Create separate tcuser account so child images aren't artificially
coupled to the version number and to deny write access to directories
outside of CATALINA_BASE.