Apparently the best practice to achieve rootless is:
So USER=mysql in the container file.
given https://github.com/MariaDB/mariadb-docker/blob/master/docker-entrypoint.sh#L350 is the only usage of gosu, and its conditional, I'm note sure why the previous folks didn't do it. I'll ask.
Interesting interactions need investigating