netbrain · glennvl · Mar 12, 2026 · Mar 14, 2026 · Mar 14, 2026 · Mar 14, 2026
diff --git a/docs/advanced/nixos.md b/docs/advanced/nixos.md
@@ -72,10 +72,6 @@ environment variables in camelCase:
     wineExperimentalWayland = false;
     # Networking mode for the container ("bridge" is default)
     networking = "bridge";
-    # User ID for running the container (usually your own UID)
-    zwiftUid = "1000";
-    # Group ID for running the container (usually your own GID)
-    zwiftGid = "1000";
     # GPU/device flags override (Docker: "--gpus=all", Podman/CDI: "--device=nvidia.com/gpu=all")
     vgaDeviceFlag = "--device=nvidia.com/gpu=all";
     # Enable debug output and verbose logging if true

diff --git a/docs/configuration/options.md b/docs/configuration/options.md
@@ -80,8 +80,6 @@ These environment variables can be used to alter the execution of the zwift bash
 | [`ZWIFT_NO_GAMEMODE`](#zwift_no_gamemode)                 | `0`                        | If set to `1`, don't run game mode                  |
 | [`WINE_EXPERIMENTAL_WAYLAND`](#wine_experimental_wayland) | `0`                        | If set to `1`, use native Wayland                   |
 | [`NETWORKING`](#networking)                               | `bridge`                   | Sets the type of container networking to use        |
-| [`ZWIFT_UID`](#zwift_uid)                                 | `$(id -u)`                 | Sets the UID that Zwift will run as                 |
-| [`ZWIFT_GID`](#zwift_gid)                                 | `$(id -g)`                 | Sets the GID that Zwift will run as                 |
 | [`VGA_DEVICE_FLAG`](#vga_device_flag)                     |                            | Override container GPU/device flags                 |
 | [`PRIVILEGED_CONTAINER`](#privileged_container)           | `0`                        | If set to `1`, run the container in privileged mode |
 
@@ -659,52 +657,6 @@ Configure how the container connects to the Internet.
 
 ---
 
-### `ZWIFT_UID`
-
-See also [`ZWIFT_GID`](#zwift_gid), [Remap User UID/GID](../../advanced/remap-user-id).
-
-Use this option to launch Zwift from a different user id.
-
-| Item              | Description              |
-|:------------------|:-------------------------|
-| Allowed values    | number                   |
-| Default value     | `$(id -u)`               |
-| Commandline usage | `ZWIFT_UID="1001" zwift` |
-| Config file usage | `ZWIFT_UID="1001"`       |
-
-{: .warning }
-> It is strongly discouraged to use a `ZWIFT_UID` that is different from your user uid. If you decide to do so anyway, know
-> that:
->
-> - It does not work with podman
-> - It does not work with Wayland
-> - Cats and dogs may start living together
-
----
-
-### `ZWIFT_GID`
-
-See also [`ZWIFT_UID`](#zwift_uid), [Remap User UID/GID](../../advanced/remap-user-id).
-
-Use this option to launch Zwift from a different group id.
-
-| Item              | Description              |
-|:------------------|:-------------------------|
-| Allowed values    | number                   |
-| Default value     | `$(id -g)`               |
-| Commandline usage | `ZWIFT_GID="1001" zwift` |
-| Config file usage | `ZWIFT_GID="1001"`       |
-
-{: .warning }
-> It is strongly discouraged to use a `ZWIFT_GID` that is different from your user gid. If you decide to do so anyway, know
-> that:
->
-> - It does not work with podman
-> - It does not work with Wayland
-> - Cats and dogs may start living together
-
----
-
 ### `VGA_DEVICE_FLAG`
 
 See also [Prerequisites for NVIDIA graphics cards][nvidia-prerequisites-href].

