Use numeric uid:gid for the opam-repository COPY --chown COPY --link copies onto an empty scratch base, so a name-based --chown has no /etc/passwd to resolve against under BuildKit's containerd image-store worker (the default since Docker 29 / Ubuntu 26.04) and fails with "invalid user index: -1". The opam user is always created with --uid 1000; numeric ids need no lookup and work on both the graphdriver and containerd workers. builds.expected regenerated.