Add aws-user and github-user to CI docker images, drop --user root (#6356)

Fedr · claude · web-flow · commit bab79864f7d2 · 2026-07-02T16:58:04.000+04:00
* add aws-user and github-user to docker images, drop --user root from workflows

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;

* drop container-options matrix plumbing entirely

Co-Authored-By: Claude Fable 5 &lt;noreply@anthropic.com&gt;

---------

Co-authored-by: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/build-test-linux-vcpkg.yml b/.github/workflows/build-test-linux-vcpkg.yml
@@ -41,7 +41,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     container:
       image: meshlib/meshlib-rockylinux8-vcpkg-${{ matrix.arch }}:${{ inputs.docker_image_tag }}
-      options: --user root
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/build-test-ubuntu-arm64.yml b/.github/workflows/build-test-ubuntu-arm64.yml
@@ -37,7 +37,6 @@ jobs:
     runs-on: ubuntu-24.04-arm
     container:
       image: meshlib/meshlib-${{matrix.os}}-arm64:${{inputs.docker_image_tag}}
-      options: --user root
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/build-test-ubuntu-x64.yml b/.github/workflows/build-test-ubuntu-x64.yml
@@ -40,7 +40,6 @@ jobs:
     runs-on: [ubuntu-latest]
     container:
       image: meshlib/meshlib-${{matrix.os}}:${{inputs.docker_image_tag}}
-      options: --user root
     strategy:
       fail-fast: false
       matrix: ${{ fromJSON( inputs.config_matrix ) }}
diff --git a/.github/workflows/generate-c-bindings.yml b/.github/workflows/generate-c-bindings.yml
@@ -19,7 +19,6 @@ jobs:
       contents: read  # This is required for actions/checkout
     container:
       image: meshlib/meshlib-emscripten-generate-c-bindings-arm64:${{inputs.docker_image_tag}}
-      options: --user root
 
     steps:
       - name: Checkout
diff --git a/.github/workflows/pip-build.yml b/.github/workflows/pip-build.yml
@@ -77,13 +77,11 @@ jobs:
             - extend:
                 - platform: x86_64
                   os: rockylinux8-vcpkg-x64
-                  container-options: "--user root"
                   runner: ubuntu-latest
                   compiler: /usr/bin/clang++
                   container-prefix: ""
                 - platform: aarch64
                   os: rockylinux8-vcpkg-arm64
-                  container-options: " "
                   runner: ubuntu-24.04-arm
                   compiler: /usr/bin/clang++
                   container-prefix: arm64v8/
@@ -112,12 +110,10 @@ jobs:
           rules: |
             - extend:
                 - platform: x86_64
-                  container-options: "--user root"
                   runner: ubuntu-latest
                   compiler: /usr/bin/clang++
                   container-prefix: ""
                 - platform: aarch64
-                  container-options: " "
                   runner: ubuntu-24.04-arm
                   compiler: /usr/bin/clang++
                   container-prefix: arm64v8/
@@ -159,7 +155,6 @@ jobs:
     runs-on: ${{ matrix.runner }}
     container:
       image: meshlib/meshlib-${{ matrix.os }}:${{ inputs.vcpkg_docker_image_tag || 'latest' }}
-      options: ${{ matrix.container-options }}
     strategy:
       fail-fast: false
       # `include` enumerates the per-platform combos, surviving platforms
@@ -584,7 +579,6 @@ jobs:
     runs-on: ${{ matrix.runner }}
     container:
       image: ${{ matrix.container-prefix }}${{ matrix.os }}
-      options: ${{ matrix.container-options }}
     strategy:
       fail-fast: false
       # `include` is the cartesian product (surviving platforms x
diff --git a/.github/workflows/release-tests.yml b/.github/workflows/release-tests.yml
@@ -23,7 +23,6 @@ jobs:
     runs-on: ${{ matrix.runner }}
     container:
       image: ${{matrix.container-prefix}}${{matrix.os}}
-      options: ${{ matrix.container-options }}
     strategy:
       fail-fast: false
       matrix:
@@ -32,11 +31,9 @@ jobs:
         include:
           - platform: "x86_64"
             runner: ubuntu-latest
-            container-options: "--user root"
             container-prefix: ""
           - platform: "aarch64"
             runner: ubuntu-24.04-arm
-            container-options: " " # empty
             container-prefix: "arm64v8/"
           - os: "ubuntu:20.04"
             py-version: "3.8"
diff --git a/.github/workflows/update-docs-manual.yml b/.github/workflows/update-docs-manual.yml
@@ -15,7 +15,6 @@ jobs:
     runs-on: ubuntu-24.04-arm
     container:
       image: meshlib/meshlib-ubuntu22-arm64:latest
-      options: --user root
     strategy:
       fail-fast: false
     env:
diff --git a/docker/emscripten-build-c-bindingsDockerfile b/docker/emscripten-build-c-bindingsDockerfile
@@ -59,14 +59,8 @@ FROM base
 COPY --from=builder /opt/meshlib-thirdparty/emscripten        /usr/local/lib/emscripten
 COPY --from=builder /opt/meshlib-thirdparty/emscripten-single /usr/local/lib/emscripten-single
 
