this is https://bugzilla.proxmox.com/show_bug.cgi?id=2582 and not yet implemented, though we are working through the list of root-only things and try to implement them in a way that makes them not require root@pam anymore (e.g., PCI/USB passthrough used to be in this category and now isn't...