Run containers as non-root user with Docker --user support

[brycelelbach]

Summary

This PR simplifies the development mount setup by removing bindfs and using Docker's native --user flag to match host user permissions on bind mounts.

Changes

New approach

• Containers now run as a non-root ach user (UID 1000) by default
• When HOST_UID/HOST_GID environment variables are set, containers run as that user instead
• All users have passwordless sudo access (ALL ALL=(ALL) NOPASSWD:ALL)
• User environment setup happens automatically via shell initialization

Files modified

New file:

• brev/user-setup.bash - Runtime user environment setup (HOME, Jupyter config, IPython config, Git safe directory)

Simplified:

• brev/dev-mount.bash - Removed bindfs, now just exports HOST_UID/HOST_GID
• brev/dev-start.bash - Removed bindfs mount references
• brev/dev-stop.bash - Removed bindfs unmount logic
• brev/dev-test.bash - Removed cleanup trap and bindfs references

Updated startup scripts:

• brev/jupyter-start.bash - Removed explicit user-setup sourcing (now automatic)
• brev/base-start.bash - Removed explicit user-setup sourcing (now automatic)
• brev/nsight-start.bash - Uses sudo for privileged operations

Updated Dockerfiles (all 5 tutorials):

• Create ach user with UID 1000
• Add passwordless sudo for all users
• Set BASH_ENV for non-interactive shell initialization
• Add shell init to /etc/profile.d/ and /etc/bash.bashrc
• Set default USER to ach

Updated docker-compose.yml (all 5 tutorials):

• Changed user: root to user: "${HOST_UID:-1000}:${HOST_GID:-1000}"

Documentation:

• CONTRIBUTING.md - Removed bindfs references

Benefits

• No more bindfs dependency
• No more sudo required for mount setup
• No cleanup traps needed
• Files created in container have correct host ownership automatically
• Works seamlessly across different host systems

[github-actions]

❌ Link Check Failed

Broken links were detected in this PR.

Please check the workflow run logs for details on which links are broken.

Common fixes:

1. Typo in URL - Check for spelling mistakes in the link
2. Outdated link - The page may have moved or been deleted
3. Relative path issue - Ensure relative links use the correct path
4. External site down - If the external site is temporarily down, you can add it to brev/.lycheeignore

To test links locally:

./brev/test-links.bash .

📚 Lychee documentation