fix(docker): actually run all seven servers as their non-root user

src/everything/Dockerfile

@@ -19,4 +19,6 @@ ENV NODE_ENV=production
 
 RUN npm ci --ignore-scripts --omit-dev
 
+USER node
+
 CMD ["node", "dist/index.js"]

src/fetch/Dockerfile

@@ -26,6 +26,12 @@ FROM python:3.12-slim-bookworm
 WORKDIR /app
 
 COPY --from=uv /root/.local /root/.local
+# /root defaults to 700, which blocks any non-root user from even traversing
+# into /root/.local — and the venv's own python binary is a symlink into
+# /root/.local/share/uv/python/.../bin/python3.11, resolved at every startup,
+# not just at build time. Without this, switching to a non-root USER below
+# breaks the interpreter itself, not just file access.
+RUN chmod o+rx /root
 
 RUN if ! id -u app >/dev/null 2>&1; then \
       useradd -rUM -s /usr/sbin/nologin app; \
@@ -35,5 +41,7 @@ COPY --from=uv --chown=app:app /app/.venv /app/.venv
 # Place executables in the environment at the front of the path
 ENV PATH="/app/.venv/bin:$PATH"
 
+USER app
+
 # when running the container, add --db-path and a bind mount to the host's db file
 ENTRYPOINT ["mcp-server-fetch"]

src/filesystem/Dockerfile

@@ -22,4 +22,6 @@ ENV NODE_ENV=production
 
 RUN npm ci --ignore-scripts --omit-dev
 
+USER node
+
 ENTRYPOINT ["node", "/app/dist/index.js"]

src/git/Dockerfile

@@ -29,6 +29,12 @@ RUN apt-get update && apt-get install -y git git-lfs && rm -rf /var/lib/apt/list
 WORKDIR /app
 
 COPY --from=uv /root/.local /root/.local
+# /root defaults to 700, which blocks any non-root user from even traversing
+# into /root/.local — and the venv's own python binary is a symlink into
+# /root/.local/share/uv/python/.../bin/python3.11, resolved at every startup,
+# not just at build time. Without this, switching to a non-root USER below
+# breaks the interpreter itself, not just file access.
+RUN chmod o+rx /root
 
 RUN if ! id -u app >/dev/null 2>&1; then \
       useradd -rUM -s /usr/sbin/nologin app; \
@@ -38,5 +44,13 @@ COPY --from=uv --chown=app:app /app/.venv /app/.venv
 # Place executables in the environment at the front of the path
 ENV PATH="/app/.venv/bin:$PATH"
 
+# The container's job is exclusively to operate on whichever repo is bind-mounted
+# in, so there's no meaningful "wrong owner" for git to protect against here the
+# way there is on a shared host; without this, git refuses to touch a repo owned
+# by a different uid than the app user once we stop running as root below.
+RUN git config --system --add safe.directory '*'
+
+USER app
+
 # when running the container, add --db-path and a bind mount to the host's db file
 ENTRYPOINT ["mcp-server-git"]

src/memory/Dockerfile

@@ -21,4 +21,12 @@ WORKDIR /app
 
 RUN npm ci --ignore-scripts --omit-dev
 
+# Without MEMORY_FILE_PATH set, the server persists its knowledge graph next
+# to its own compiled entrypoint (dist/memory.jsonl) — dist was just copied in
+# as root, so the app user needs ownership of it before it can create/update
+# that file, including when a named volume (see README) mounts over dist/.
+RUN chown -R node:node /app/dist
+
+USER node
+
 ENTRYPOINT ["node", "dist/index.js"]

src/sequentialthinking/Dockerfile

@@ -21,4 +21,6 @@ WORKDIR /app
 
 RUN npm ci --ignore-scripts --omit-dev
 
+USER node
+
 ENTRYPOINT ["node", "dist/index.js"]

src/time/Dockerfile

@@ -26,6 +26,12 @@ FROM python:3.12-slim-bookworm
 WORKDIR /app
 
 COPY --from=uv /root/.local /root/.local
+# /root defaults to 700, which blocks any non-root user from even traversing
+# into /root/.local — and the venv's own python binary is a symlink into
+# /root/.local/share/uv/python/.../bin/python3.11, resolved at every startup,
+# not just at build time. Without this, switching to a non-root USER below
+# breaks the interpreter itself, not just file access.
+RUN chmod o+rx /root
 
 RUN if ! id -u app >/dev/null 2>&1; then \
       useradd -rUM -s /usr/sbin/nologin app; \
@@ -38,5 +44,7 @@ ENV PATH="/app/.venv/bin:$PATH"
 # Set the LOCAL_TIMEZONE environment variable
 ENV LOCAL_TIMEZONE=${LOCAL_TIMEZONE:-"UTC"}
 
+USER app
+
 # when running the container, add --local-timezone and a bind mount to the host's db file
 ENTRYPOINT ["mcp-server-time", "--local-timezone", "${LOCAL_TIMEZONE}"]