From 28364977dcec1df128f07e3ecb45540f2212fef1 Mon Sep 17 00:00:00 2001
From: Dmitry Maksyoma <ledestin@gmail.com>
Date: Wed, 20 May 2026 09:40:22 +0000
Subject: [PATCH] VNC-295 Use sccache to speed up compilation

---
 .dockerignore                                 |  1 +
 .gitlab-ci.yml                                | 37 ++++++--
 CMakeLists.txt                                | 10 +-
 builder/build-apk                             | 16 ++--
 builder/build-deb                             |  9 +-
 builder/build-rpm                             | 13 ++-
 builder/build-tarball                         | 56 +++++------
 builder/build-www                             | 33 +++++++
 .../{build_www.sh => build-www-inside-docker} |  0
 builder/build.sh                              | 44 ++++++++-
 builder/dockerfile.alpine_321.apk.build       |  6 +-
 builder/dockerfile.alpine_321.build           |  8 +-
 builder/dockerfile.alpine_322.apk.build       |  6 +-
 builder/dockerfile.alpine_322.build           |  9 +-
 builder/dockerfile.alpine_323.apk.build       |  6 +-
 builder/dockerfile.alpine_323.build           |  8 +-
 builder/dockerfile.debian_bookworm.build      |  9 +-
 builder/dockerfile.debian_bookworm.deb.build  | 11 +--
 builder/dockerfile.debian_bullseye.build      |  8 +-
 builder/dockerfile.debian_bullseye.deb.build  | 11 +--
 builder/dockerfile.debian_trixie.build        |  9 +-
 builder/dockerfile.debian_trixie.deb.build    | 11 +--
 builder/dockerfile.fedora_42.build            |  8 +-
 builder/dockerfile.fedora_42.rpm.build        |  6 +-
 builder/dockerfile.fedora_43.build            |  8 +-
 builder/dockerfile.fedora_43.rpm.build        |  6 +-
 builder/dockerfile.kali_kali-rolling.build    | 15 ++-
 .../dockerfile.kali_kali-rolling.deb.build    | 11 +--
 builder/dockerfile.opensuse_15.build          | 15 ++-
 builder/dockerfile.opensuse_15.rpm.build      |  7 +-
 builder/dockerfile.opensuse_16.build          | 15 ++-
 builder/dockerfile.opensuse_16.rpm.build      |  7 +-
 builder/dockerfile.oracle_8.build             | 12 ++-
 builder/dockerfile.oracle_8.rpm.build         |  6 +-
 builder/dockerfile.oracle_9.build             | 12 ++-
 builder/dockerfile.oracle_9.rpm.build         |  6 +-
 builder/dockerfile.ubuntu_focal.build         |  9 +-
 builder/dockerfile.ubuntu_focal.deb.build     | 11 +--
 builder/dockerfile.ubuntu_jammy.build         |  8 +-
 builder/dockerfile.ubuntu_jammy.deb.build     | 11 +--
 builder/dockerfile.ubuntu_noble.build         |  9 +-
 builder/dockerfile.ubuntu_noble.deb.build     | 11 +--
 builder/dockerfile.www.build                  | 15 ++-
 builder/os_ver_cli.sh                         |  3 +-
 builder/scripts/add-docker-user               | 41 ++++++++
 builder/scripts/build-cpuid                   |  7 +-
 builder/scripts/build-deps.sh                 |  2 +-
 builder/scripts/build-fmt                     |  6 +-
 builder/scripts/build-libjpeg-turbo           |  4 +-
 builder/scripts/build-libyuv                  |  4 +-
 builder/scripts/build-tbb                     | 20 ++--
 builder/scripts/build-webp                    |  3 +-
 builder/scripts/install_sccache_from_github   | 37 ++++++++
 builder/scripts/output_owner.sh               | 93 ++++++++++++++++++
 builder/test/test-build-tarball               | 94 +++++++++++++++++++
 55 files changed, 598 insertions(+), 245 deletions(-)
 create mode 100644 .dockerignore
 create mode 100755 builder/build-www
 rename builder/{build_www.sh => build-www-inside-docker} (100%)
 create mode 100755 builder/scripts/add-docker-user
 create mode 100755 builder/scripts/install_sccache_from_github
 create mode 100644 builder/scripts/output_owner.sh
 create mode 100755 builder/test/test-build-tarball

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..d5ee34a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1 @@
+builder/build/.sccache
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8bfbe49..2e450cb 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -39,11 +39,12 @@ stages:
 .prepare_build: &prepare_build
   - pwd
   - mkdir -p "$GITLAB_SHARED_DIND_DIR" && chmod 777 "$GITLAB_SHARED_DIND_DIR"
-  - apt-get update && apt-get install -y docker.io
+  - apt-get update && apt-get install -y docker.io sudo
   - echo "$DOCKER_HUB_PASSWORD" | docker login --username $DOCKER_HUB_USERNAME --password-stdin
 
 .prepare_www: &prepare_www
   - tar -zxf output/www/kasm_www.tar.gz -C builder/
+  - touch builder/www
 
 .prepare_artfacts: &prepare_artfacts
   - cp -r builder/build/* output/
@@ -55,36 +56,52 @@ stages:
 .parallel_matrix: &parallel_matrix
   matrix:
       - DISTRO: 'ubuntu focal'
+        DISTRO_SLUG: 'ubuntu_focal'
         GROUP: 0
       - DISTRO: 'ubuntu jammy'
+        DISTRO_SLUG: 'ubuntu_jammy'
         GROUP: 1
       - DISTRO: 'ubuntu noble'
+        DISTRO_SLUG: 'ubuntu_noble'
         GROUP: 2
       - DISTRO: 'debian bullseye'
+        DISTRO_SLUG: 'debian_bullseye'
         GROUP: 3
       - DISTRO: 'debian bookworm'
+        DISTRO_SLUG: 'debian_bookworm'
         GROUP: 4
       - DISTRO: 'debian trixie'
+        DISTRO_SLUG: 'debian_trixie'
         GROUP: 5
       - DISTRO: 'kali kali-rolling'
+        DISTRO_SLUG: 'kali_kali-rolling'
         GROUP: 6
       - DISTRO: 'oracle 8'
+        DISTRO_SLUG: 'oracle_8'
         GROUP: 7
       - DISTRO: 'oracle 9'
+        DISTRO_SLUG: 'oracle_9'
         GROUP: 8
       - DISTRO: 'opensuse 15'
+        DISTRO_SLUG: 'opensuse_15'
         GROUP: 9
       - DISTRO: 'opensuse 16'
+        DISTRO_SLUG: 'opensuse_16'
         GROUP: 10
       - DISTRO: 'fedora 42'
+        DISTRO_SLUG: 'fedora_42'
         GROUP: 11
       - DISTRO: 'fedora 43'
+        DISTRO_SLUG: 'fedora_43'
         GROUP: 12
       - DISTRO: 'alpine 321'
+        DISTRO_SLUG: 'alpine_321'
         GROUP: 13
       - DISTRO: 'alpine 322'
+        DISTRO_SLUG: 'alpine_322'
         GROUP: 14
       - DISTRO: 'alpine 323'
+        DISTRO_SLUG: 'alpine_323'
         GROUP: 15
 
