Use setpriv instead of runuser to avoid extra process

This prevents `runuser` from displaying the judge credentials to
everyone on the same machine.

.docker/entry

@@ -11,13 +11,14 @@ cd /judge || exit
 case "$1" in
 run) command=(/env/bin/dmoj) ;;
 cli) command=(/env/bin/dmoj-cli) ;;
-test) command=(/env/bin/python3 -- -m dmoj.testsuite testsuite) ;;
+test) command=(/env/bin/python3 -m dmoj.testsuite testsuite) ;;
 *)
   echo "Invalid command, must be one of [run, cli, test]" 1>&2
   exit 1
   ;;
 esac
 
 shift
+export HOME=~judge
 . ~judge/.profile
-exec runuser -u judge "${command[@]}" -- "$@"
+exec setpriv --reuid judge --regid judge --clear-groups "${command[@]}" "$@"