> It's a bit crude to use a different user per application, but it's effective & robust.

This is how I run services on my home server. Plex runs in a rootless container under user plex for example.