Probably these images should use option 1 the same as the docker build does. Note that the docker build uses a slight variant on option 1 that does not use the Mojolicious::Plugin::SetUserGroup module. It runs the webwork2 app via "sudo -E -u www-data hypnotoad -f bin/webwork2" which is why this issue doesn't happen for the docker build. It can do this because it doesn't bind to port 80 directly. Instead it binds to port 8080, and so does not need to run as root initially. Port 80 or port 443 for ssl are externally exposed by docker.
Using option 1 shouldn't conflict with using the same server for sending email since that uses a different port.
Using option 1 shouldn't conflict with using the same server for sending email since that uses a different port.