Build and push rootless docker container

[cgdolan]

PR checklist:

• Purpose of the code is evident to future readers
• Tests included or PR comment includes a reproducible test plan
• Documentation is up-to-date
• A changelog entry was added to changelog.d for any user-facing change
• Change has no security implications (otherwise, ping security team)

If you're unsure about any of this, please see:

• Contribution guidelines!
• One of the more specific guides located here

[github-actions]

🚫 The whole benchmark suite is too slow: +9.3% (+1.093 s)

14 benchmarks, 9.3% slower on average.

Individual deviations greater than 20% from the baseline are reported. An individual performance degradation of over 30% or a global degradation of over 7% is an error and will block the pull request. See run output for full results ('Show all checks' > 'Tests / semgrep benchmark tests' 'Details').

[github-actions]

🚫 The whole benchmark suite is too slow: +9.0% (+1.090 s)

14 benchmarks, 9.0% slower on average.

Individual deviations greater than 20% from the baseline are reported. An individual performance degradation of over 30% or a global degradation of over 7% is an error and will block the pull request. See run output for full results ('Show all checks' > 'Tests / semgrep benchmark tests' 'Details').

[github-actions]

🚫 The whole benchmark suite is too slow: +7.4% (+1.074 s)

14 benchmarks, 7.4% slower on average.

Individual deviations greater than 20% from the baseline are reported. An individual performance degradation of over 30% or a global degradation of over 7% is an error and will block the pull request. See run output for full results ('Show all checks' > 'Tests / semgrep benchmark tests' 'Details').

[aryx]

Thanks.
Why do we need this though? Was it impossible to make it rootless by default, so we don't need to build 2 images each time? Could you add a comment maybe in the Dockerfile next to the rootless target about why we provide 2 images (I guess it's easier for some customers, but would be nice to have some scenario in which the root one is needed and using the rootless would make too many customers suddently fail or something.

[cgdolan]

Sure, added a comment in the new nonroot docker stage explaining why we can't just make this the default.

[github-actions]

🚫 The whole benchmark suite is too slow: +7.6% (+1.076 s)

14 benchmarks, 7.6% slower on average.

Individual deviations greater than 20% from the baseline are reported. An individual performance degradation of over 30% or a global degradation of over 7% is an error and will block the pull request. See run output for full results ('Show all checks' > 'Tests / semgrep benchmark tests' 'Details').

[gedigi]

Please note just above your change that USER semgrep was disabled because of issues with CircleCI (and GitHub Actions.)

See:

• Open issue: Experiencing permission denied after v3.1.0 on jobContainers when container user is not 'root' actions/checkout#956
• Failed GitHub Actions run: https://github.com/aptos-labs/aptos-core/actions/runs/6054718321/job/16432581065

[aryx]

reverting this diff @gedigi. Should be fixed in 1.38.3 later today.