From 3e52939aade4333a4fbbc7fdc566e8ee777dd19c Mon Sep 17 00:00:00 2001
From: Federico Jaramillo Martinez <federicojaramillom@gmail.com>
Date: Sat, 20 Jun 2026 23:45:04 +0200
Subject: [PATCH] fix(docker): initialize dev data permissions

---
 .changeset/docker-dev-data-permissions.md |  5 ++++
 docker/README.md                          |  2 ++
 docker/compose.dev.yml                    | 31 ++++++++++++++++++++---
 3 files changed, 35 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/docker-dev-data-permissions.md

diff --git a/.changeset/docker-dev-data-permissions.md b/.changeset/docker-dev-data-permissions.md
new file mode 100644
index 0000000..6a0b7ea
--- /dev/null
+++ b/.changeset/docker-dev-data-permissions.md
@@ -0,0 +1,5 @@
+---
+"@jmfederico/pi-web": patch
+---
+
+Initialize shared Docker development data directory ownership before starting the dev session daemon.
diff --git a/docker/README.md b/docker/README.md
index 2eab487..68e1f4b 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -214,6 +214,8 @@ Restart `sessiond` manually after changes that affect `src/server/sessiond.ts`,
 
 The dev setup intentionally has the same Docker socket and broad host mounts as the runtime setup. The same trust warnings apply.
 
+On startup, a short `data-init` service creates the shared `/data` subdirectories and gives them to `PI_WEB_UID:PI_WEB_GID`. This handles the common Flatcar/Docker case where a missing bind-mount directory is created as root by the Docker daemon.
+
 ### Sharing runtime and development state
 
 Runtime and dev mode both use `/data` inside the containers. By default they now point at the same host directory:
diff --git a/docker/compose.dev.yml b/docker/compose.dev.yml
index b5359dc..f96cdf7 100644
--- a/docker/compose.dev.yml
+++ b/docker/compose.dev.yml
@@ -15,6 +15,11 @@ x-pi-web-dev-environment: &pi-web-dev-environment
   NPM_CONFIG_UPDATE_NOTIFIER: "false"
   NPM_CONFIG_CACHE: /data/npm-cache
 
+x-pi-web-dev-data-volume: &pi-web-dev-data-volume
+  type: bind
+  source: ${PI_WEB_DOCKER_DATA_DIR:-${HOME}/.local/share/pi-web-docker/data}
+  target: /data
+
 x-pi-web-dev-volumes: &pi-web-dev-volumes
   - type: bind
     source: ..
@@ -22,9 +27,7 @@ x-pi-web-dev-volumes: &pi-web-dev-volumes
   - type: volume
     source: node_modules
     target: /workspace/node_modules
-  - type: bind
-    source: ${PI_WEB_DOCKER_DATA_DIR:-${HOME}/.local/share/pi-web-docker/data}
-    target: /data
+  - *pi-web-dev-data-volume
   - type: bind
     source: /var/run/docker.sock
     target: /var/run/docker.sock
@@ -43,11 +46,33 @@ x-pi-web-dev-volumes: &pi-web-dev-volumes
     read_only: true
 
 services:
+  data-init:
+    build: *pi-web-dev-build
+    image: ${PI_WEB_DEV_IMAGE:-pi-web:dev}
+    command:
+      - bash
+      - -lc
+      - |
+        set -euo pipefail
+        mkdir -p /data/home /data/config /data/npm-cache /data/pi-web /data/pi-agent
+        chown -R "${PI_WEB_UID:-1000}:${PI_WEB_GID:-1000}" /data
+    user: "0:0"
+    security_opt:
+      - label=disable
+    environment:
+      PI_WEB_UID: ${PI_WEB_UID:-1000}
+      PI_WEB_GID: ${PI_WEB_GID:-1000}
+    volumes:
+      - *pi-web-dev-data-volume
+
   sessiond:
     build: *pi-web-dev-build
     image: ${PI_WEB_DEV_IMAGE:-pi-web:dev}
     command: ["npm", "run", "start:sessiond"]
     working_dir: /workspace
+    depends_on:
+      data-init:
+        condition: service_completed_successfully
     user: "${PI_WEB_UID:-1000}:${PI_WEB_GID:-1000}"
     group_add:
       - "${DOCKER_GID:-0}"