fix: run sandbox image as workspace owner

.github/workflows/docker-image-size-analysis.yml

@@ -81,6 +81,17 @@ jobs:
           size_bytes="$(docker image inspect eve-docker-size:current --format '{{.Size}}')"
           echo "size_bytes=$size_bytes" >> "$GITHUB_OUTPUT"
 
+      - name: Verify sandbox user workspace and sudo permissions
+        run: |
+          docker run --rm eve-docker-size:current bash -lc '
+            set -euo pipefail
+            test "$(id -un)" = vercel-sandbox
+            test "$(stat -c %U /workspace)" = vercel-sandbox
+            git init --quiet /workspace
+            git -C /workspace remote add origin https://github.com/vercel/eve.git
+            sudo -n true
+          '
+
       - name: Generate Docker image size report
         env:
           BASELINE_LABEL: ${{ steps.baseline.outputs.label }}

Dockerfile

@@ -84,4 +84,5 @@ RUN set -eux; \
   printf 'vercel-sandbox ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/vercel-sandbox; \
   chmod 0440 /etc/sudoers.d/vercel-sandbox
 
+USER vercel-sandbox
 WORKDIR /workspace

docs/sandbox.mdx

@@ -100,7 +100,7 @@ export default defineSandbox({
   revalidationKey: () => "repo-bootstrap-v1",
   async bootstrap({ use }) {
     const sandbox = await use();
-    await sandbox.run({ command: "apt-get install -y jq" });
+    await sandbox.run({ command: "sudo apt-get install -y jq" });
   },
   async onSession({ use }) {
     await use({ networkPolicy: "deny-all" });