run as user srclib in Docker, not root