I am going to go get new tires for the automobile, so I will add more later, but I've been working a lot with the www-data:root or spot:root model. This way I can have the many packages that will only run as non-root user yet still be able to access as the root user those files at the group level that belong to the user other than root.
Also to note, most of the Puppy Linux installations of Zoneminder do not use root but use the www-data:www-data and mysql:mysql users for the LAMP or LHMP. OR another combination that satisfies ZM preference to operate as any other user rather than root, is to use the built in webuser:webgroup for the web server plus ZM and mysql:mysql for the database server.
Zoneminder is not set up to run well as root since it is mainly controlled from a web console and is built to stream video and receive data from a network. With the APT plugin and the PAM it is even more in-line with ZM's prefrence of running as user www-data, webuser, weedog or daemon
Every Puppy Linux web server I set up does not use root as the primary user for web server connections. Apache and Hiawatha don't like it.