Dockerfile files are owned as Docker owns them

COPY and ADD now write files owned by root unless --chown says otherwise, whatever the USER, and a WORKDIR that does not exist yet is made for the current USER. So USER node, WORKDIR /app, COPY . ., RUN npm ci builds, where it failed on an /app only root could write. See Build from a Dockerfile.