build: add non root user for dynamo dockerfiles

container/Dockerfile

@@ -335,23 +335,6 @@ ARG ARCH_ALT
 ENV DYNAMO_HOME=/opt/dynamo \
     CARGO_TARGET_DIR=/opt/dynamo/target
 
-# NIXL environment variables
-ENV NIXL_PREFIX=/opt/nvidia/nvda_nixl \
-    NIXL_LIB_DIR=/opt/nvidia/nvda_nixl/lib/${ARCH_ALT}-linux-gnu \
-    NIXL_PLUGIN_DIR=/opt/nvidia/nvda_nixl/lib/${ARCH_ALT}-linux-gnu/plugins
-ENV LD_LIBRARY_PATH=${NIXL_LIB_DIR}:${NIXL_PLUGIN_DIR}:/usr/local/ucx/lib:/usr/local/ucx/lib/ucx:${LD_LIBRARY_PATH}
-
-# Copy ucx and nixl libs
-COPY --from=wheel_builder /usr/local/ucx/ /usr/local/ucx/
-COPY --from=wheel_builder ${NIXL_PREFIX}/ ${NIXL_PREFIX}/
-COPY --from=wheel_builder /opt/nvidia/nvda_nixl/lib64/. ${NIXL_LIB_DIR}/
-
-# Copy built artifacts
-COPY --from=wheel_builder /opt/dynamo/dist/nixl/ /opt/dynamo/wheelhouse/nixl/
-COPY --from=wheel_builder /opt/dynamo/dist/*.whl /opt/dynamo/wheelhouse/
-COPY --from=wheel_builder $CARGO_TARGET_DIR $CARGO_TARGET_DIR
-COPY --from=wheel_builder $CARGO_HOME $CARGO_HOME
-
 RUN apt-get update -y \
     && apt-get install -y --no-install-recommends \
         # required for AIC perf files
@@ -364,10 +347,19 @@ RUN apt-get update -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
 
+# Create dynamo user
+RUN groupadd dynamo && \
+    useradd -g dynamo -m -s /bin/bash dynamo && \
+    mkdir -p /home/dynamo && \
+    chown -R dynamo:dynamo /opt/dynamo
+
+# Switch to dynamo user
+USER dynamo
+ENV HOME=/home/dynamo
+
 # Create and activate virtual environment
 ARG PYTHON_VERSION
-RUN mkdir -p /opt/dynamo/venv && \
-    uv venv /opt/dynamo/venv --python $PYTHON_VERSION
+RUN uv venv /opt/dynamo/venv --python $PYTHON_VERSION
 
 ENV VIRTUAL_ENV=/opt/dynamo/venv \
     PATH="/opt/dynamo/venv/bin:${PATH}"
@@ -380,7 +372,25 @@ RUN --mount=type=bind,source=./container/deps/requirements.txt,target=/tmp/requi
         --requirement /tmp/requirements.txt \
         --requirement /tmp/requirements.test.txt
 
-COPY benchmarks/ /opt/dynamo/benchmarks/
+# NIXL environment variables
+ENV NIXL_PREFIX=/opt/nvidia/nvda_nixl \
+    NIXL_LIB_DIR=/opt/nvidia/nvda_nixl/lib/${ARCH_ALT}-linux-gnu \
+    NIXL_PLUGIN_DIR=/opt/nvidia/nvda_nixl/lib/${ARCH_ALT}-linux-gnu/plugins
+ENV LD_LIBRARY_PATH=${NIXL_LIB_DIR}:${NIXL_PLUGIN_DIR}:/usr/local/ucx/lib:/usr/local/ucx/lib/ucx:${LD_LIBRARY_PATH}
+
+# Copy ucx and nixl libs
+COPY --chown=dynamo:dynamo --from=wheel_builder /usr/local/ucx/ /usr/local/ucx/
+COPY --chown=dynamo:dynamo --from=wheel_builder ${NIXL_PREFIX}/ ${NIXL_PREFIX}/
+COPY --chown=dynamo:dynamo --from=wheel_builder /opt/nvidia/nvda_nixl/lib64/. ${NIXL_LIB_DIR}/
+
+# Copy built artifacts
+COPY --chown=dynamo:dynamo --from=wheel_builder /opt/dynamo/dist/nixl/ /opt/dynamo/wheelhouse/nixl/
+COPY --chown=dynamo:dynamo --from=wheel_builder /opt/dynamo/dist/*.whl /opt/dynamo/wheelhouse/
+COPY --chown=dynamo:dynamo --from=wheel_builder $CARGO_TARGET_DIR $CARGO_TARGET_DIR
+COPY --chown=dynamo:dynamo --from=wheel_builder $CARGO_HOME $CARGO_HOME
+
+COPY --chown=dynamo:dynamo benchmarks/ /opt/dynamo/benchmarks/
+
 RUN uv pip install \
     /opt/dynamo/wheelhouse/ai_dynamo_runtime*.whl \
     /opt/dynamo/wheelhouse/ai_dynamo*any.whl \
@@ -395,9 +405,9 @@ RUN uv pip install \
 
