Hacker News Reader

certbot doesn't need root, it just writes to directories that are usually limited to root by default (`/etc/`, `/var/log/`, `/var/lib/`). And it needs some interaction with the web server to actually complete the challenge.

You can absolutely provide it with alternative paths and configure your web server to forward `/.well-known/acme-challenge/` to a non-root location.

It doesn’t necessarily, people are just conditioned to using root for things that don’t necessarily need it because it’s easier.

I guess I'll just have to run anything that needs root in some sort of container.

certbot copies the file to be served as part of the challenge. It can optionally can modify your nginx config to use the cert once its obtained. I don't see why it needs root to do this, but you'd at least need permissions for it to read/write to the appropriate nginx & server folders.