 default:
@@ -126,15 +143,13 @@ functional_test:
 build_www:
   stage: www
   allow_failure: false
+  image: $DEBIAN_STABLE_IMAGE
   tags:
     - oci-fixed-amd
   before_script:
     - *prepare_build
   script:
-    - webpacked_www=$PWD/builder/www
-    - src_www=kasmweb
-    - docker build -t kasmweb/www -f builder/dockerfile.www.build .
-    - docker run --rm -v $PWD/builder/www:/build kasmweb/www:latest
+    - builder/build-www
     - mkdir -p output/www
     - cd builder
     - echo $PWD
@@ -161,11 +176,16 @@ build_amd64:
   after_script:
     - *prepare_artfacts
   script:
-    - set -e
     - is_build_this_distro "$DISTRO" && builder/build-package $DISTRO
   artifacts:
     paths:
       - output/
+  cache:
+    key: "sccache-$CI_RUNNER_EXECUTABLE_ARCH-$CI_COMMIT_REF_SLUG-$DISTRO_SLUG"
+    paths:
+      - builder/build/.sccache
+    policy: pull-push
+
   resource_group: "concurrent_$GROUP"
   parallel:
     *parallel_matrix
@@ -188,6 +208,11 @@ build_arm64:
   artifacts:
     paths:
       - output/
+  cache:
+    key: "sccache-$CI_RUNNER_EXECUTABLE_ARCH-$CI_COMMIT_REF_SLUG-$DISTRO_SLUG"
+    paths:
+      - builder/build/.sccache
+    policy: pull-push
   resource_group: "concurrent_$GROUP"
   parallel:
     *parallel_matrix
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 410f182..f612a2f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -43,12 +43,6 @@ if(MSVC)
   message(FATAL_ERROR "KasmVNC cannot be built with Visual Studio.  Please use MinGW")
 endif()
 
-if(NOT BUILD_TIMESTAMP)
-  set(BUILD_TIMESTAMP "")
-  execute_process(COMMAND "date" "+%Y-%m-%d %H:%M" OUTPUT_VARIABLE BUILD_TIMESTAMP)
-  string(REGEX REPLACE "\n" "" BUILD_TIMESTAMP ${BUILD_TIMESTAMP})
-endif()
-
 # Default to optimised builds instead of debug ones. Our code has no bugs ;)
 # (CMake makes it fairly easy to toggle this back to Debug if needed)
 if(NOT CMAKE_BUILD_TYPE)
@@ -58,8 +52,6 @@ endif()
 message(STATUS "CMAKE_BUILD_TYPE = ${CMAKE_BUILD_TYPE}")
 
 message(STATUS "VERSION = ${VERSION}")
-message(STATUS "BUILD_TIMESTAMP = ${BUILD_TIMESTAMP}")
-add_definitions(-DBUILD_TIMESTAMP="${BUILD_TIMESTAMP}")
 
 message(STATUS "WWWDIR = ${DATA_DIR}/kasmvnc/www")
 add_definitions(-DWWWDIR="${DATA_DIR}/kasmvnc/www")
@@ -155,6 +147,8 @@ find_package(Freetype REQUIRED)
 include_directories(${FREETYPE_INCLUDE_DIRS})
 
 # Staticly link libjpeg-turbo
+# Add library search paths for custom-built libjpeg-turbo in ~/.local
+link_directories("$ENV{HOME}/.local/lib" "$ENV{HOME}/.local/lib64")
 set(JPEG_LIBRARIES "-Wl,-Bstatic -lturbojpeg -Wl,-Bdynamic")
 # Warn if it doesn't seem to be the accelerated libjpeg that's found
 set(CMAKE_REQUIRED_LIBRARIES ${JPEG_LIBRARIES})
diff --git a/builder/build-apk b/builder/build-apk
index 8b49160..4c0d3d3 100755
--- a/builder/build-apk
+++ b/builder/build-apk
@@ -3,33 +3,33 @@
 set -e
 
 copy_signing_key_to_user_abuild_dir() {
-  docker run --rm -v $PWD/alpine/.abuild:/abuild --user $L_UID:$L_GID \
+  docker run --rm -v $PWD/alpine/.abuild:/abuild \
+    --user "$output_owner_uid:$output_owner_gid" \
     $builder_image \
     cp /etc/apk/keys/kasmvnc_signing_key.rsa.pub \
       /etc/apk/keys/kasmvnc_signing_key.rsa /abuild
 }
 
 . builder/os_ver_cli.sh
+. builder/scripts/output_owner.sh
 
 cd "$(dirname "$0")/.."
 
-L_UID=$(id -u)
-L_GID=$(id -g)
+select_consistent_output_owner_uid_and_gid
+
 ABUILD_GID=300
-if [ "$L_UID" = 0 ]; then
-  L_UID=1000
-  L_GID=1000
-fi
 
 builder_image=kasmvnc_apkbuilder_${os}:${os_codename}
 docker build -t $builder_image \
   --build-arg KASMVNC_ALPINE_PRIVATE_KEY \
   --build-arg KASMVNC_ALPINE_PUBLIC_KEY \
+  --build-arg OUTPUT_OWNER_UID="$output_owner_uid" \
   -f builder/dockerfile.${os}_${os_codename}.apk.build .
 copy_signing_key_to_user_abuild_dir
 
 source_dir=$(echo $PWD)
-docker run --rm -v "$source_dir":/src --user $L_UID:$L_GID \
+docker run --rm -v "$source_dir":/src \
+  --user "$output_owner_uid:$output_owner_gid" \
   --group-add $ABUILD_GID \
   -e CI \
   kasmvnc_apkbuilder_${os}:${os_codename} /bin/bash -c \
diff --git a/builder/build-deb b/builder/build-deb
index e2e1093..b59db89 100755
--- a/builder/build-deb
+++ b/builder/build-deb
@@ -4,18 +4,19 @@ set -e
 
 cd "$(dirname "$0")/.."
 . builder/os_ver_cli.sh
+. builder/scripts/output_owner.sh
 
-L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
-L_GID=$(id -g)
+select_consistent_output_owner_uid_and_gid
 
 builder_image=debbuilder_${os}:${os_codename}${build_tag_for_images}
 docker build --build-arg KASMVNC_PACKAGE_DIR="builder/build/${os_codename}" \
-  --build-arg L_UID="$L_UID" \
+  --build-arg OUTPUT_OWNER_UID="$output_owner_uid" \
   -t "$builder_image" -f \
   builder/dockerfile.${os}_${os_codename}${build_tag}.deb.build .
 
 deb_output_dir=$(cd .. && echo $PWD)
+
 docker run --rm -v "$deb_output_dir":/src -e BUILD_TAG="$build_tag" \
-  --user "$L_UID:$L_GID" \
+  --user "$output_owner_uid:$output_owner_gid" \
   "$builder_image" /bin/bash -c \
   '/src/*/builder/build-deb-inside-docker'
diff --git a/builder/build-rpm b/builder/build-rpm
index f3fdf2d..e72fdd1 100755
--- a/builder/build-rpm
+++ b/builder/build-rpm
@@ -13,14 +13,17 @@ warn_build_tag_not_supported_for_rpm_and_exit() {
 
 cd "$(dirname "$0")/.."
 . builder/os_ver_cli.sh
+. builder/scripts/output_owner.sh
 warn_build_tag_not_supported_for_rpm_and_exit "$build_tag"
 
-docker build -t kasmvnc_rpmbuilder_${os}:${os_codename} -f \
-  builder/dockerfile.${os}_${os_codename}.rpm.build .
+select_consistent_output_owner_uid_and_gid
+
+docker build -t kasmvnc_rpmbuilder_${os}:${os_codename} \
+  --build-arg OUTPUT_OWNER_UID="$output_owner_uid" \
+  -f builder/dockerfile.${os}_${os_codename}.rpm.build .
 
