Volume mount the user's ~/.capo directory to /home/ssa/capo in the image

The idea here is that you can put a docker.properties in ~/.capo and it will pick it up from /home/ssa/capo inside the container, in local mode. You still have to manually put the ALMA settings in a docker.properties in your home, but no credentials leak into the system. Capo should "just work"—but I haven't tested it.