The user inside the instructlab container is root. To make the container truly rootless, it should be an unprivileged user. This impacts the ilab wrapper script that needs to set the user mapping according to the change.