fix(docker): make source readable by the runtime UID

[kajalj22]

What does this PR do?

Adds --chown to the release-stage source copy in docker/Dockerfile, matching the hermetic-stage copies directly above it.

Why

The release stage copies the full checkout without --chown, so the source keeps whatever ownership and mode the build context supplied. The ownership pass that follows covers directories only — deliberately, to avoid duplicating the source tree into another layer:

find /opt/nemo-gym ... -type d -exec chown "${RUNTIME_UID}:${RUNTIME_GID}" {} +

That leaves the files root-owned. Fine whenever the context is world-readable, which is true for the self-contained path where the nemo-gym stage is populated by ADD from GitHub — so this passes in our own CI.

It does not hold for every builder. NeMo CI builds this image with --build-context nemo-gym=. from a checkout made under umask 0007, so files arrive as mode 0660 owned by root. After USER ${RUNTIME_UID} the interpreter cannot read them:

File "/opt/nemo_gym_venv/bin/gym", line 4, in <module>
    from nemo_gym.cli.main import main
  ...
PermissionError: [Errno 13] Permission denied: '/opt/nemo-gym/nemo_gym/__init__.py'

The non-root probe added in #2560 turns that into a hard build failure. The image does not currently build under NeMo CI on either amd64 or arm64 — failing at Dockerfile:214, identically on both.

This went unnoticed because NeMo CI stopped building this Dockerfile on 2026-08-11 (an unrelated CI change repointed the Gym build at a different Dockerfile). Restoring that build is what surfaced it.

Why this fix

Applying ownership during COPY costs no extra layer, so the reason the later pass skips files still holds. The image stops depending on the umask of whoever builds it, which seems worth having regardless of who the builder is.

An alternative would be fixing modes on the NeMo CI side before the build. That works too, but leaves the image sensitive to build-context permissions for anyone else building it. Happy to go that route instead if you'd prefer the Dockerfile stay as-is.

Testing

• docker build --check -f docker/Dockerfile . — clean, no warnings
• pre-commit run --files docker/Dockerfile — pass
• Failure reproduced in NeMo CI pipeline 63613873 (Gym main, both arches fail)
• Same NeMo CI pipeline against f8d4318b6, which predates fix(docker): support non-root runtime execution #2560, builds green on both arches — 63619803

I have not yet run a full image build with this change applied — a NeMo CI run against this branch is the direct verification and I'd like to do that before this merges. Flagging it rather than implying more validation than I've done.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.