small fixes

docker/shulker/Dockerfile

@@ -35,9 +35,10 @@ COPY docker/shulker/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 # Install helpful runtime tools
-RUN apk add --no-cache jq
+RUN apk add --no-cache jq su-exec
 
-USER shulker
+# Start as root to allow entrypoint to chown mounted volumes, then drop to non-root
+USER root
 
 # Shulker default port
 EXPOSE 8000

docker/shulker/entrypoint.sh

@@ -1,6 +1,13 @@
 #!/bin/sh
 set -e
 
+# Ensure runtime dirs exist and are writable for the app user when running as root
+if [ "$(id -u)" = "0" ]; then
+  mkdir -p /data /minecraft/logs || true
+  # 10001 is the shulker user created in the image
+  chown -R 10001:10001 /data /minecraft || true
+fi
+
 # If no config exists in /data, seed it from the example and apply env overrides if provided
 if [ ! -f /data/config.json ]; then
   echo "Seeding /data/config.json from example"
@@ -67,4 +74,11 @@ jq ".IS_LOCAL_FILE=${IS_LOCAL_FILE} | .LOCAL_FILE_PATH=\"${LOCAL_FILE_PATH}\"" /
 # Link config into app directory where shulker expects it
 ln -sf /data/config.json /app/config.json
 
-exec "$@"
+# If running as root, drop privileges to shulker before starting the app
+if [ "$(id -u)" = "0" ]; then
+  # Ensure ownership after seeding as root
+  chown -R 10001:10001 /data || true
+  exec su-exec 10001:10001 "$@"
+else
+  exec "$@"
+fi