ioc: disable APT sandbox.

IOC containers do not require multiple users, and thus they are commonly
deployed without subuid and subgid to avoid creating files in volumes
mapped to the host filesystem with a uid/gid not possible to be handled
by its user outside the namespace. However, this breaks APT default
configuration due to its sandbox user `_apt`. Disable its sandbox so
that we can use APT in such deployment environments.

CHANGES.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+### Bug fixes
+
+* ioc: disable APT sandbox. by @henriquesimoes in
+  https://github.com/cnpem/epics-in-docker/69
+  * This allows to use APT in containers deployed in systems without subuid and
+    subgid.
+
 ### New features
 
 * base: update ipmiComm patch to install general templates. by

Dockerfile

@@ -10,6 +10,8 @@ ARG RUNTIME_PACKAGES
 ARG RUNTIME_TAR_PACKAGES
 ARG RUNTIME_PIP_PACKAGES
 
+COPY --from=build-image /etc/apt/apt.conf.d/90-disable-sandbox.conf /etc/apt/apt.conf.d/90-disable-sandbox.conf
+
 RUN apt update -y && \
     apt install -y --no-install-recommends \
         libreadline8 \