fix: run container as host PUID/PGID for workspace mounts

node uid 1000 could not read /home/frank (frank=1002); build and compose now use configurable PUID/PGID.

Co-authored-by: Cursor <cursoragent@cursor.com>

compose.yml

@@ -1,54 +1,65 @@
 # PI WEB + Pi Coding Agent behind Traefik + Authelia (external)
 # Deploy: /home/frank/pi.schwenk.online  →  https://pi.schwenk.online
+#
+# PUID/PGID must match the host user that owns WORKSPACE_HOST_PATH (boka: frank=1002).
 
 services:
   sessiond:
-    build: .
+    build:
+      context: .
+      args:
+        PUID: ${PUID:-1002}
+        PGID: ${PGID:-1002}
     image: pidevremote-pi:local
     container_name: pi-sessiond
     restart: unless-stopped
+    user: "${PUID:-1002}:${PGID:-1002}"
     command: ["pi-web-sessiond"]
     env_file:
       - .env
     environment:
-      HOME: /home/node
+      HOME: /home/pi
       PI_WEB_CONFIG: /etc/pi-web/config.json
       PI_WEB_DATA_DIR: /data/pi-web
       PI_WEB_SESSIOND_SOCKET: /data/pi-web/sessiond.sock
-      PI_CODING_AGENT_DIR: /home/node/.pi/agent
+      PI_CODING_AGENT_DIR: /home/pi/.pi/agent
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
     volumes:
       - ./data/pi-web:/data/pi-web
-      - ./data/pi-agent:/home/node/.pi/agent
+      - ./data/pi-agent:/home/pi/.pi/agent
       - ${WORKSPACE_HOST_PATH:-./workspaces}:/workspaces
     networks:
       - internal
 
   web:
-    build: .
+    build:
+      context: .
+      args:
+        PUID: ${PUID:-1002}
+        PGID: ${PGID:-1002}
     image: pidevremote-pi:local
     container_name: pi-web
     restart: unless-stopped
+    user: "${PUID:-1002}:${PGID:-1002}"
     command: ["pi-web-server"]
     depends_on:
       - sessiond
     env_file:
       - .env
     environment:
-      HOME: /home/node
+      HOME: /home/pi
       PI_WEB_CONFIG: /etc/pi-web/config.json
       PI_WEB_DATA_DIR: /data/pi-web
       PI_WEB_SESSIOND_SOCKET: /data/pi-web/sessiond.sock
       PI_WEB_HOST: "0.0.0.0"
       PI_WEB_PORT: "8504"
       PI_WEB_ALLOWED_HOSTS: pi.schwenk.online
-      PI_CODING_AGENT_DIR: /home/node/.pi/agent
+      PI_CODING_AGENT_DIR: /home/pi/.pi/agent
       OPENROUTER_API_KEY: ${OPENROUTER_API_KEY:-}
     volumes:
       - ./data/pi-web:/data/pi-web
-      - ./data/pi-agent:/home/node/.pi/agent
+      - ./data/pi-agent:/home/pi/.pi/agent
       - ${WORKSPACE_HOST_PATH:-./workspaces}:/workspaces
-    # No host port publish — Traefik reaches the container on the traefik network
     expose:
       - "8504"
     networks: