- Add entrypoint script that ensures /data is owned by node user before dropping privileges with su-exec - Remove USER node from Dockerfile (entrypoint handles it) - Change client depends_on to service_healthy so nginx waits for the server to pass its healthcheck before starting