 source_dir=$(echo $PWD)
-L_UID=$(id -u) #Ubuntu already has UID env var, but this should work on all Linix systems
-L_GID=$(id -g)
-docker run --rm -v "$source_dir":/src --user $L_UID:$L_GID \
+docker run --rm -v "$source_dir":/src \
+  --user "$output_owner_uid:$output_owner_gid" \
   kasmvnc_rpmbuilder_${os}:${os_codename} /bin/bash -c \
   '/src/builder/build-rpm-inside-docker'
diff --git a/builder/build-tarball b/builder/build-tarball
index dec43e9..ce159cf 100755
--- a/builder/build-tarball
+++ b/builder/build-tarball
@@ -2,46 +2,46 @@
 
 set -e
 
-build_www_dir() {
-  local webpacked_www=$PWD/builder/www
-  local src_www=kasmweb
-
-  if [ "$src_www" -nt "$webpacked_www" ]; then
-    docker build -t kasmweb/www -f builder/dockerfile.www.build .
-    docker run --rm -v $PWD/builder/www:/build kasmweb/www:latest
-  fi
+build_tarball_builder_image() {
+  builder_image=kasmvncbuilder:$os_codename${build_tag_for_images}
+  docker build -t "$builder_image" \
+    --build-arg OUTPUT_OWNER_UID="$output_owner_uid" \
+    -f builder/dockerfile.${os}_${os_codename}${build_tag}.build .
 }
 
-move_libjpeg_turbo_to_os_specific_dir() {
-  chown $L_UID:$L_GID $shared_with_docker_dir/${os_codename}/*
-  mkdir -p $PWD/builder/build/${os_codename}/
-  mv $shared_with_docker_dir/${os_codename}/libjpeg-turbo*.deb \
-    $PWD/builder/build/${os_codename}/
+create_distro_sccache_dir_under_output_owner() {
+  sccache_dir_for_distro="$PWD/builder/build/.sccache/user_${output_owner_uid}/${os}_${os_codename}${build_tag}"
+  as_output_owner mkdir -p "$sccache_dir_for_distro"
 }
 
-shared_with_docker_dir=${GITLAB_SHARED_DIND_DIR:-/tmp}
+create_build_dir_under_output_owner() {
+  build_dir="$PWD/builder/build"
+  as_output_owner mkdir -p "$build_dir"
+}
 
 cd "$(dirname "$0")/.."
 . builder/os_ver_cli.sh
+. builder/scripts/output_owner.sh
 
-build_www_dir
+select_consistent_output_owner_uid_and_gid
 
-builder_image=kasmvncbuilder:$os_codename${build_tag_for_images}
-docker build -t "$builder_image" \
-  -f builder/dockerfile.${os}_${os_codename}${build_tag}.build .
-mkdir -p builder/build
-docker run -v $shared_with_docker_dir:/build -e BUILD_TAG="$build_tag" \
+builder/build-www
+
+build_tarball_builder_image
+
+create_build_dir_under_output_owner
+create_distro_sccache_dir_under_output_owner
+docker run -v $build_dir:/build \
+  -v "$sccache_dir_for_distro":/sccache \
+  -e BUILD_TAG="$build_tag" \
+  --user "$output_owner_uid":"$output_owner_gid" \
   -e KASMVNC_COMMIT_ID="$KASMVNC_COMMIT_ID" \
+  -e SCCACHE_DIR=/sccache \
   --rm "$builder_image"
 
-L_GID=$(id -g)
-L_UID=$(id -u)
 tarball_name="kasmvnc.${os}_${os_codename}.tar.gz"
 tarball_name_with_build_tag="kasmvnc.${os}_${os_codename}${build_tag}.tar.gz"
-chown $L_UID:$L_GID $shared_with_docker_dir/$tarball_name
-mv $shared_with_docker_dir/$tarball_name \
-  $PWD/builder/build/"$tarball_name_with_build_tag"
-
-if [ "$build_tag" = "+libjpeg-turbo_latest" ]; then
-  move_libjpeg_turbo_to_os_specific_dir
+if [[ "$tarball_name" != "$tarball_name_with_build_tag" ]]; then
+  mv "$build_dir/$tarball_name" \
+    "$build_dir/$tarball_name_with_build_tag"
 fi
diff --git a/builder/build-www b/builder/build-www
new file mode 100755
index 0000000..cb5ab7d
--- /dev/null
+++ b/builder/build-www
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+set -eo pipefail
+
+build_www_dir() {
+  select_consistent_output_owner_uid_and_gid
+  as_output_owner mkdir -p "$built_www"
+
+  docker build -t kasmweb/www \
+    --build-arg OUTPUT_OWNER_UID="$output_owner_uid" \
+    -f builder/dockerfile.www.build .
+  docker run --rm -v "$built_www:/build" \
+    --user "$output_owner_uid":"$output_owner_gid" \
+    kasmweb/www:latest
+}
+
+www_source_not_changed() {
+  [[ "$src_www" -ot "$built_www" ]]
+}
+
+cd "$(dirname "$0")/.."
+. builder/scripts/output_owner.sh
+
+src_www=kasmweb
+built_www=$PWD/builder/www
+
+if www_source_not_changed; then
+  echo "Source for www (kasmweb) did not change, doing nothing."
+  exit
+fi
+
+echo "Building www..."
+build_www_dir
diff --git a/builder/build_www.sh b/builder/build-www-inside-docker
similarity index 100%
rename from builder/build_www.sh
rename to builder/build-www-inside-docker
diff --git a/builder/build.sh b/builder/build.sh
index 43e78f9..f3b0078 100755
--- a/builder/build.sh
+++ b/builder/build.sh
@@ -2,6 +2,11 @@
 
 set -e
 
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+if [ -z "$SCRIPTS_DIR" ]; then
+  SCRIPTS_DIR="$SCRIPT_DIR/scripts"
+fi
+
 debian_patches_dir="debian/patches"
 
 is_debian_patches_present() {
@@ -38,6 +43,26 @@ EOF
   fi
 }
 
+enable_sccache_debug_log() {
+  export SCCACHE_LOG="sccache::server=debug,sccache::compiler=trace,sccache::cache=debug"
+  export SCCACHE_ERROR_LOG=/tmp/sccache.log
+}
+
+setup_sccache() {
+  export SCCACHE_CACHE_SIZE=160M
+  export CC="sccache ${CC:-gcc}"
+  export CXX="sccache ${CXX:-g++}"
+}
+
+setup_compilers_to_see_libs_in_dot_local() {
+  export PKG_CONFIG_PATH="$HOME/.local/lib/pkgconfig:$HOME/.local/lib64/pkgconfig:$HOME/.local/share/pkgconfig:${PKG_CONFIG_PATH}"
+  export CPATH="$HOME/.local/include${CPATH:+:CPATH}"
+}
+
+ensure_libturbojpeg_links() {
+  export LDFLAGS="-L$HOME/.local/lib -L$HOME/.local/lib64"
+}
+
 # For build-dep to work, the apt sources need to have the source server
 #sudo apt-get build-dep xorg-server
 
@@ -48,6 +73,12 @@ EOF
 
 # Ubuntu applies a million patches, but here we use upstream to simplify matters
 cd /tmp
+
+setup_sccache
+setup_compilers_to_see_libs_in_dot_local
+
+$SCRIPTS_DIR/build-deps.sh
+
 # default to the version of x in Ubuntu 18.04, otherwise caller will need to specify
 XORG_VER=${XORG_VER:-"1.19.6"}
 if [[ "${XORG_VER}" == 21* ]]; then
@@ -67,8 +98,17 @@ fi
 #git checkout dynjpeg
 cd /src
 
