What’s the proper way to setup WP-CLI on Ubuntu so that I don’t have to use the flag –allow-root?

All files and folders should be owned by www-data user and group if not then WordPress can’t change files hence fails to update from dashboard. wp-cli says to use sudo -u www-data -i -- wp <command> but that gives This account is currently not available.

Why? See this answer: https://askubuntu.com/a/486661/695240

You’re getting the This account is currently not available. error because the shell for the user www-data is set to /usr/sbin/nologin, and it’s set for a very good reason. You should not log in as www-data, it’s a special user/group used by the web server, not intended for regular shell use.

EDIT: It is an especially bad idea to give sudo rights to www-data. If Apache was intended to run with root permissions, it wouldn’t have it’s own group. By doing this, you are creating huge security holes. You have been warned.

What is the solution?
Use sudo -u www-data wp<command>. So you don’t have problem using wp-cli and is safe. All files create by wp-cli will be owned by www-data.