fix: run testbed image as root to support bind-mounted /flags

[toddbaert]

The non-root change in #381 (v3.8.1) breaks consumers that bind-mount a host /flags dir: launchpad runs as testbed and cannot write allFlags.json into the root-owned mount, so the container exits 1 (surfaced in flagd's e2e). Reverting to root; the busybox-root Sonar hotspot should be marked Safe since this is a test fixture that must write to consumer-provided bind mounts of arbitrary ownership.

[coderabbitai]

Warning

Review limit reached

@toddbaert, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 55 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8367bf59-1bf2-475c-9ec5-f7b6afbf5269

📥 Commits

Reviewing files that changed from the base of the PR and between d0c714b and 5c5f596.

📒 Files selected for processing (1)

• flagd/Dockerfile

📝 Walkthrough

Walkthrough

The testbed Docker image no longer creates a non-root user or changes directory ownership. It intentionally runs as root so launchpad-generated flag configurations can be written to /flags when host-mounted directories have arbitrary ownership.

Changes

Testbed container execution

Layer / File(s)	Summary
Retain root execution for generated configurations flagd/Dockerfile	Removes testbed user creation, recursive ownership changes, and the USER testbed directive; comments document the intentional root-only test behavior.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly states the root-behavior change and its bind-mounted /flags purpose.
Description check	✅ Passed	The description directly explains the permission issue and the root revert in the testbed image.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}