The NVIDIA Isaac Sim base image declares no USER directive and defaults
to root, so the explicit USER root in this Dockerfile is a no-op
declaration. Removing it aligns Dockerfile.curobo with the upstream
NVIDIA Isaac Sim Dockerfile and with the other Isaac Lab Dockerfiles
(Dockerfile.ros2, Dockerfile.installci) which omit the directive.

Build and runtime behavior are unchanged: the container still runs as
root via the base image default.

…ile.curobo

The base image (nvcr.io/nvidian/isaac-sim:latest-develop) ends with
USER isaac-sim (uid 1234). Previously the Dockerfile switched back to
root for the entire build and left runtime as root via
OMNI_KIT_ALLOW_ROOT. Removing the initial USER root broke CI because
apt needs root; simply restoring it keeps us as root the whole way
which is what we want to avoid.

Correct pattern applied here:

  * Explicit USER root for the system-level setup block (apt, cuda
    repo, /bin/nvidia-* placeholders, /root cache dirs, get-pip
    bootstrap, COPYed source files).
  * After the last root-required step, chown only the paths we are
    about to write to from the non-root user
    (${ISAACLAB_PATH}, site-packages, ${DOCKER_USER_HOME}) to
    isaac-sim:isaac-sim. /isaac-sim itself is already isaac-sim-owned
    from the base image, so re-chowning it would needlessly bloat
    the layer.
  * USER isaac-sim before the editable pip installs
    (isaaclab.sh --install, cuRobo, isaaclab_teleop) and the bashrc
    writes, so those paths end up owned by the runtime user.
  * BuildKit cache mount at ${DOCKER_USER_HOME}/.cache/pip pinned to
    uid=1234,gid=1234, otherwise it would default to root-owned and
    isaac-sim could not write into it.
  * Final COPY annotated with --chown=isaac-sim:isaac-sim for
    consistency.

This keeps CI build args (DOCKER_USER_HOME_ARG=/root) and
docker-compose paths unchanged, so docker-compose usage continues to
work with OMNI_KIT_ALLOW_ROOT. Dockerfile.base and Dockerfile.ros2
follow the same legacy pattern and are out of scope for this PR.

… compat

The previous attempt switched to the base image's isaac-sim user (uid 1234),
which broke the test step in CI: the test runner bind-mounts the host
workspace (/opt/github-runner/_work/.../IsaacLab, owned by uid 1000) over
/workspace/isaaclab, overlaying our build-time chown. As uid 1234, the
container could not write to the bind mount and `mkdir tests` failed before
pytest even started.

Fix: create a fresh isaaclab user with uid 1000 to match the runner host
user, instead of remapping isaac-sim. Creating a new user (rather than
remapping isaac-sim's UID) avoids triggering an OverlayFS copy-up of the
multi-GB Isaac Sim install in /isaac-sim, which would otherwise become
orphan-owned. /isaac-sim stays mode 755 and isaac-sim-owned, so isaaclab
can still read and execute everything there. Only the paths the new user
needs to write to (${ISAACLAB_PATH}, kit site-packages, ${DOCKER_USER_HOME},
/home/isaaclab) are chowned.

Also bumps the BuildKit pip cache mount uid/gid from 1234 to 1000 (numeric
form is required because BuildKit does not consult /etc/passwd at mount
time) and switches the final COPY --chown to isaaclab.

Caveat: hardcodes uid 1000, matching the typical EC2 self-hosted runner
user. If a runner is reconfigured to a different uid this will break the
same way; in that case the right next step is to parameterize via build
arg, but until then 1000 is the simplest correct value.

`useradd --non-unique --uid 1000` only relaxes the UID uniqueness check;
it does not help with the implicit groupadd that useradd runs internally
to create the user's primary group. On base image revisions that already
carry a group at gid 1000 (likely whenever a uid-1000 user also exists),
that internal groupadd either fails outright or silently picks a different
gid like 1001, leaving the BuildKit pip cache mount's `gid=1000` mismatched
against the user's primary group.

Fix: explicitly groupadd the isaaclab group with --non-unique --gid 1000
before useradd, and pass --gid 1000 to useradd so it reuses the new group
as the user's primary group instead of auto-creating a per-user group.
This deterministically lands isaaclab at uid 1000 / gid 1000 regardless of
collisions in the base image.

The previous chown only covered the python site-packages directory, but
pip also installs console_scripts and other binaries to the embedded
CPython's bin/ directory. The torch install pulls triton, which ships a
`proton` CLI binary that needs to land at
${ISAACSIM_ROOT_PATH}/kit/python/bin/proton -- a directory still owned
by isaac-sim (uid 1234) from the base image, so isaaclab cannot write
there and the editable install fails with EACCES.

Replaces the specific lib/python3.12/site-packages target with the
parent kit/python so chown covers bin/, lib/python3.X/{everything},
include/, share/, and any other subpath pip may write to as transitive
deps land. Drops the hardcoded python3.12 path from this chown step as
a side benefit; the rm-pip and get-pip lines elsewhere in this file
still hardcode 3.12 and are out of scope for this PR.

Layer cost: ~500 MB - 1 GB OverlayFS copy-up of the embedded CPython
tree. Accepted in exchange for not having to chase further pip-write
EACCES failures one transitive dep at a time.