+ensure_libturbojpeg_links
+
 cmake -D CMAKE_BUILD_TYPE=RelWithDebInfo . -DBUILD_VIEWER:BOOL=OFF \
-  -DENABLE_GNUTLS:BOOL=OFF
+  -DENABLE_GNUTLS:BOOL=OFF \
+  -DCMAKE_PREFIX_PATH="$HOME/.local" \
+  -DCMAKE_LIBRARY_PATH="$HOME/.local/lib;$HOME/.local/lib64" \
+  -DCMAKE_INCLUDE_PATH="$HOME/.local/include" \
+  -DCMAKE_EXE_LINKER_FLAGS="-L$HOME/.local/lib -L$HOME/.local/lib64" \
+  -DCMAKE_SHARED_LINKER_FLAGS="-L$HOME/.local/lib -L$HOME/.local/lib64" \
+  -DCMAKE_MODULE_LINKER_FLAGS="-L$HOME/.local/lib -L$HOME/.local/lib64"
+
 make -j"$(nproc)"
 
 if [ ! -d unix/xserver/include ]; then
@@ -165,6 +205,8 @@ if is_debian; then
   apply_debian_patches
 fi
 
+sccache --show-stats || true
+
 make servertarball
 
 cp kasmvnc*.tar.gz /build/kasmvnc.${KASMVNC_BUILD_OS}_${KASMVNC_BUILD_OS_CODENAME}.tar.gz
diff --git a/builder/dockerfile.alpine_321.apk.build b/builder/dockerfile.alpine_321.apk.build
index 6f41bde..ce70d62 100644
--- a/builder/dockerfile.alpine_321.apk.build
+++ b/builder/dockerfile.alpine_321.apk.build
@@ -13,7 +13,5 @@ ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
 RUN $SCRIPTS_DIR/install_alpine_signing_keys
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
-RUN echo 'docker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
-
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.alpine_321.build b/builder/dockerfile.alpine_321.build
index fd972d4..35bac07 100644
--- a/builder/dockerfile.alpine_321.build
+++ b/builder/dockerfile.alpine_321.build
@@ -15,6 +15,7 @@ RUN \
     ca-certificates \
     cmake \
     nasm \
+    sccache \
     coreutils \
     curl \
     eudev-dev \
@@ -78,11 +79,10 @@ RUN if [ "$(uname -m)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.alpine_322.apk.build b/builder/dockerfile.alpine_322.apk.build
index 92bae6b..2befd22 100644
--- a/builder/dockerfile.alpine_322.apk.build
+++ b/builder/dockerfile.alpine_322.apk.build
@@ -13,7 +13,5 @@ ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
 RUN $SCRIPTS_DIR/install_alpine_signing_keys
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
-RUN echo 'docker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
-
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.alpine_322.build b/builder/dockerfile.alpine_322.build
index 5409729..5baed9a 100644
--- a/builder/dockerfile.alpine_322.build
+++ b/builder/dockerfile.alpine_322.build
@@ -78,11 +78,12 @@ RUN if [ "$(uname -m)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+RUN $SCRIPTS_DIR/install_sccache_from_github
 
-COPY --chown=docker:docker . /src/
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.alpine_323.apk.build b/builder/dockerfile.alpine_323.apk.build
index 7633085..942a9f8 100644
--- a/builder/dockerfile.alpine_323.apk.build
+++ b/builder/dockerfile.alpine_323.apk.build
@@ -13,7 +13,5 @@ ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
 RUN $SCRIPTS_DIR/install_alpine_signing_keys
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
-RUN echo 'docker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
-
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.alpine_323.build b/builder/dockerfile.alpine_323.build
index fa9c9bf..349facb 100644
--- a/builder/dockerfile.alpine_323.build
+++ b/builder/dockerfile.alpine_323.build
@@ -14,6 +14,7 @@ RUN \
     bash \
     ca-certificates \
     nasm \
+    sccache \
     coreutils \
     curl \
     eudev-dev \
@@ -80,11 +81,10 @@ RUN pip install --break-system-packages cmake==3.22.6
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.debian_bookworm.build b/builder/dockerfile.debian_bookworm.build
index d0b3344..b5bb223 100644
--- a/builder/dockerfile.debian_bookworm.build
+++ b/builder/dockerfile.debian_bookworm.build
@@ -22,7 +22,7 @@ RUN apt-get update && \
 
 RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
 RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
-RUN apt-get update && apt-get -y install ninja-build cmake nasm git libgnutls28-dev vim wget tightvncserver curl
+RUN apt-get update && apt-get -y install ninja-build cmake nasm sccache git libgnutls28-dev vim wget tightvncserver curl
 RUN apt-get update && apt-get -y install libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev libxrandr-dev \
     libxcursor-dev libavformat-dev libswscale-dev libva-dev
 
@@ -33,11 +33,10 @@ RUN if [ "$(arch)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.debian_bookworm.deb.build b/builder/dockerfile.debian_bookworm.deb.build
index 2e61fbb..7de0c96 100644
--- a/builder/dockerfile.debian_bookworm.deb.build
+++ b/builder/dockerfile.debian_bookworm.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.debian_bullseye.build b/builder/dockerfile.debian_bullseye.build
index c9e1c23..27a0e6f 100644
--- a/builder/dockerfile.debian_bullseye.build
+++ b/builder/dockerfile.debian_bullseye.build
@@ -31,11 +31,11 @@ RUN CMAKE_URL="https://cmake.org/files/v3.22/cmake-3.22.0" && \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+RUN $SCRIPTS_DIR/install_sccache_from_github
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.debian_bullseye.deb.build b/builder/dockerfile.debian_bullseye.deb.build
index 51bde4f..815e018 100644
--- a/builder/dockerfile.debian_bullseye.deb.build
+++ b/builder/dockerfile.debian_bullseye.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.debian_trixie.build b/builder/dockerfile.debian_trixie.build
index efa74ef..9d4dda6 100644
--- a/builder/dockerfile.debian_trixie.build
+++ b/builder/dockerfile.debian_trixie.build
@@ -22,7 +22,7 @@ RUN apt-get update && \
 
 RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
 RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
-RUN apt-get update && apt-get -y install ninja-build cmake nasm git libgnutls28-dev vim wget tightvncserver curl
+RUN apt-get update && apt-get -y install ninja-build cmake nasm sccache git libgnutls28-dev vim wget tightvncserver curl
 RUN apt-get update && apt-get -y install libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev libxrandr-dev \
     libxcursor-dev libavformat-dev libswscale-dev libva-dev
 
@@ -33,11 +33,10 @@ RUN if [ "$(arch)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.debian_trixie.deb.build b/builder/dockerfile.debian_trixie.deb.build
index 913614e..571c5b6 100644
--- a/builder/dockerfile.debian_trixie.deb.build
+++ b/builder/dockerfile.debian_trixie.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.fedora_42.build b/builder/dockerfile.fedora_42.build
index ee85302..5236123 100644
--- a/builder/dockerfile.fedora_42.build
+++ b/builder/dockerfile.fedora_42.build
@@ -25,6 +25,7 @@ RUN \
     fop \
     gcc \
     gcc-c++ \
+    sccache \
     git \
     glibc-devel \
     libdrm-devel \
@@ -80,11 +81,10 @@ RUN \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.fedora_42.rpm.build b/builder/dockerfile.fedora_42.rpm.build
index 009ea57..5d80328 100644
--- a/builder/dockerfile.fedora_42.rpm.build
+++ b/builder/dockerfile.fedora_42.rpm.build
@@ -10,6 +10,8 @@ RUN dnf install -y dnf-plugins-core
 COPY fedora/*.spec /tmp
 RUN dnf builddep -y /tmp/*.spec
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.fedora_43.build b/builder/dockerfile.fedora_43.build
index f2fd19c..f219b60 100644
--- a/builder/dockerfile.fedora_43.build
+++ b/builder/dockerfile.fedora_43.build
@@ -25,6 +25,7 @@ RUN \
     fop \
     gcc \
     gcc-c++ \
+    sccache \
     git \
     glibc-devel \
     libdrm-devel \
@@ -80,11 +81,10 @@ RUN \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.fedora_43.rpm.build b/builder/dockerfile.fedora_43.rpm.build
index 7addea8..3dff780 100644
--- a/builder/dockerfile.fedora_43.rpm.build
+++ b/builder/dockerfile.fedora_43.rpm.build
@@ -10,6 +10,8 @@ RUN dnf install -y dnf-plugins-core
 COPY fedora/*.spec /tmp
 RUN dnf builddep -y /tmp/*.spec
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.kali_kali-rolling.build b/builder/dockerfile.kali_kali-rolling.build
index bd5bc96..63bbee0 100644
--- a/builder/dockerfile.kali_kali-rolling.build
+++ b/builder/dockerfile.kali_kali-rolling.build
@@ -7,7 +7,7 @@ ENV DEBIAN_FRONTEND noninteractive
 ENV CXXFLAGS="-Wno-stringop-overflow"
 ENV CFLAGS="-Wno-stringop-overflow"
 
