run container with non-root user