> For the complete documentation index, see [llms.txt](https://docs.cedana.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cedana.ai/cedana-slurm/unprivileged-mode-non-root.md).

# Unprivileged Mode (non-root)

By default, the checkpointing and restoring of a SLURM job is done as root. Root user has all the capabilities required for performing a complete checkpoint/restore of a process. This is often though an issue for SLURM sysadmins depending on the installation site. 

To address this, Cedana supports unprivileged mode, where the checkpointing and restoring are done as the job's user, i.e., the UID of the SLURM job performs the checkpoint and restore. This configuration is useful when the root is demoted for security purposes. For example, NFS with `root_squash` requires unprivileged mode.

To enable unprivileged mode, set `Slurm.Unprivileged` to `true` in the [Cedana Daemon configuration](https://docs.cedana.ai/daemon/get-started/configuration) on all the compute/worker nodes. Otherwise, just do this on each compute/worker node:

```sh
export CEDANA_SLURM_UNPRIVILEGED=true

sudo cedana version --merge-config
```

In addition, the `criu` binary must have the right capabilities set. There are two ways to go about this: 

* `sudo setcap cap_sys_ptrace,cap_checkpoint_restore=eip "$(command -v criu)"` , which sets `cap_sys_ptrace` and `cap_checkpoint_restore` on the criu binary. 
* Setting *only `cap_checkpoint_restore` ,* which would require setting an additional kernel configuration

The recommended configuration is the former.