I've just finished setting up supervisor to run my gunicorn instances and I was wondering if there is a default way to let a regular user run supervisorctl to start/stop the websites. I was thinking of adding some sudo config that would enable this user to run it but then I think it might open some loophole through which an intruder could run stuff as root. I know I can set user=someuser on the [supervisord] config section, but then I'd have to give permission to that user for files all over the filesystem, for logs, socket creation, etc. That would be a problem because the standard ubuntu package deploy assumes supervisor will be run as root.
So which one is better, or is there another alternative?