Merge "derive_sdk: run as nobody"