The user, working directory and environment commands run with.
Mirrors docker run -u / -w / -e: user and work_dir replace the
layer below, env_vars merge into it key by key. It applies at three
points, each layered over the one before -- the snapshot, the sandbox, and
a single command.