-RUN grep '^deb'  /etc/apt/sources.list | sed 's#^deb#deb-src#' >> /etc/apt/sources.list
+RUN sed -i 's/Types: deb/Types: deb deb-src/' /etc/apt/sources.list.d/kali.sources
 
 RUN apt-get update && \
       apt-get -y install sudo
@@ -15,12 +15,10 @@ RUN apt-get update && \
 RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends tzdata
 RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
 RUN apt-get update && apt-get -y install gcc g++ curl ca-certificates && update-ca-certificates
-RUN apt-get update && apt-get -y install ninja-build nasm git libgnutls28-dev vim wget tightvncserver
+RUN apt-get update && apt-get -y install ninja-build nasm git sccache libgnutls28-dev vim wget tightvncserver
 RUN apt-get update && apt-get -y install libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev libxrandr-dev \
     libxcursor-dev libavformat-dev libswscale-dev libva-dev libcrypt-dev
 
-ENV SCRIPTS_DIR=/tmp/scripts
-COPY builder/scripts $SCRIPTS_DIR
 RUN ARCH=$(arch) && \
   CMAKE_URL="https://cmake.org/files/v3.22/cmake-3.22.0" && \
   if [ "$ARCH" = "x86_64" ]; then \
@@ -34,11 +32,12 @@ RUN ARCH=$(arch) && \
   (echo y; echo n) | bash cmake.sh --prefix=/usr/local --skip-license && \
   rm cmake.sh
 
-RUN $SCRIPTS_DIR/build-deps.sh
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && usermod -aG sudo docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.kali_kali-rolling.deb.build b/builder/dockerfile.kali_kali-rolling.deb.build
index 6d0ed1b..a9f4e94 100644
--- a/builder/dockerfile.kali_kali-rolling.deb.build
+++ b/builder/dockerfile.kali_kali-rolling.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.opensuse_15.build b/builder/dockerfile.opensuse_15.build
index 78e660e..ca7603f 100644
--- a/builder/dockerfile.opensuse_15.build
+++ b/builder/dockerfile.opensuse_15.build
@@ -18,6 +18,7 @@ RUN zypper install -ny \
   font-util \
   gcc14 \
   gcc14-c++ \
+  sccache \
   giflib-devel \
   git \
   gzip \
@@ -49,9 +50,6 @@ RUN zypper install -ny \
   zlib-devel \
   libva-devel
 
-RUN groupadd -g 1000 docker && \
-  useradd -u 1000 -g docker docker
-
 RUN ARCH=$(arch) && \
   CMAKE_URL="https://cmake.org/files/v3.22/cmake-3.22.0" && \
   if [ "$ARCH" = "x86_64" ]; then \
@@ -65,14 +63,15 @@ RUN ARCH=$(arch) && \
   (echo y; echo n) | bash cmake.sh --prefix=/usr/local --skip-license && \
   rm cmake.sh
 
+RUN ln -s /usr/bin/gcc-14 /usr/local/bin/gcc && ln -s /usr/bin/g++-14 /usr/local/bin/g++
+
 ENV SCRIPTS_DIR=/tmp/scripts
-ENV CC=/usr/bin/gcc-14
-ENV CXX=/usr/bin/g++-14
 
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-COPY --chown=docker:docker . /src/
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["bash", "-l", "-c", "/src/builder/build.sh"]
diff --git a/builder/dockerfile.opensuse_15.rpm.build b/builder/dockerfile.opensuse_15.rpm.build
index 379ed92..a21b0b5 100644
--- a/builder/dockerfile.opensuse_15.rpm.build
+++ b/builder/dockerfile.opensuse_15.rpm.build
@@ -20,7 +20,8 @@ COPY opensuse/kasmvncserver.spec /tmp
 
 RUN zypper -n install $(grep BuildRequires /tmp/*.spec | cut -d' ' -f2 | xargs)
 
-RUN groupadd -g 1000 docker && \
-  useradd -u 1000 -m -d /home/docker -g docker docker
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.opensuse_16.build b/builder/dockerfile.opensuse_16.build
index 6e17921..7616b7c 100644
--- a/builder/dockerfile.opensuse_16.build
+++ b/builder/dockerfile.opensuse_16.build
@@ -18,6 +18,7 @@ RUN zypper install -ny \
   gcc15 \
   gcc15-c++ \
   cmake \
+  sccache \
   giflib-devel \
   git \
   gzip \
@@ -51,18 +52,14 @@ RUN zypper install -ny \
   zlib-devel \
   libva-devel
 
-RUN useradd -u 1000 docker && \
-  usermod -a -G docker docker
+RUN ln -s /usr/bin/gcc-15 /usr/local/bin/gcc && ln -s /usr/bin/g++-15 /usr/local/bin/g++
 
 ENV SCRIPTS_DIR=/tmp/scripts
-ENV CC=/usr/bin/gcc-15
-ENV CXX=/usr/bin/g++-15
-ENV PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:/usr/local/lib/pkgconfig
-
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-COPY --chown=docker:docker . /src/
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["bash", "-l", "-c", "/src/builder/build.sh"]
diff --git a/builder/dockerfile.opensuse_16.rpm.build b/builder/dockerfile.opensuse_16.rpm.build
index 578f913..ba348e2 100644
--- a/builder/dockerfile.opensuse_16.rpm.build
+++ b/builder/dockerfile.opensuse_16.rpm.build
@@ -20,7 +20,8 @@ COPY opensuse/kasmvncserver16.spec /tmp
 
 RUN zypper -n install $(grep BuildRequires /tmp/*.spec | cut -d' ' -f2 | xargs)
 
-RUN useradd -u 1000 -m -d /home/docker docker && \
-  usermod -a -G docker docker
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.oracle_8.build b/builder/dockerfile.oracle_8.build
index c9f17b2..951c1fb 100644
--- a/builder/dockerfile.oracle_8.build
+++ b/builder/dockerfile.oracle_8.build
@@ -59,11 +59,13 @@ ENV SCRIPTS_DIR=/tmp/scripts
 ENV PKG_CONFIG_PATH=/usr/local/lib64/pkgconfig:${PKG_CONFIG_PATH:-/opt/rh/gcc-toolset-14/root/usr/lib64/pkgconfig}
 
 COPY builder/scripts $SCRIPTS_DIR
-RUN echo "source /opt/rh/gcc-toolset-14/enable" > /etc/profile.d/gcc-toolset.sh && \
-    $SCRIPTS_DIR/build-deps.sh  && \
-    useradd -m docker && echo "docker:docker" | chpasswd
+RUN echo "source /opt/rh/gcc-toolset-14/enable" > /etc/profile.d/gcc-toolset.sh
 
