13e9865e8d
Container runs as appuser (uid=1000), not app. docker cp copies as root, so tar extract + chown must run as root via docker exec -u root.