I like steering docker runs with docker-compose, especially with .env files - easy to store in repositories, easy to customise and have sane defaults.

Yeah agreed. I use docker-compose. But it doesn't help if the Docker images try to update /etc/passwd, or force a hardcoded UID, or run some install.sh at runtime instead of buildtime.