The deploy user runs scripts as root via passwordless sudo, avoiding ownership conflicts with Docker-mounted volumes.
/opt already exists on Linux systems and git clone refuses to clone into a non-empty directory.