 # Setup launch banner
 RUN --mount=type=bind,source=./container/launch_message.txt,target=/opt/dynamo/launch_message.txt \
-    sed '/^#\s/d' /opt/dynamo/launch_message.txt > ~/.launch_screen && \
-    echo "cat ~/.launch_screen" >> ~/.bashrc && \
-    echo "source $VIRTUAL_ENV/bin/activate" >> ~/.bashrc
+    sed '/^#\s/d' /opt/dynamo/launch_message.txt > ${HOME}/.launch_screen && \
+    echo "cat ${HOME}/.launch_screen" >> ${HOME}/.bashrc && \
+    echo "source $VIRTUAL_ENV/bin/activate" >> ${HOME}/.bashrc
 
 ENTRYPOINT ["/opt/nvidia/nvidia_entrypoint.sh"]
 CMD []

container/Dockerfile.local_dev

@@ -15,7 +15,7 @@ ARG DEV_BASE=""
 FROM ${DEV_BASE} AS local-dev
 
 # Don't want ubuntu to be editable, just change uid and gid.
-ENV USERNAME=ubuntu
+ENV USERNAME=dynamo
 ARG USER_UID
 ARG USER_GID
 ARG WORKSPACE_DIR=/workspace

container/Dockerfile.sglang

@@ -187,6 +187,15 @@ RUN git clone --depth 1 --branch ${GDRCOPY_COMMIT} https://github.com/NVIDIA/gdr
 # Fix DeepEP IBGDA symlink
 RUN ln -sf /usr/lib/$(uname -m)-linux-gnu/libmlx5.so.1 /usr/lib/$(uname -m)-linux-gnu/libmlx5.so
 
+# Create dynamo user EARLY - before copying files
+RUN groupadd dynamo && \
+    useradd -g dynamo -m -s /bin/bash dynamo && \
+    mkdir -p /workspace && \
+    chown -R dynamo:dynamo /sgl-workspace /workspace
+
+USER dynamo
+ENV HOME=/home/dynamo
+
 # Install SGLang (requires CUDA 12.8.1 or 12.9.1)
 RUN python3 -m pip install --no-cache-dir --ignore-installed pip==25.3 setuptools==80.9.0 wheel==0.45.1 html5lib==1.1 six==1.17.0 \
     && git clone --depth 1 --branch v${SGLANG_COMMIT} https://github.com/sgl-project/sglang.git \
@@ -202,7 +211,7 @@ RUN python3 -m pip install --no-cache-dir --ignore-installed pip==25.3 setuptool
     && FLASHINFER_LOGGING_LEVEL=warning python3 -m flashinfer --download-cubin
 
 # Download and extract NVSHMEM source, clone DeepEP (use Tom's fork for GB200)
-RUN --mount=type=cache,target=/var/cache/curl \
+RUN --mount=type=cache,target=/var/cache/curl,uid=1001,gid=1001 \
     curl --retry 3 --retry-delay 2 -fsSL -o /var/cache/curl/nvshmem_src_cuda12-all-all-${NVSHMEM_VERSION}.tar.gz https://developer.download.nvidia.com/compute/redist/nvshmem/${NVSHMEM_VERSION}/source/nvshmem_src_cuda12-all-all-${NVSHMEM_VERSION}.tar.gz \
     && tar -xf /var/cache/curl/nvshmem_src_cuda12-all-all-${NVSHMEM_VERSION}.tar.gz \
     && mv nvshmem_src nvshmem \
@@ -345,40 +354,42 @@ COPY --from=dynamo_base /usr/bin/nats-server /usr/bin/nats-server
 COPY --from=dynamo_base /usr/local/bin/etcd/ /usr/local/bin/etcd/
 COPY --from=dynamo_base /usr/local/ucx /usr/local/ucx
 COPY --from=dynamo_base $NIXL_PREFIX $NIXL_PREFIX
-ENV PATH=/usr/local/bin/etcd/:/usr/local/cuda/nvvm/bin:$PATH
+ENV PATH=/usr/local/bin/etcd/:/usr/local/cuda/nvvm/bin:${HOME}/.local/bin:$PATH
 
