I'm actually running into this issue right now, in the context of a test that I'm writing. The test needs to copy some data out of an image. The image contains

I'm actually running into this issue right now, in the context of a test that I'm writing. The test needs to copy some data out of an image. The image contains a full filesystem, and some of the files are read-only. The copy is done via docker cp, which requires elevated privileges on the host to copy read-only files (see https://github.com/moby/moby/issues/35987 https://github.com/moby/moby/issues/35987 for more info). As a result, the test needs to be run using sudo to work correctly. The test environment is containerized, so there is a Dockerfile, but as the article mentioned the user in the container should not be root. Is there any plausible way around this? Updating the image is not under my control, and changing the copy code is also riskier than I would like. Since this is in the context of CI, the threat is lower than live production, but still....