-COPY --chown=docker:docker . /src/
+RUN $SCRIPTS_DIR/install_sccache_from_github
+
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["bash", "-l", "-c", "/src/builder/build.sh"]
diff --git a/builder/dockerfile.oracle_8.rpm.build b/builder/dockerfile.oracle_8.rpm.build
index d9e814f..75f0374 100644
--- a/builder/dockerfile.oracle_8.rpm.build
+++ b/builder/dockerfile.oracle_8.rpm.build
@@ -16,6 +16,8 @@ RUN dnf install -y \
 COPY oracle/kasmvncserver.spec /tmp
 RUN dnf builddep -y /tmp/*.spec
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.oracle_9.build b/builder/dockerfile.oracle_9.build
index 80157b3..8f1a267 100644
--- a/builder/dockerfile.oracle_9.build
+++ b/builder/dockerfile.oracle_9.build
@@ -58,11 +58,13 @@ RUN dnf install -y \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN echo "source /opt/rh/gcc-toolset-14/enable" > /etc/profile.d/gcc-toolset.sh && \
-  $SCRIPTS_DIR/build-deps.sh && \
-  useradd -m docker && echo "docker:docker" | chpasswd
+RUN echo "source /opt/rh/gcc-toolset-14/enable" > /etc/profile.d/gcc-toolset.sh
 
-COPY --chown=docker:docker . /src/
+RUN $SCRIPTS_DIR/install_sccache_from_github
+
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["bash", "-l", "-c", "/src/builder/build.sh"]
diff --git a/builder/dockerfile.oracle_9.rpm.build b/builder/dockerfile.oracle_9.rpm.build
index bb7257f..f64f627 100644
--- a/builder/dockerfile.oracle_9.rpm.build
+++ b/builder/dockerfile.oracle_9.rpm.build
@@ -18,6 +18,8 @@ RUN dnf install --nobest -y \
 
 COPY oracle/kasmvncserver9.spec /tmp
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.ubuntu_focal.build b/builder/dockerfile.ubuntu_focal.build
index cd82e05..8898a89 100644
--- a/builder/dockerfile.ubuntu_focal.build
+++ b/builder/dockerfile.ubuntu_focal.build
@@ -27,7 +27,9 @@ RUN if [ "$(arch)" = "x86_64" ]; then \
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+RUN $SCRIPTS_DIR/install_sccache_from_github
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
 RUN ARCH=$(arch) && \
   CMAKE_URL="https://cmake.org/files/v3.22/cmake-3.22.0" && \
@@ -42,9 +44,6 @@ RUN ARCH=$(arch) && \
   (echo y; echo n) | bash cmake.sh --prefix=/usr/local --skip-license && \
   rm cmake.sh
 
-RUN $SCRIPTS_DIR/build-deps.sh
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-COPY --chown=docker:docker . /src/
-
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.ubuntu_focal.deb.build b/builder/dockerfile.ubuntu_focal.deb.build
index 8a4db12..adf5d60 100644
--- a/builder/dockerfile.ubuntu_focal.deb.build
+++ b/builder/dockerfile.ubuntu_focal.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.ubuntu_jammy.build b/builder/dockerfile.ubuntu_jammy.build
index dfa8258..e87f10e 100644
--- a/builder/dockerfile.ubuntu_jammy.build
+++ b/builder/dockerfile.ubuntu_jammy.build
@@ -23,11 +23,11 @@ RUN if [ "$(arch)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+RUN $SCRIPTS_DIR/install_sccache_from_github
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.ubuntu_jammy.deb.build b/builder/dockerfile.ubuntu_jammy.deb.build
index 31dee99..56eb8b1 100644
--- a/builder/dockerfile.ubuntu_jammy.deb.build
+++ b/builder/dockerfile.ubuntu_jammy.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.ubuntu_noble.build b/builder/dockerfile.ubuntu_noble.build
index 7588ff6..6f56653 100644
--- a/builder/dockerfile.ubuntu_noble.build
+++ b/builder/dockerfile.ubuntu_noble.build
@@ -12,7 +12,7 @@ RUN apt-get update && \
 
 RUN apt-get update && apt-get install -y --no-install-recommends tzdata
 RUN apt-get update && apt-get -y build-dep xorg-server libxfont-dev
-RUN apt-get update && apt-get -y install ninja-build cmake nasm git libgnutls28-dev vim wget curl
+RUN apt-get update && apt-get -y install ninja-build cmake nasm sccache git libgnutls28-dev vim wget curl
 RUN apt-get update && apt-get -y install libpng-dev libtiff-dev libgif-dev libavcodec-dev libssl-dev libxrandr-dev \
     libxcursor-dev libavformat-dev libswscale-dev libva-dev
 
@@ -23,11 +23,10 @@ RUN if [ "$(arch)" = "x86_64" ]; then \
 
 ENV SCRIPTS_DIR=/tmp/scripts
 COPY builder/scripts $SCRIPTS_DIR
-RUN $SCRIPTS_DIR/build-deps.sh
 
-RUN useradd -m docker && echo "docker:docker" | chpasswd && adduser docker sudo
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
 
-COPY --chown=docker:docker . /src/
+COPY --chown=$OUTPUT_OWNER_UID . /src/
 
-USER docker
 ENTRYPOINT ["/src/builder/build.sh"]
diff --git a/builder/dockerfile.ubuntu_noble.deb.build b/builder/dockerfile.ubuntu_noble.deb.build
index 6a56b24..7d9db26 100644
--- a/builder/dockerfile.ubuntu_noble.deb.build
+++ b/builder/dockerfile.ubuntu_noble.deb.build
@@ -9,11 +9,8 @@ RUN apt-get update && \
 COPY ./debian/control /tmp
 RUN apt-get update && echo YYY | mk-build-deps --install --remove /tmp/control
 
-ARG L_UID
-RUN if [ "$L_UID" -eq 0 ]; then \
-      useradd -m docker; \
-    else \
-      useradd -m docker -u $L_UID;\
-    fi
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
 
-USER docker
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
diff --git a/builder/dockerfile.www.build b/builder/dockerfile.www.build
index e5a1845..2b6591d 100644
--- a/builder/dockerfile.www.build
+++ b/builder/dockerfile.www.build
@@ -1,12 +1,21 @@
 FROM alpine
 
 RUN apk add npm nodejs
+RUN apk add bash shadow
 
-COPY kasmweb/ /src/www
-COPY builder/build_www.sh /src/
+ENV SCRIPTS_DIR=/tmp/scripts
+COPY builder/scripts $SCRIPTS_DIR
+
+ARG OUTPUT_OWNER_UID
+RUN $SCRIPTS_DIR/add-docker-user "$OUTPUT_OWNER_UID"
+
+COPY --chown=$OUTPUT_OWNER_UID  kasmweb/ /src/www
+COPY --chown=$OUTPUT_OWNER_UID  builder/build-www-inside-docker /src/
 
 WORKDIR /src/www
 
+USER $OUTPUT_OWNER_UID
+
 RUN npm install
 
-ENTRYPOINT [ "/src/build_www.sh" ]
+ENTRYPOINT [ "/src/build-www-inside-docker" ]
diff --git a/builder/os_ver_cli.sh b/builder/os_ver_cli.sh
index cc19427..c6b1691 100644
--- a/builder/os_ver_cli.sh
+++ b/builder/os_ver_cli.sh
@@ -12,4 +12,5 @@ if [[ -n "$build_tag" ]]; then
 fi
 os_image="$os:$os_codename"
 
