Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.