Custom container not running under root account?

A customer wants to enforce these rules in their custom SageMaker containers:

•	Processes running inside a container must run with a known UID/GUID and never as root.
•	Avoid using privilege escalation methods that grant root access (e.g. sudo)

How do we ensure this?