the entrypoint (CMD) script init.sh does an `id -u` of current UID before dropping privs, and will exit as error if not UID 0. will open issue to ask if running as true rootless due to K8s is possible via new envvar ROOTLESS=k8s or something like that