Docker build fails with the API, but succeeds with the CLI

I think this is linked to the handling of users and workdirs somehow.

reproductible setup :

FROM alpine

RUN adduser -D user

USER user

WORKDIR /test

RUN echo toto > toto

demonstration of the issue :

(venv)  ⚡ root /tmp/work $ docker build -t toto .
[+] Building 0.7s (8/8) FINISHED                                                                                            docker:default
 => [internal] load .dockerignore                                                                                                     0.0s
 => => transferring context: 2B                                                                                                       0.0s
 => [internal] load build definition from Dockerfile                                                                                  0.0s
 => => transferring dockerfile: 118B                                                                                                  0.0s
 => [internal] load metadata for docker.io/library/alpine:latest                                                                      0.0s
 => CACHED [1/4] FROM docker.io/library/alpine                                                                                        0.0s
 => [2/4] RUN adduser -D user                                                                                                         0.3s
 => [3/4] WORKDIR /test                                                                                                               0.0s
 => [4/4] RUN echo toto > toto                                                                                                        0.3s
 => exporting to image                                                                                                                0.1s
 => => exporting layers                                                                                                               0.0s
 => => writing image sha256:c43656efd75c98cd7cc2f477b7958ffaa1b6cb42c14e8a09fa5b3c89afbf3efe                                          0.0s
 => => naming to docker.io/library/toto                                                                                               0.0s
(venv)  ⚡ root /tmp/work $ python3
Python 3.11.2 (main, Mar 13 2023, 12:18:29) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import docker
>>> a = docker.from_env()
>>> i, l = a.images.build(path=".", forcerm=True, pull=True, timeout=120, rm=True, tag="toto:latest")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/docker/models/images.py", line 285, in build
    raise BuildError(chunk['error'], result_stream)
docker.errors.BuildError: The command '/bin/sh -c echo toto > toto' returned a non-zero code: 1

Start by reproducing the Dockerfile build through the CLI and through docker.from_env().images.build(), focusing on the user and workdir handling in the API path. Compare the build behavior and request options, then verify that the API succeeds with the reported setup and add or update a regression test if the relevant test location is found.