I played with this a bit in my dev environment and it works reasonably well:

```hcl
resource "chainguard_apko_build" "build" {
  repo = chainguard_image_repo.static.id

  config = jsonencode({
    contents = {
      repositories = [
        "https://packages.wolfi.dev/os"
      ]
      keyring = [
        "https://packages.wolfi.dev/os/wolfi-signing.rsa.pub"
      ]
      packages = [
        "tzdata",
        "wolfi-baselayout",
        "ca-certificates-bundle",
      ]
    }
    accounts = {
      groups = [{
        groupname: "nonroot"
        gid: 65532
      }]
      users = [{
        username: "nonroot"
        uid: 65532
        gid: 65532
      }]
      run-as: 65532
    }
    archs: ["aarch64"]
  })
}
```

Signed-off-by: Matt Moore <[email protected]>