-echo "Building for $os_image"
+echo "Distro image: $os_image"
+echo
diff --git a/builder/scripts/add-docker-user b/builder/scripts/add-docker-user
new file mode 100755
index 0000000..1bd65f2
--- /dev/null
+++ b/builder/scripts/add-docker-user
@@ -0,0 +1,41 @@
+#!/bin/bash
+
+set -eo pipefail
+
+output_owner_is_root() {
+  [ "$output_owner_uid" -eq 0 ]
+}
+
+output_owner_user_exists() {
+  getent passwd "$output_owner_uid" >/dev/null
+}
+
+output_owner_non_root_user_exists() {
+  output_owner_user_exists
+}
+
+add_docker_user_with_homedir_rwx_by_output_owner() {
+  useradd -m docker -u "$output_owner_uid"
+  echo 'docker ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
+}
+
+add_docker_user_with_homedir_that_output_owner_can_compile_in() {
+  if output_owner_is_root; then
+    echo >&2 "ERROR: output owner can't be root"
+    exit 1
+  fi
+
+  if output_owner_non_root_user_exists; then
+    return
+  fi
+
+  add_docker_user_with_homedir_rwx_by_output_owner
+}
+
+output_owner_uid="$1"
+if [[ $# -ne 1 ]]; then
+  echo >&2 "Usage: $(basename "$0") <output_owner_uid>"
+  exit 1
+fi
+
+add_docker_user_with_homedir_that_output_owner_can_compile_in
diff --git a/builder/scripts/build-cpuid b/builder/scripts/build-cpuid
index 0996cb5..97a98a7 100755
--- a/builder/scripts/build-cpuid
+++ b/builder/scripts/build-cpuid
@@ -3,12 +3,15 @@
 set -euo pipefail
 
 build_and_install() {
-    cmake -S . -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DLIBCPUID_ENABLE_TESTS=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Release -GNinja
+    cmake -S . -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DLIBCPUID_ENABLE_TESTS=OFF -DBUILD_SHARED_LIBS=OFF \
+        -DLIBCPUID_BUILD_DRIVERS=OFF -DCMAKE_BUILD_TYPE=Release \
+        -GNinja -DCMAKE_INSTALL_PREFIX=$HOME/.local
     ninja -C build install
 }
 
 prepare_source() {
-    DIR=tbb
+    DIR=cpuid
     cd /tmp
     [ -d ./${DIR} ] && rm -rf ./${DIR}
     mkdir ${DIR}
diff --git a/builder/scripts/build-deps.sh b/builder/scripts/build-deps.sh
index 461aee1..9f132d4 100755
--- a/builder/scripts/build-deps.sh
+++ b/builder/scripts/build-deps.sh
@@ -14,4 +14,4 @@ echo ">> Building cpuid..."
 echo ">> Building fmt..."
 "${source_dir}"/build-fmt
 echo ">> Building libyuv..."
-"${source_dir}"/build-libyuv
\ No newline at end of file
+"${source_dir}"/build-libyuv
diff --git a/builder/scripts/build-fmt b/builder/scripts/build-fmt
index f92eb13..b4d1f32 100755
--- a/builder/scripts/build-fmt
+++ b/builder/scripts/build-fmt
@@ -3,7 +3,9 @@
 set -euo pipefail
 
 build_and_install() {
-    cmake -S . -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Release -GNinja
+    cmake -S . -B build -DCMAKE_POSITION_INDEPENDENT_CODE=ON \
+        -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Release \
+        -DCMAKE_INSTALL_PREFIX=$HOME/.local -GNinja
     ninja -C build install
 }
 
@@ -23,4 +25,4 @@ prepare_source() {
 }
 
 prepare_source
-build_and_install
\ No newline at end of file
+build_and_install
diff --git a/builder/scripts/build-libjpeg-turbo b/builder/scripts/build-libjpeg-turbo
index ed8a737..2d7ccc5 100755
--- a/builder/scripts/build-libjpeg-turbo
+++ b/builder/scripts/build-libjpeg-turbo
@@ -3,7 +3,9 @@
 set -euo pipefail
 
 build_and_install() {
-  cmake -B build -DCMAKE_INSTALL_PREFIX=/usr/local -DCMAKE_POSITION_INDEPENDENT_CODE=ON -GNinja .
+  cmake -B build -DCMAKE_INSTALL_PREFIX=$HOME/.local \
+    -DCMAKE_POSITION_INDEPENDENT_CODE=ON -GNinja \
+    .
   ninja -C build install
 }
 
diff --git a/builder/scripts/build-libyuv b/builder/scripts/build-libyuv
index 7257555..1ed1c76 100755
--- a/builder/scripts/build-libyuv
+++ b/builder/scripts/build-libyuv
@@ -27,10 +27,10 @@ build_and_install() {
     EXTRA_CXXFLAGS=""
   fi
 
-  cp -r include/ /usr/
+  cp -r include/ "$HOME/.local/"
   make V=1 -f linux.mk CFLAGS="-O2 -fomit-frame-pointer -fPIC" CXXFLAGS="-O2 -fomit-frame-pointer -fPIC $EXTRA_CXXFLAGS"
 
-  install -D -m 0644 libyuv.a /usr/lib/libyuv.a
+  install -D -m 0644 libyuv.a "$HOME/.local/lib/libyuv.a"
 }
 
 prepare_source
diff --git a/builder/scripts/build-tbb b/builder/scripts/build-tbb
index dc80175..a45eb3f 100755
--- a/builder/scripts/build-tbb
+++ b/builder/scripts/build-tbb
@@ -6,18 +6,12 @@ build_and_install() {
     if [ $older_release -eq 1 ]; then
         make extra_inc=big_iron.inc work_dir="$PWD"/ tbb_root="$PWD"
 
-        if [ -d /usr/lib/x86_64-linux-gnu ]; then
-            LIBS=lib/x86_64-linux-gnu
-        elif [ -d /usr/lib/aarch64-linux-gnu ]; then
-            LIBS=lib/aarch64-linux-gnu
-        elif [ -d /usr/lib/arm-linux-gnueabihf ]; then
-            LIBS=lib/arm-linux-gnu
-        fi
+        mkdir -p $HOME/.local/lib/pkgconfig
 
-        PC_FILE=/usr/${LIBS}/pkgconfig/tbb.pc
-        echo "prefix=/usr" > "${PC_FILE}"
+        PC_FILE=$HOME/.local/lib/pkgconfig/tbb.pc
+        echo "prefix=$HOME/.local" > "${PC_FILE}"
         echo "exec_prefix=\${prefix}" >> "${PC_FILE}"
-        echo "libdir=\${exec_prefix}/lib/${LIBS}" >> "${PC_FILE}"
+        echo "libdir=\${exec_prefix}/lib/" >> "${PC_FILE}"
         echo "includedir=\${prefix}/include" >> "${PC_FILE}"
         echo "Name: Threading Building Blocks" >> "${PC_FILE}"
         echo "Description: Intel's parallelism library for C++" >> "${PC_FILE}"
@@ -26,10 +20,10 @@ build_and_install() {
         echo "Libs: -ltbb -latomic" >> "${PC_FILE}"
         echo "Cflags: -I\${includedir}" >> "${PC_FILE}"
 
