check / check (push) Successful in 1m9s
The runtime image no longer sets USER. Its new entrypoint, deploy/docker-entrypoint.sh, runs as root: it creates the data directory if needed, gives it and everything in it to the dnswatcher user (uid 10001) with mode 700 on the directory, then runs dnswatcher as that user with su-exec. An empty root-owned host directory, or one holding a state file left by another uid, now works with no step on the host, so the README's instruction to create and chown it is gone. The startup check that the data directory is writable stays. Model: opus-5-5