diff --git a/flake.nix b/flake.nix
@@ -30,8 +30,6 @@
           zwiftNoGameMode,
           wineExperimentalWayland,
           networking,
-          zwiftUid,
-          zwiftGid,
           vgaDeviceFlag,
           debug,
           verbosity,
@@ -77,8 +75,6 @@
               wineExperimentalWayland != ""
             ) "export WINE_EXPERIMENTAL_WAYLAND=${wineExperimentalWayland}"}
             ${pkgs.lib.optionalString (networking != "") "export NETWORKING='${networking}'"}
-            ${pkgs.lib.optionalString (zwiftUid != "") "export ZWIFT_UID='${zwiftUid}'"}
-            ${pkgs.lib.optionalString (zwiftGid != "") "export ZWIFT_GID='${zwiftGid}'"}
             ${pkgs.lib.optionalString (debug != "") "export DEBUG=${debug}"}
             ${pkgs.lib.optionalString (verbosity != "") "export VERBOSITY='${verbosity}'"}
             ${pkgs.lib.optionalString (vgaDeviceFlag != "") "export VGA_DEVICE_FLAG='${vgaDeviceFlag}'"}
@@ -201,14 +197,6 @@
                 type = str;
                 default = "";
               };
-              zwiftUid = mkOption {
-                type = str;
-                default = "";
-              };
-              zwiftGid = mkOption {
-                type = str;
-                default = "";
-              };
               vgaDeviceFlag = mkOption {
                 type = str;
                 default = "";
@@ -250,8 +238,6 @@
                       zwiftScreenshotsDir
                       zwiftOverrideResolution
                       networking
-                      zwiftUid
-                      zwiftGid
                       vgaDeviceFlag
                       verbosity
                       ;

diff --git a/src/Dockerfile b/src/Dockerfile
@@ -1,4 +1,6 @@
 ARG DEBIAN_VERSION=trixie
+ARG USER_UID=1000
+ARG USER_GID=1000
 
 FROM rust:1.95.0-slim-trixie AS build-runfromprocess
 
@@ -28,6 +30,8 @@ FROM debian:${DEBIAN_VERSION}-slim AS wine-base
 # - 20260125 : webview2 in zwift launcher works
 # - 20240105 : first version used in this Dockerfile
 ARG DEBIAN_VERSION
+ARG USER_UID
+ARG USER_GID
 ARG WINE_BRANCH="devel"
 ARG WINE_VERSION="=9.9~${DEBIAN_VERSION}-1"
 ARG WINETRICKS_VERSION=20260125
@@ -38,7 +42,6 @@ ARG WINETRICKS_CHECKSUM=431f82fc74000e6c864409f1d8fb495d696c03928808e3e8acffc451
 # - cabextract for winetricks
 # - curl used in zwift authentication script
 # - gamemode for freedesktop screensaver inhibit
-# - gosu for invoking scripts in entrypoint
 # - libegl1 and libgl1 for GL library
 # - libvulkan1 for vulkan loader library
 # - procps for pgrep
@@ -52,7 +55,6 @@ RUN dpkg --add-architecture i386 \
         cabextract \
         curl \
         gamemode \
-        gosu \
         libegl1 \
         libgl1 \
         libgamemode0.i386 \
@@ -79,16 +81,27 @@ RUN wget -qO /etc/apt/trusted.gpg.d/winehq.asc https://dl.winehq.org/wine-builds
 # Download winetricks
 ADD --checksum=sha256:${WINETRICKS_CHECKSUM} --chmod=755 https://raw.githubusercontent.com/Winetricks/winetricks/${WINETRICKS_VERSION}/src/winetricks /usr/local/bin/
 
-# Create passwordless user and make nvidia libraries discoverable
-RUN adduser --disabled-password --gecos '' user \
+# Add audio driver config file
+COPY pulse-client.conf /etc/pulse/client.conf
+
+# Various configuration
+# - Create user
+# - Create runtime directory
+# - Update audio driver config file
+# - Make nvidia libraries discoverable
+RUN addgroup --gid ${USER_GID} user \
+ && adduser --uid ${USER_UID} --gid ${USER_GID} --disabled-password --comment '' user \
+ && sed -i "s|/run/user/1000|/run/user/${USER_UID}|g" /etc/pulse/client.conf \
+ && mkdir -p /run/user/${USER_UID} \
+ && chown -R user:user /run/user/${USER_UID} \
  && echo "/usr/local/nvidia/lib" >> /etc/ld.so.conf.d/nvidia.conf \
  && echo "/usr/local/nvidia/lib64" >> /etc/ld.so.conf.d/nvidia.conf
 
