS_ROOT from the Chromium user setting to the privilege policy for customer-facing image services.

• Run the API, browser, ChromeDriver, Openbox, Neko, PulseAudio and Xvfb as kernel with no_new_privs. Reject exec/spawn identity overrides in non-root mode.
• Keep Xorg, dbus and Envoy under a separate root-only supervisor. Separate writable service configuration and logs, including across restarts.
• Preserve browser restart, display resize, timezone updates and recording. Allow unprivileged Neko to connect to Xorg's input socket, and check socket connectivity during startup.
• Add regression tests against both images' actual supervisor configurations and document compatibility changes.

Compatibility

RUN_AS_ROOT=false and an unset value now remove root access through the process and filesystem APIs, not just Chromium. RUN_AS_ROOT=true retains root access. Launch-script defaults are unchanged. Use a fresh container or guest when switching modes; root-dependent callers must adapt or explicitly select root mode.

Validation

• Built both public headful and headless Docker images.
• Tested both images in root and non-root modes: exec/spawn identities and overrides, browser restart, display resize, screenshots, PulseAudio, and recordings with audio. Checked the API's root-startup guard and Neko's group-accessible input socket.
• Restarted both non-root containers with a customer-created service named dbus; verified that root configuration stayed unchanged, the injected command did not gain root access, and the API remained unprivileged. Tested with and without tmpfs /run.
• Race-enabled Go tests pass for all non-e2e packages except cmd/shell. Full tests and go vet ./... hit the existing cmd/shell/main.go:160 UUID/string type error, also reproduced on main. Vet passes with that package excluded. A Chromium temporary-directory cleanup failure in lib/devtoolsproxy passed on rerun.
• bash -n passes for the changed scripts; git diff --check passes.
• The full e2e suite, Unikraft deployment and WebRTC video playback were not run.