RFE: dockerfiles: use non-root runtime user for safer container usage

[cuiyingd]

Summary

The Dockerfiles under the dockerfiles directory currently run containers as _root by default. Any container without an explicit USER instruction will run as root. Running dexbotic containers as root introduces security risks, making it unsuitable for shared GPU clusters, production deployments and CI environments. Files created on mounted host volumes will be owned by root, which causes permission issues.

Proposed Change

Add a dedicated non-root user and group (e.g. dexbotic) in the Dockerfiles.
Set proper ownership for relevant directories including /opt/dexbotic and /opt/rlinf.
Insert the USER dexbotic directive before CMD or ENTRYPOINT.
Retain root privileges only for build-time installation steps.

Example:
dockerfile
RUN groupadd -r dexbotic && useradd -r -g dexbotic -m dexbotic
RUN chown -R dexbotic:dexbotic /opt/dexbotic /opt/rlinf
USER dexbotic

[cuiyingd]

Let’s get the maintainer to review the RFE first to ack the requirements, and I’ll fix the issue afterward. Thanks.

[hbzfeng]

Thanks for the suggestion. We do not recommend making a non-root user the default in the upstream Dockerfiles unless it has been thoroughly tested across the full training, evaluation, checkpointing, cache, and volume-mount workflows.

Dexbotic images are mainly used as development/training environments, where users often need to install extra packages, compile dependencies, and write to shared cache/checkpoint directories. A fixed non-root user may also introduce UID/GID mismatches on different clusters.

For stricter security requirements, we recommend applying a site-specific user policy, e.g. running with --user $(id -u):$(id -g) or deriving a custom image.