-# Setup non-root user (use 1001 to play nicely with actions/checkout@v4)
-# https://github.com/actions/checkout/issues/1014
-RUN <<EOF
-    set -e
-    groupadd -g 1001 user
-    useradd -m -u 1001 -g user -s /bin/bash user
-    chmod -R 777 /emsdk/upstream/emscripten/
-EOF
+RUN chmod -R 777 /emsdk/upstream/emscripten/
 
-# Change to non-root privilege
-USER user
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/emscripten-generate-c-bindingsDockerfile b/docker/emscripten-generate-c-bindingsDockerfile
@@ -21,3 +21,7 @@ RUN <<EOF
     apt-get clean
     rm -rf /var/lib/apt/lists/*
 EOF
+
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/emscriptenDockerfile b/docker/emscriptenDockerfile
@@ -65,14 +65,8 @@ COPY --from=builder /opt/meshlib-thirdparty/emscripten        /usr/local/lib/ems
 COPY --from=builder /opt/meshlib-thirdparty/emscripten-single /usr/local/lib/emscripten-single
 COPY --from=builder /opt/meshlib-thirdparty/emscripten-wasm64 /usr/local/lib/emscripten-wasm64
 
-# Setup non-root user (use 1001 to play nicely with actions/checkout@v4)
-# https://github.com/actions/checkout/issues/1014
-RUN <<EOF
-    set -e
-    groupadd -g 1001 user
-    useradd -m -u 1001 -g user -s /bin/bash user
-    chmod -R 777 /emsdk/upstream/emscripten/
-EOF
+RUN chmod -R 777 /emsdk/upstream/emscripten/
 
-# Change to non-root privilege
-USER user
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/rockylinux8-vcpkgDockerfile b/docker/rockylinux8-vcpkgDockerfile
@@ -105,3 +105,7 @@ ENV VCPKG_INSTALLED_DIR=/opt/vcpkg_installed
 
 ARG VCPKG_TRIPLET
 ENV VCPKG_TRIPLET=$VCPKG_TRIPLET
+
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/rockylinux9-vcpkgDockerfile b/docker/rockylinux9-vcpkgDockerfile
@@ -94,3 +94,7 @@ ENV VCPKG_ROOT=/opt/vcpkg
 
 ARG VCPKG_TRIPLET
 ENV VCPKG_TRIPLET=$VCPKG_TRIPLET
+
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/ubuntu22Dockerfile b/docker/ubuntu22Dockerfile
@@ -87,8 +87,6 @@ RUN <<EOF
     ldconfig
 EOF
 
-# Add a new user "actions-runner" with user id 8877
-RUN useradd -u 8877 -m user
-
-# Change to non-root privilege
-USER user
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
diff --git a/docker/ubuntu24Dockerfile b/docker/ubuntu24Dockerfile
@@ -89,8 +89,6 @@ RUN <<EOF
     ldconfig
 EOF
 
-# Add a new user "actions-runner" with user id 8877
-RUN useradd -u 8877 -m user
-
-# Change to non-root privilege
-USER user
+RUN useradd -u 8877 -m aws-user
+RUN useradd -u 1001 -m github-user
+USER github-user
