- Use DATA_DIR=/config (config:rw map) per maintainer request - Scope chmod to /entrypoint.sh and cont-init.d instead of whole FS - Gate chown -R behind .initialized marker to avoid slow restarts