Hello,

it does not need to run as a root user, but running it as one makes things more easy. You can make a user for the node process that has only access to certain things and certain paths