 # Install Dynamo wheels from dynamo_base wheelhouse
-COPY benchmarks/ /opt/dynamo/benchmarks/
-COPY --from=dynamo_base /opt/dynamo/wheelhouse/ /opt/dynamo/wheelhouse/
-RUN pip install \
+COPY --chown=dynamo:dynamo benchmarks/ /opt/dynamo/benchmarks/
+COPY --chown=dynamo:dynamo --from=dynamo_base /opt/dynamo/wheelhouse/ /opt/dynamo/wheelhouse/
+RUN python3 -m pip install \
     /opt/dynamo/wheelhouse/ai_dynamo_runtime*.whl \
     /opt/dynamo/wheelhouse/ai_dynamo*any.whl \
     /opt/dynamo/wheelhouse/nixl/nixl*.whl \
     && cd /opt/dynamo/benchmarks \
-    && pip install --no-cache . \
+    && python3 -m pip install --no-cache . \
     && cd - \
     && rm -rf /opt/dynamo/benchmarks
 
 # Install common and test dependencies
 RUN --mount=type=bind,source=./container/deps/requirements.txt,target=/tmp/requirements.txt \
     --mount=type=bind,source=./container/deps/requirements.test.txt,target=/tmp/requirements.test.txt \
-    pip install \
+    python3 -m pip install \
         --no-cache \
         --requirement /tmp/requirements.txt \
         --requirement /tmp/requirements.test.txt
 
-## Copy attribution files and launch banner
-COPY ATTRIBUTION* LICENSE /workspace/
-COPY container/launch_message.txt /workspace/launch_message.txt
-RUN sed '/^#\s/d' /workspace/launch_message.txt > ~/.launch_screen && \
-    echo "cat ~/.launch_screen" >> ~/.bashrc
+## Copy attribution files and launch banner with correct ownership
+COPY --chown=dynamo:dynamo ATTRIBUTION* LICENSE /workspace/
+COPY --chown=dynamo:dynamo container/launch_message.txt /workspace/launch_message.txt
+
+# Setup launch banner for dynamo user
+RUN sed '/^#\s/d' /workspace/launch_message.txt > ${HOME}/.launch_screen && \
+    echo "cat ${HOME}/.launch_screen" >> ${HOME}/.bashrc
 
-# Copy tests, benchmarks, deploy and components for CI
-COPY tests /workspace/tests
-COPY examples /workspace/examples
-COPY benchmarks /workspace/benchmarks
-COPY deploy /workspace/deploy
-COPY components/ /workspace/components/
+# Copy tests, benchmarks, deploy and components for CI with correct ownership
+COPY --chown=dynamo:dynamo tests /workspace/tests
+COPY --chown=dynamo:dynamo examples /workspace/examples
+COPY --chown=dynamo:dynamo benchmarks /workspace/benchmarks
+COPY --chown=dynamo:dynamo deploy /workspace/deploy
+COPY --chown=dynamo:dynamo components/ /workspace/components/
 
 ENTRYPOINT ["/opt/nvidia/nvidia_entrypoint.sh"]
 CMD []
@@ -412,6 +423,7 @@ RUN mkdir -p /opt/dynamo/venv && \
 ENV VIRTUAL_ENV=/opt/dynamo/venv \
     PATH="/opt/dynamo/venv/bin:${PATH}"
 
+USER root
 # Install development tools and utilities
 RUN apt-get update -y && \
     apt-get install -y --no-install-recommends  \
@@ -467,12 +479,14 @@ RUN curl --retry 3 --retry-delay 2 -LSso /usr/local/bin/clang-format https://git
     && cp -r clangd_18.1.3/lib/* /usr/local/lib/ \
     && rm -rf clangd_18.1.3 clangd.zip
 
+USER dynamo
+
 # Editable install of dynamo
-COPY pyproject.toml README.md hatch_build.py /workspace/
-RUN pip install --no-deps -e .
+COPY --chown=dynamo:dynamo pyproject.toml README.md hatch_build.py /workspace/
+RUN python3 -m pip install --no-deps -e .
 
 # Install Python development packages
-RUN pip install --no-cache-dir \
+RUN python3 -m pip install --no-cache-dir \
     maturin[patchelf] \
     pytest \
     black \