Lando / Lagoon / Gitpod permission woes

Hi - I'm trying to get the Lando+Lagoon integration running in GitPod, but hitting a stumbling block in the php image permissions

lando start reports a set of chown errors on first run:

Creating drupal9base_cli_1 ... done
Creating drupal9base_php_1 ... done
chown: unknown user/group user:/home
chown: unknown user/group user:/home
chown: unknown user/group user:/home
chown: invalid group: 'user:/home'
chown: invalid group: 'user:/home'
chown: invalid group: 'user:/home'
Installing dependencies from lock file (including require-dev)
...

It appears to start, but then the correspondence between php and nginx fails - so every request errors out - and yes, even if Drupal is installed...

php_1        | ERROR: Unable to open primary script: /index.php (No such file or directory)

Looking at the lando logs output:

php_1        | 
php_1        | userperms 06:49:38.INFO  ==> Symlinked users .gitconfig.
php_1        | userperms 06:49:38.INFO  ==> This is a alpine container
php_1        | userperms 06:49:38.INFO  ==> user-perms.sh kicking off as user uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
php_1        | userperms 06:49:38.DEBUG ==> Lando ENVVARS set at
php_1        | userperms 06:49:38.DEBUG ==> 
php_1        | userperms 06:49:38.DEBUG ==> ========================================
php_1        | userperms 06:49:38.DEBUG ==> LANDO_WEBROOT_USER      : user
php_1        | userperms 06:49:38.DEBUG ==> LANDO_WEBROOT_GROUP     : user
php_1        | userperms 06:49:38.DEBUG ==> LANDO_WEBROOT_UID       : 
php_1        | userperms 06:49:38.DEBUG ==> LANDO_WEBROOT_GID       : 
php_1        | userperms 06:49:38.DEBUG ==> LANDO_HOST_UID          : 33333
php_1        | userperms 06:49:38.DEBUG ==> LANDO_HOST_GID          : 33333
php_1        | userperms 06:49:38.DEBUG ==> ========================================
php_1        | userperms 06:49:38.DEBUG ==> 
php_1        | userperms 06:49:38.INFO  ==> Making sure correct user:group (user:user) exists...
php_1        | userperms 06:49:38.INFO  ==> Remapping ownership to handle docker volume sharing...
php_1        | userperms 06:49:38.INFO  ==> Resetting user:user from : to 33333:33333
php_1        | userperms 06:49:38.INFO  ==> user:user is now running as uid=33333(user) gid=33333(user) groups=33333(user),33333(user)!
php_1        | userperms 06:49:38.INFO  ==> And here. we. go.
php_1        | userperms 06:49:38.INFO  ==> Doing the permission sweep.
php_1        | lando 06:49:38.INFO  ==> Lando handing off to: /sbin/tini -- /lagoon/entrypoints.sh /usr/local/sbin/php-fpm -F -R
php_1        | [WARN  tini (98)] Tini is not running as PID 1 and isn't registered as a child subreaper.
php_1        | Zombie processes will not be re-parented to Tini, so zombie reaping won't work.
php_1        | To fix the problem, use the -s option or set the environment variable TINI_SUBREAPER to register Tini as a child subreaper, or run Tini as PID 1.
php_1        | [24-Mar-2022 06:49:38] NOTICE: fpm is running, pid 99
php_1        | [24-Mar-2022 06:49:38] NOTICE: ready to handle connections
php_1        | userperms 06:49:47.INFO  ==> Symlinked users .gitconfig.
php_1        | userperms 06:49:47.INFO  ==> This is a alpine container
php_1        | userperms 06:49:47.INFO  ==> user-perms.sh kicking off as user uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)
php_1        | userperms 06:49:47.DEBUG ==> Lando ENVVARS set at
php_1        | userperms 06:49:47.DEBUG ==> 
php_1        | userperms 06:49:47.DEBUG ==> ========================================
php_1        | userperms 06:49:47.DEBUG ==> LANDO_WEBROOT_USER      : user
php_1        | userperms 06:49:47.DEBUG ==> LANDO_WEBROOT_GROUP     : user
php_1        | userperms 06:49:47.DEBUG ==> LANDO_WEBROOT_UID       : 33333
php_1        | userperms 06:49:47.DEBUG ==> LANDO_WEBROOT_GID       : 1000
php_1        | userperms 06:49:47.DEBUG ==> LANDO_HOST_UID          : 33333
php_1        | userperms 06:49:47.DEBUG ==> LANDO_HOST_GID          : 33333
php_1        | userperms 06:49:47.DEBUG ==> ========================================
php_1        | userperms 06:49:47.DEBUG ==> 
php_1        | userperms 06:49:47.INFO  ==> Making sure correct user:group (user:user) exists...
php_1        | userperms 06:49:47.INFO  ==> Remapping ownership to handle docker volume sharing...
php_1        | userperms 06:49:47.INFO  ==> Resetting user:user from 33333:1000 to 33333:33333
php_1        | userperms 06:49:47.INFO  ==> user:user is now running as uid=33333(user) gid=1000(user) groups=1000(user),1000(user)!
php_1        | userperms 06:49:47.INFO  ==> And here. we. go.
php_1        | userperms 06:49:47.INFO  ==> Doing the permission sweep.
php_1        | chown: unknown user/group user:/home
php_1        | chown: unknown user/group user:/home
php_1        | chown: unknown user/group user:/home
php_1        | lando 06:49:47.INFO  ==> Lando handing off to: /sbin/tini -- /lagoon/entrypoints.sh /usr/local/sbin/php-fpm -F -R

It looks like the second run through of the permission sweep in php_1 is where the problem happens.
I'd certainly appreciate any pointers on whether there's anything special at play here, or whether we need to set some additional permissions in the base images.

The source repo/branch is at https://github.com/tobybellwood/drupal9-base/tree/gitpod

To "fix" it in native docker-compose, we can change the user that the nginx container runs as (to 33333 to match the default gitpod uid) and expose the 8080 port (eg in this commit) - but I've no idea how to effect the same in Lando

lando_lagoon_gitpod.txt

Start by reviewing the gitpod branch of tobybellwood/drupal9-base and reproduce the issue with lando start, focusing on the php_1 permission sweep and the /index.php error. Compare the native docker-compose adjustment in commit f9ad261a5fdd86b23e728807350f750e51e54ed1; done means the Lando/Lagoon Gitpod setup starts without permission errors and serves requests.