- add docker-entrypoint.sh that creates and chowns /app/data at startup - run as nextjs via su-exec after fixing directory ownership - handle root-owned named volumes created by earlier images