fix(docker): initialize dev data permissions

.changeset/docker-dev-data-permissions.md

@@ -0,0 +1,5 @@
+---
+"@jmfederico/pi-web": patch
+---
+
+Initialize shared Docker development data directory ownership before starting the dev session daemon.

docker/README.md

@@ -214,6 +214,8 @@ Restart `sessiond` manually after changes that affect `src/server/sessiond.ts`,
 
 The dev setup intentionally has the same Docker socket and broad host mounts as the runtime setup. The same trust warnings apply.
 
+On startup, a short `data-init` service creates the shared `/data` subdirectories and gives them to `PI_WEB_UID:PI_WEB_GID`. This handles the common Flatcar/Docker case where a missing bind-mount directory is created as root by the Docker daemon.
+
 ### Sharing runtime and development state
 
 Runtime and dev mode both use `/data` inside the containers. By default they now point at the same host directory:

docker/compose.dev.yml

@@ -15,6 +15,11 @@ x-pi-web-dev-environment: &pi-web-dev-environment
   NPM_CONFIG_UPDATE_NOTIFIER: "false"
   NPM_CONFIG_CACHE: /data/npm-cache
 
+x-pi-web-dev-data-volume: &pi-web-dev-data-volume
+  type: bind
+  source: ${PI_WEB_DOCKER_DATA_DIR:-${HOME}/.local/share/pi-web-docker/data}
+  target: /data
+
 x-pi-web-dev-volumes: &pi-web-dev-volumes
   - type: bind
     source: ..
@@ -22,9 +27,7 @@ x-pi-web-dev-volumes: &pi-web-dev-volumes
   - type: volume
     source: node_modules
     target: /workspace/node_modules
-  - type: bind
-    source: ${PI_WEB_DOCKER_DATA_DIR:-${HOME}/.local/share/pi-web-docker/data}
-    target: /data
+  - *pi-web-dev-data-volume
   - type: bind
     source: /var/run/docker.sock
     target: /var/run/docker.sock
@@ -43,11 +46,33 @@ x-pi-web-dev-volumes: &pi-web-dev-volumes
     read_only: true
 
 services:
+  data-init:
+    build: *pi-web-dev-build
+    image: ${PI_WEB_DEV_IMAGE:-pi-web:dev}
+    command:
+      - bash
+      - -lc
+      - |
+        set -euo pipefail
+        mkdir -p /data/home /data/config /data/npm-cache /data/pi-web /data/pi-agent
+        chown -R "${PI_WEB_UID:-1000}:${PI_WEB_GID:-1000}" /data
+    user: "0:0"
+    security_opt:
+      - label=disable
+    environment:
+      PI_WEB_UID: ${PI_WEB_UID:-1000}
+      PI_WEB_GID: ${PI_WEB_GID:-1000}
+    volumes:
+      - *pi-web-dev-data-volume
+
   sessiond:
     build: *pi-web-dev-build
     image: ${PI_WEB_DEV_IMAGE:-pi-web:dev}
     command: ["npm", "run", "start:sessiond"]
     working_dir: /workspace
+    depends_on:
+      data-init:
+        condition: service_completed_successfully
     user: "${PI_WEB_UID:-1000}:${PI_WEB_GID:-1000}"
     group_add:
       - "${DOCKER_GID:-0}"