Custard as non-root

We had to revert 1725da so that we could make custard live work after a deploy.

@morty, would you like to push to `custard-nonroot` as you make further improvements to the nonroot branch?