Run as PUID:PGID with a configurable umask

The image now starts through docker-entrypoint.sh: as root it hands
/data and the backup folder to PUID:PGID (only files owned by someone
else, so restarts stay fast), applies UMASK, and runs Canon as that
user with su-exec. Started with --user, it runs Canon directly. The
image defaults to 1000:1000; the Compose file presets Unraid's 99:100.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Dockerfile

@@ -7,15 +7,20 @@ ARG VERSION=dev
 RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/canon ./cmd/canon
 
 FROM alpine:3
-RUN apk add --no-cache ca-certificates tzdata \
- && adduser -D -u 1000 canon \
- && mkdir -p /data /backups && chown canon:canon /data /backups
+RUN apk add --no-cache ca-certificates tzdata su-exec \
+ && mkdir -p /data /backups
 COPY --from=build /out/canon /usr/local/bin/canon
-USER canon
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod 755 /usr/local/bin/docker-entrypoint.sh
+# The entrypoint starts as root only to set ownership, then runs Canon as
+# PUID:PGID.
 ENV CANON_DATA_DIR=/data \
-    CANON_PORT=4242
+    CANON_PORT=4242 \
+    PUID=1000 \
+    PGID=1000 \
+    UMASK=022
 VOLUME /data /backups
 EXPOSE 4242
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s \
   CMD wget -qO- http://127.0.0.1:${CANON_PORT}/healthz >/dev/null || exit 1
-ENTRYPOINT ["canon"]
+ENTRYPOINT ["docker-entrypoint.sh"]