fix(eve): run the sandbox image as its workspace owner

[vercel-gh-bot-3]

The published sandbox image starts commands as root, but /workspace belongs to vercel-sandbox. Git rejects the GitHub channel checkout as dubious ownership, and the turn continues with an empty workspace. Fixes #1596.

Approach

Set the image's default user to vercel-sandbox after the privileged setup completes. Vercel Sandbox runs non-sudo commands as the image's default user, so this aligns the command user with the existing workspace owner. Passwordless sudo remains available for commands that need root access.

Validation

• Reproduced the failure with the checkout's command sequence: git remote add exits 128 when root opens a repository owned by another UID
• Repeated the sequence as the workspace owner: git remote add succeeds
• Ran 51 focused GitHub checkout, Vercel Sandbox, and Docker option tests
• Ran pnpm guard:invariants
• Ran git diff --check

The sandbox does not expose Docker, so I could not build and run the image locally. The pull request's Container Image workflow builds the image for linux/amd64 and linux/arm64.

Requested by: ruiconti

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview	Aug 5, 2026 7:20pm
eve-docs-4759	Ready	Preview, v0	Aug 5, 2026 7:20pm

[github-actions]

Docker Image Size Summary: Dockerfile

Key takeaways

• Image size is unchanged vs main (007cd0f).

Delta vs main (007cd0f)

Metric	Baseline	Current	Delta
Image size	583.31 MB	583.31 MB	0 B

Metadata

• Current: pull request (cf613d2)
• Generated at: 2026-08-05T19:19:27.069Z

[ruiconti]

@!e0 needs repro