- Add docker-entrypoint.sh that runs as root to fix mounted volume permissions - Creates required subdirectories (logs, users, packages) before app starts - Copies default config.js if missing - Drops to node user via su-exec before running the app - Update Dockerfile to use entrypoint and install su-exec - Update docker-compose.yml with UID/GID mapping and separate volume mounts - Wrap filesystem operations in try-catch to handle permission errors gracefully