When enabled, the stargazer process will be given CAP_SETGID and CAP_SETUID so that it can run cgi processes as a different user. This is required if the cgi-user option is used for a route. Note that these capabilities could allow privilege escalation so be careful. For that reason, this is disabled by default.
You will need to create the user mentioned cgi-user if it does not already exist.