-# Required for non-glvnd setups
+# Make nvidia libraries discoverable (Required for non-glvnd setups)
 ENV LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu:/usr/lib/i386-linux-gnu:/usr/local/nvidia/lib:/usr/local/nvidia/lib64
 
-# Configure audio driver
-COPY pulse-client.conf /etc/pulse/client.conf
+# Run as a regular user instead of root
+USER user
 
 FROM wine-base
 

diff --git a/src/build-image.sh b/src/build-image.sh
@@ -65,9 +65,7 @@ readonly XAUTHORITY="${XAUTHORITY:-}"
 
 # Initialize script constants
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" > /dev/null 2>&1 && pwd)"
-ZWIFT_UID="${UID}"
-ZWIFT_GID="$(id -g)"
-readonly SCRIPT_DIR ZWIFT_UID ZWIFT_GID
+readonly SCRIPT_DIR
 
 # Initialize CONTAINER_TOOL: Use podman if available
 msgbox info "Looking for container tool"
@@ -102,6 +100,10 @@ msgbox info "Image will be called ${IMAGE}"
 ###############################
 ##### Basic configuration #####
 
+# Create array for build arguments
+declare -a build_args
+build_args=()
+
 # Create array for container arguments
 declare -a container_args
 container_args=(
@@ -115,14 +117,22 @@ container_args=(
     -e VERBOSITY="${VERBOSITY}"
     -e COLORED_OUTPUT="${COLORED_OUTPUT_SUPPORTED}"
     -e CONTAINER_TOOL="${CONTAINER_TOOL}"
-    -e ZWIFT_UID="${ZWIFT_UID}"
-    -e ZWIFT_GID="${ZWIFT_GID}"
 )
 
+# Initialize user ids
+host_uid="${UID}"
+host_gid="$(id -g)"
 if [[ ${CONTAINER_TOOL} == "podman" ]]; then
     # Podman maps the local user into the container as uid/gid 1000 (the container's user),
     # consistent with zwift.sh. Using the host uid/gid here causes a uid mismatch at runtime.
-    container_args+=(--userns "keep-id:uid=1000,gid=1000")
+    container_uid=1000
+    container_args+=(--userns="keep-id:uid=1000,gid=1000")
+else
+    container_uid="${host_uid}"
+    build_args+=(
+        --build-arg USER_UID="${host_uid}"
+        --build-arg USER_GID="${host_gid}"
+    )
 fi
 
 # Configure window manager
@@ -141,8 +151,8 @@ container_args+=(
 )
 if [[ -n ${XAUTHORITY} ]]; then
     container_args+=(
-        -e XAUTHORITY="${XAUTHORITY}"
-        -v "${XAUTHORITY}:${XAUTHORITY}"
+        -e XAUTHORITY="${XAUTHORITY//${host_uid}/${container_uid}}"
+        -v "${XAUTHORITY}:${XAUTHORITY//${host_uid}/${container_uid}}"
     )
 elif command_exists xhost && xhost +local: > /dev/null; then
     msgbox ok "Container X11 access provided through xhost"
@@ -181,7 +191,7 @@ cleanup() {
 trap cleanup EXIT
 
 msgbox info "Building image ${IMAGE}"
-if ${CONTAINER_TOOL} build --force-rm -t "${BUILD_NAME}" "${SCRIPT_DIR}"; then
+if ${CONTAINER_TOOL} build --force-rm "${build_args[@]}" -t "${BUILD_NAME}" "${SCRIPT_DIR}"; then
     msgbox ok "Successfully built image ${IMAGE}"
 else
     msgbox error "Failed to build image! 😭"