remove memlock only for daemon subcommand

Signed-off-by: Steffen Vogel <post@steffenvogel.de>

pkg/daemon.go

@@ -18,13 +18,6 @@ import (
 	"go.uber.org/zap/zapio"
 )
 
-func init() {
-	// Disable memlock for loading eBPF programs
-	if err := rlimit.RemoveMemlock(); err != nil {
-		panic(fmt.Errorf("failed to remove memlock: %w", err))
-	}
-}
-
 type Daemon struct {
 	Backend signaling.Backend
 	Client  *wgctrl.Client
@@ -60,6 +53,11 @@ func NewDaemon(cfg *config.Config) (*Daemon, error) {
 		return nil, fmt.Errorf("failed to initialize backend: %w", err)
 	}
 
+	// Disable memlock for loading eBPF programs
+	if err := rlimit.RemoveMemlock(); err != nil {
+		panic(fmt.Errorf("failed to remove memlock: %w", err))
+	}
+
 	// Create Wireguard netlink socket
 	client, err := wgctrl.New()
 	if err != nil {