-        cp _release/*.a /usr/"${LIBS}"/
-        cp -r include/* /usr/include/
+        cp _release/*.a $HOME/.local/lib/
+        cp -r include/ $HOME/.local/
     else
-        cmake -B build -DCMAKE_INSTALL_PREFIX=/usr/local \
+        cmake -B build -DCMAKE_INSTALL_PREFIX="$HOME/.local" \
             -DCMAKE_CXX_FLAGS="-Wno-stringop-overflow" \
             -DTBB_TEST=OFF -DBUILD_SHARED_LIBS=OFF -GNinja .
         ninja -C build install
diff --git a/builder/scripts/build-webp b/builder/scripts/build-webp
index af5ddfd..c32cceb 100755
--- a/builder/scripts/build-webp
+++ b/builder/scripts/build-webp
@@ -21,7 +21,7 @@ prepare_source() {
 
 build_and_install() {
   export MAKEFLAGS=-j$(nproc)
-  CONFIG_FLAGS=( --enable-static --disable-shared --enable-threading )
+  CONFIG_FLAGS=( --enable-static --disable-shared --enable-threading --prefix="$HOME/.local")
   ARCH=$(arch)
 
   if [ "$ARCH" = "x86_64" ]; then
@@ -38,4 +38,3 @@ build_and_install() {
 
 prepare_source
 build_and_install
-
diff --git a/builder/scripts/install_sccache_from_github b/builder/scripts/install_sccache_from_github
new file mode 100755
index 0000000..f167db9
--- /dev/null
+++ b/builder/scripts/install_sccache_from_github
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -eo pipefail
+
+detect_ssccache_arch() {
+  arch="$(arch)"
+
+  case $arch in
+    x86_64)
+      sccache_arch=x86_64
+      ;;
+    aarch64)
+      sccache_arch=aarch64
+      ;;
+    *)
+      echo >&2 "Unknown arch: $arch"
+      return 1
+  esac
+}
+
+fetch_sccache_and_put_into_user_local_bin() {
+  cd /tmp
+
+  detect_ssccache_arch
+  wget "https://github.com/mozilla/sccache/releases/download/${sccache_version}/sccache-${sccache_version}-$sccache_arch-unknown-linux-musl.tar.gz"
+
+  tar -xzf sccache*.tar.gz
+  mv sccache*/sccache /usr/local/bin/sccache
+}
+
+cleanup_download() {
+  rm -r sccache*
+}
+
+sccache_version="v0.14.0"
+fetch_sccache_and_put_into_user_local_bin
+cleanup_download
diff --git a/builder/scripts/output_owner.sh b/builder/scripts/output_owner.sh
new file mode 100644
index 0000000..da912d4
--- /dev/null
+++ b/builder/scripts/output_owner.sh
@@ -0,0 +1,93 @@
+#!/bin/bash
+
+as_output_owner() {
+  sudo -u "#$output_owner_uid" "$@"
+}
+
+is_under_sudo() {
+  [[ -n "$SUDO_UID" ]]
+}
+
+is_sudo_invoker_root() {
+  [[ "$SUDO_UID" -eq 0 ]]
+}
+
+is_root() {
+  [[ "$effective_uid" -eq 0 ]]
+}
+
+is_ci() {
+  [[ -n "$CI" ]]
+}
+
+use_effective_uid_and_gid_for_output_owner() {
+  output_owner_uid="$effective_uid"
+  output_owner_gid="$effective_gid"
+}
+
+use_uid_and_gid_of_sudo_invoker_for_output_owner() {
+  output_owner_uid="$SUDO_UID"
+  output_owner_gid="$SUDO_GID"
+}
+
+use_first_non_system_uid_and_gid_for_output_owner() {
+  output_owner_uid=1000
+  output_owner_gid=1000
+
+  if host_output_owner_user_exists; then
+    return
+  fi
+
+  create_host_output_owner_user_and_group
+}
+
+host_output_owner_user_exists() {
+  getent passwd "$output_owner_uid" >/dev/null
+}
+
+create_host_output_owner_user_and_group() {
+  groupadd -g "$output_owner_gid" build
+  useradd -m -u "$output_owner_uid" -g "$output_owner_gid" build
+}
+
+fail_if_sudo_invoker_is_root() {
+  if ! is_sudo_invoker_root; then
+    return
+  fi
+
+  echo >&2 "ERROR: sudo invoker is root. Please call sudo from a non-root user."
+  exit 1
+}
+
+use_non_root_uid_and_gid_for_output_owner_or_fail() {
+  if is_ci; then
+    use_first_non_system_uid_and_gid_for_output_owner
+    return
+  fi
+
+  if is_under_sudo; then
+    fail_if_sudo_invoker_is_root
+
+    use_uid_and_gid_of_sudo_invoker_for_output_owner
+    return
+  fi
+
+  fail_if_there_is_no_way_to_use_non_root
+}
+
+fail_if_there_is_no_way_to_use_non_root() {
+  echo >&2 "ERROR: please don't run this script as root, use sudo if needed."
+  exit 1
+}
+
+select_consistent_output_owner_uid_and_gid() {
+  if ! is_root; then
+    use_effective_uid_and_gid_for_output_owner
+    return
+  fi
+
+  use_non_root_uid_and_gid_for_output_owner_or_fail
+}
+
+effective_uid="$(id -u)"
+effective_gid="$(id -g)"
diff --git a/builder/test/test-build-tarball b/builder/test/test-build-tarball
new file mode 100755
index 0000000..2fa9080
--- /dev/null
+++ b/builder/test/test-build-tarball
@@ -0,0 +1,94 @@
+#!/bin/bash
+
+set -eo pipefail
+
+create_fresh_test_env() {
+  test_env_dir=$(mktemp -d /tmp/kasmvnc-test.XXXXXXX)
+  test_env_dir=$(realpath "$test_env_dir")
+
+  rsync -av --exclude=builder/build --exclude=builder/www "$PWD" "$test_env_dir"
+}
+
+expect_dir_not_to_be_owned_by_root() {
+  local dir="$1"
+  local uid_and_gid_of_dir
+
+  uid_and_gid_of_dir=$(stat -c "%u %g" "$dir")
+  [[ "$uid_and_gid_of_dir" != "0 0" ]] || error "Directory $dir is owned by root"
+}
+
+error() {
+  local message="$1"
+
+  echo >&2 -e "ERROR: $message"
+  exit 1
+}
+
+setup() {
+  project_dir="$PWD"
+  create_fresh_test_env
+  cd "$test_env_dir/"*
+}
+
+cleanup() {
+  cd "$project_dir"
+
+  case "$test_env_dir" in
+    /tmp/*)
+      rm -rf -- "$test_env_dir"
+      ;;
+    *)
+      echo "Refusing to remove unsafe test env dir: $test_env_dir" >&2
+      exit 1
+      ;;
+  esac
+}
+
+expect_build_dirs_not_to_be_owned_by_root() {
+  expect_dir_not_to_be_owned_by_root "$build_dir"
+  expect_dir_not_to_be_owned_by_root "$www_dir"
+  expect_dir_not_to_be_owned_by_root "$sccache_dir"
+}
+
+test_build_dirs_dont_exist() {
+  setup
+
+  [[ ! -d "$build_dir" ]] || error "$build_dir exists in fresh env"
+  [[ ! -d "$www_dir" ]] || error "$www_dir exists in fresh env"
+  [[ ! -d "$sccache_dir" ]] || error "$sccache_dir exists in fresh env"
+
+  cleanup
+}
+
+test_compilation_produces_build_dirs_not_owned_by_root() {
+  setup
+
+  ./builder/build-tarball debian trixie
+
+  expect_build_dirs_not_to_be_owned_by_root
+
+  cleanup
+}
+
+test_sudo_compilation_produces_build_dirs_not_owned_by_root() {
+  setup
+
+  sudo ./builder/build-tarball debian trixie
+
+  expect_build_dirs_not_to_be_owned_by_root
+
+  cleanup
+}
+
+trap cleanup EXIT
+
+build_dir="./builder/build"
+www_dir="./builder/www"
+sccache_dir="./builder/build/.sccache"
+
+test_build_dirs_dont_exist
+test_sudo_compilation_produces_build_dirs_not_owned_by_root
+test_compilation_produces_build_dirs_not_owned_by_root
+
+echo
+echo "All tests green"