build: set user in container to match service user