I usually try and make this so, but it is often very hard to impossible. Vendors do not make it easy.
See "Figure 1. Process tree in Volexity Volcano Server from the infected Confluence server"
https://www.volexity.com/wp-content/uploads/2022/06/Figure1....
I didn't mean running as non-root would fix the problem, just that a remote root RCE was worse than a normal RCE.
I thought Atlassian products were well trusted. Is that not the case?
https://confluence.atlassian.com/doc/confluence-security-adv...
Each time, they patch the particular vulnerable script, but they don't seem to have done anything systematic which would eliminate the entire class of vulnerabilities (like, say, adding taint-checking for unquoted, client-supplied content before running code as an OGNL script). So they keep coming up.