Native amd64 image cannot run as non-root (--user 1000:1000 fails on ./log), volumes not interchangeable with the JVM image #10319

Reported by a contributor.

Symptoms

• docker run --user 1000:1000 arcadedata/arcadedb:<version>-native ... (the example documented in docs/native-image.md, "Running the container") exits immediately on linux/amd64 with:

  AccessDeniedException: ./log/arcadedb.log.0.lck
  

• Rebuilding on top of it (FROM arcadedata/arcadedb:latest-native + COPY --chown=...) is not enough: config stays owned by root and the server cannot write server-users.jsonl. The only working workaround is re-copying everything into a fresh FROM scratch with /home/arcadedb and /tmp copied --chown=1000:1000.

Cause

native/src/main/docker/Dockerfile.native.scratch:

• the busybox dirs stage creates databases, backups, replication, log with chown -R 0:0 (mode 755), and config is copied without --chown
• all five paths are declared VOLUME; Docker initializes an anonymous volume with the ownership of the image directory, so every volume starts root-owned and is not writable by UID 1000
• there is no USER, so the image runs as UID 0 by default

The docs only tell the user to align the ownership of the databases bind mount, which does not cover log or config.

Why it matters

• The JVM image runs as arcadedb (UID 1000, package/src/main/docker/Dockerfile).
• When the native image runs as root, the files it writes on the volumes are owned by root, and the security files are mode 600 (SecurityUserFileRepository.applyOwnerOnlyPermissions). Going back to the JVM image is then no longer a plain image swap: the volumes have to be re-owned first.
• The linux/arm64 distroless image runs as nonroot (65532), so it does not match the JVM image's UID either.

Proposed fix

• In Dockerfile.native.scratch, create /home/arcadedb/** (including config) owned by 1000:1000 and declare USER 1000:1000, as Dockerfile.native.distroless already does with nonroot.
• Decided: move the arm64 distroless image to UID/GID 1000:1000 as well (instead of nonroot 65532), so the JVM, amd64-native and arm64-native images all share the same volume ownership. In Dockerfile.native.distroless: chown -R 1000:1000 in the dirs stage, --chown=1000:1000 on the COPYs, USER 1000:1000. The :nonroot base tag only adds a 65532 /etc/passwd entry; the binary does not need a passwd entry for its UID, so the plain base-debian12 tag (pinned by digest) with USER 1000:1000 is enough.
• This changes the default owner of the arm64 image's volumes: existing arm64-native deployments with volumes written as 65532 need a one-time chown -R 1000:1000 (release note).
• Update the "Running the container" section of docs/native-image.md accordingly.

Verification

Boot the amd64 image with no --user and with --user 1000:1000, with anonymous volumes and with a bind-mounted databases, and check that the server starts, writes log/ and config/server-users.jsonl.