Normally tmpfiles.d will handle this at boot time, but if you install lorax-composer without rebooting it was ending up with root:root ownership instead of root:weldr (cherry picked from commit 7adc5162fb)
7adc5162fb
Instead of enabling lorax-composer.service enable lorax-composer.socket and it will start lorax-composer on first access to /run/weldr/api.socket