diff --git a/build/build-win64-from-linux.sh b/build/build-win64-from-linux.sh
index 74c307c89..7f23d78c3 100755
--- a/build/build-win64-from-linux.sh
+++ b/build/build-win64-from-linux.sh
@@ -1,5 +1,6 @@
-#!/usr/bin/env sh
+#!/bin/bash
 
+set -e
 # Number of jobs == core count
 jobs=$(grep -c ^processor /proc/cpuinfo)
 
@@ -8,20 +9,36 @@ srcdir=$(realpath "$(dirname "$(readlink -f "$0")")"/..)
 
 cd "$srcdir"/build
 
+builder_uid=$(id -u)
+
 mkdir -p win64-cross
 mkdir -p win64-cross/output
 
+# Check for sudo; we want to use the real user
+if [[ $(id -u) -eq 0 ]]; then
+    if [[ -z "$SUDO_UID" || "$SUDO_UID" -eq 0 ]]; then
+        echo "Please don't run this script directly as root, use sudo instead:"
+        echo
+        echo "  sudo $0"
+        # This is because we can't change the buildmaster UID in the container to 0 --
+        # that's already taken by root.
+        exit 1
+    fi
+
+    # If this was run using sudo, let's make sure the directories are owned by the
+    # real user (and set the BUILDER_UID to it)
+    builder_uid=$SUDO_UID
+    chown $builder_uid win64-cross win64-cross/output
+fi
+
 # Assumes you built a container image called dfhack-build-msvc from
 # https://github.com/BenLubar/build-env/tree/master/msvc, see
 # docs/dev/compile/Compile.rst.
 #
 # NOTE: win64-cross is mounted in /src/build due to the hardcoded `cmake ..` in
 # the Dockerfile
-#
-# TODO: make this work for rootless docker, i.e. remove the sudo for those that
-# don't normally need to use sudo to run docker.
-if ! sudo docker run --rm -it -v "$srcdir":/src -v "$srcdir/build/win64-cross/":/src/build  \
-    --user buildmaster \
+if ! docker run --rm -it -v "$srcdir":/src -v "$srcdir/build/win64-cross/":/src/build  \
+    -e BUILDER_UID=$builder_uid \
     --name dfhack-win \
     dfhack-build-msvc bash -c "cd /src/build && dfhack-configure windows 64 Release -DCMAKE_INSTALL_PREFIX=/src/build/output && dfhack-make -j$jobs install" \
     ; then
diff --git a/docs/dev/compile/Compile.rst b/docs/dev/compile/Compile.rst
index 8e38139fa..f91c43c07 100644
--- a/docs/dev/compile/Compile.rst
+++ b/docs/dev/compile/Compile.rst
@@ -387,10 +387,7 @@ It'll be called ``dfhack-build-msvc:latest`` after it's done building::
 
    git clone https://github.com/BenLubar/build-env.git
    cd build-env/msvc
-   docker build --build-arg BUILDER_UID=$(id -u) -t dfhack-build-msvc .
-
-The ``BUILDER_UID`` argument is used to make sure the build user can access your
-source code directory inside the container.
+   docker build -t dfhack-build-msvc .
 
 The docker build takes a while, but only needs to be done once, unless the build
 environment changes.
@@ -406,14 +403,15 @@ Check out ``dfhack`` into another directory, and run the build script::
    cd build
    ./build-win64-from-linux.sh
 
-The last step may ask you for your ``sudo`` password -- if you are able to run
-``docker`` without ``sudo`` normally, you can remove the ``sudo`` from the build
-script.
-
 The script will mount your host's ``dfhack`` directory to docker, use it to
 build the artifacts in ``build/win64-cross``, and put all the files needed to
 install in ``build/win64-cross/output``.
 
+If you need to run ``docker`` using ``sudo``, run the script using ``sudo``
+rather than directly::
+
+  sudo ./build-win64-from-linux.sh
+
 Step 3: install dfhack to your Steam DF install
 -----------------------------------------------
 As the script will tell you, you can then copy the files into your DF folder::