[sebastianst]

Motivation

The image installs contender and anvil into /root/.cargo/bin, and /root is mode 0700. So the image can't run as any user other than root:

$ docker run --rm --user 1000:1000 flashbots/contender --version
docker: Error response from daemon: ... exec: "contender": executable file not found in $PATH

Containers therefore have to run as root, and on Linux every file contender writes into a mounted data dir comes out root-owned on the host. We hit this in Kupcake, which runs every other service as the host user.

Solution

• Install the binaries into /usr/local/bin and drop the PATH override.
• Drop mkdir -p /root/.contender. That's the legacy data dir, and creating it only triggers the migration to ~/.local/state/contender. The comment now points at the current data dir.
• Add a README example for running as the host user with CONTENDER_DATA_DIR.

The default user stays root, so the documented -v …:/root/.local/state/contender mount keeps working.

Tested on a locally built image, running as --user $(id -u):$(id -g) --cap-drop ALL: anvil, contender spam … transfers and contender report all ran, and every file in the data dir was owned by the host user.

PR Checklist

• Added Tests: n/a, Dockerfile only
• Added Documentation
• Ran cargo +nightly clippy …: n/a, no Rust changes
• Ran cargo fmt --all: n/a
• Note breaking changes in PR description, if applicable: none, unless something calls /root/.cargo/bin/contender by its full path
• update changelogs: none of the crate changelogs cover the image

🤖 Co-created with Claude Opus 5.5