Revert "simplify entrypoint for both root and non-root invocation"

This reverts commit eba24b2.

Signed-off-by: Travis Cotton <trcotton@lanl.gov>

Author: travisbcotton

README.md

@@ -18,6 +18,7 @@ podman run --rm \
   --cap-add=SETGID \
   --security-opt seccomp=unconfined \
   --security-opt label=disable \
+  --userns=keep-id \
   -v /opt/workdir/images/test-rocky-9.5.yaml:/home/builder/config.yaml \
   ghcr.io/openchami/image-build:latest \
   image-build --config config.yaml --log-level DEBUG

entrypoint.sh

@@ -1,9 +1,16 @@
 #!/bin/bash
 set -euo pipefail
 
-# Only su if running as root
-if [[ "$(id -u)" == "0" ]]; then
-  exec su - builder -c "buildah unshare $*"
-else
-  exec buildah unshare "$@"
-fi
+# Only do this if you really need to override inside-container subuid/gid behavior
+# Usually not needed unless you're testing mapping features
+if [[ -w /etc/subuid && -w /etc/subgid ]]; then
+  echo "builder:1001:${USERNS_RANGE:-65536}" > /etc/subuid
+  echo "builder:1001:${USERNS_RANGE:-65536}" > /etc/subgid
+fi
+
+# Make sure builder owns its homedir (optional if baked into image)
+chown -R builder /home/builder || true
+
+# Run buildah directly
+exec buildah unshare "$@"
+