From df6bc4989c915bc2ad17236f12d2e4e8aa124139 Mon Sep 17 00:00:00 2001
From: prosolis <5590409+prosolis@users.noreply.github.com>
Date: Sun, 26 Jul 2026 23:11:00 -0700
Subject: [PATCH] Run the container as the host uid that owns the ./data bind
 mount

The image's own petal user (uid 10001) has no claim on a bind-mounted
host directory, so SQLite came up with "unable to open database file
(14)" and the container restart-looped. Run as the stack directory's
owner instead of chowning ./data to 10001 -- the backup script gzips
snapshots in place from the host, so that account needs write access to
the same directory. Still non-root.
---
 deploy/petal.env.example | 6 ++++++
 docker-compose.yml       | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/deploy/petal.env.example b/deploy/petal.env.example
index 372439f..1f2f06e 100644
--- a/deploy/petal.env.example
+++ b/deploy/petal.env.example
@@ -14,6 +14,12 @@ BASE_URL=https://petal.parodia.dev
 # The companion's bedtime nag and the night theme read the container clock.
 TZ=Europe/Lisbon
 
+# The container runs as this uid/gid so it can write the ./data bind mount.
+# Set both to the output of `id -u` / `id -g` for the account owning the stack
+# directory. Wrong values show up as "unable to open database file (14)".
+PETAL_UID=1001
+PETAL_GID=1001
+
 # --- LLM (millenia, over headscale) ------------------------------------------
 # The only cross-VPN dependency. Petal degrades warmly when it's unreachable:
 # spell check, gloss, garden, search, export and read-aloud all keep working and
diff --git a/docker-compose.yml b/docker-compose.yml
index c62d83b..6d498ff 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -24,6 +24,13 @@ services:
     image: petal:local
     container_name: petal
     restart: unless-stopped
+    # ./data is a bind mount, so the image's own `petal` user (uid 10001) has no
+    # claim on it — the host's ownership wins and the container can't open
+    # petal.db. Run as whoever owns the stack directory instead. Keeping it the
+    # host user (rather than chowning ./data to 10001) is deliberate: the backup
+    # script gzips snapshots in place from the host, so the host account needs
+    # write access to the same directory. Still never root.
+    user: "${PETAL_UID:-1001}:${PETAL_GID:-1001}"
     env_file: .env
     environment:
       # Fixed by the image layout; kept here so they're visible at a glance.