I've used Centos more recently and I've run BIND there. In Centos, I've made sure to not run the BIND user as root by adding the option in the /etc/sysconfig/named file, and that was pretty straightforward.
What's the best way to avoid running the BIND user as root on Ubuntu?
You don't need to do anything to run bind as non-root on Ubuntu. It will run
named
as the unprivilegedbind
user by default.