See tail of 'yocto-shell' script.

Key information documented here:
    https://docs.podman.io/en/stable/markdown/podman-run.1.html#security-opt-option

Docker equivalent for reference:
    https://docs.docker.com/reference/cli/docker/container/run/#security-opt

Grep for "label=disable" and "seccomp=unconfined"
Might be worth considering "apparmor=unconfined"

Additional info about user namespaces here:
    https://docs.podman.io/en/stable/markdown/podman-run.1.html#userns-mode

If uid/gid is hardcoded within the container, and this is a hard requirement to
avoid host contamination, this might not be that interesting. This demo uses:
    "--userns=keep-id"

however:
    "--user $(id -u):$(id -g)"

is also an option. Given strict requirements, perhaps as 1000:1000 instead of
hardcoding in containerfile, and coerce this in 'entrypoint.sh' at runtime.

Gosu alternative in 100 sloc ansi C:
    https://github.com/ncopa/su-exec