base: disable apt sandbox.

APT uses a _apt user by default for handling its files in the
filesystem. When ignore_chown_errors is set to True, which collapses the
filesystem's UIDs to a single UID (root's one), any apt command will
fail, since setgroups, setegid and seteuid syscalls will not succeed.

Disable apt sandbox as it is not strictly required inside containers.

base/Dockerfile

@@ -6,6 +6,9 @@ ARG JOBS
 
 ENV DEBIAN_FRONTEND noninteractive
 
+COPY lnls-single-uid.sh /usr/local/bin/lnls-single-uid
+RUN lnls-single-uid
+
 RUN apt update -y && \
     apt install -y --no-install-recommends \
         build-essential \

base/lnls-single-uid.sh

@@ -0,0 +1,6 @@
+#!/bin/sh
+#
+# Configure container filesystem so that single UID restriction is satisfied,
+# making ignore_chown_errors=True storage configuration work properly.
+
+echo "APT::Sandbox::User \"root\";" > /etc/apt/apt.conf.d/90-disable-sandbox.conf